documentation/docs/admin-guide/configuration/desktop/xrdp.md

RDP Remote Access with XRDP

The basic configuration in Hiera is:

xrdp::enable: true

Remote Access Modes

Terminal Server Mode

By default XRDP runs in terminal server mode where only virtual desktop sessions are available. The explicit configuration would be:

xrdp::mode: 'virtual_desktops_only'

Access to Physical Desktop

!!! warning Accessing to your/a real physical desktop session causes a security risk with people having physical access to the workstation. They can see on the real monitor what you are doing and interfere with keyboard and mouse. It is similar as if you are away from the workstation and have the screen unlocked.

Note that due to technical limitations it is only possible to access the primary screen in multi-monitor setups.

For accessing the physical desktop there are three different modes supported:

xrdp::mode: 'access_users_physical_desktop_or_fallback_to_virtual_desktop'

This allow to access to currently running desktop of the accessing user or, if none exists, creates automatically a virtual desktop. Note that you should log out of the virtual desktop before logging in again on the physical desktop. But it is fine to have multiple different users running own virtual desktops as long as they are different to the one using the physical desktop.

xrdp::mode: 'access_physical_desktop_of_whatever_user_logged_in'

This mode is for the case where a shared account (GAC-account or e-account) is used e.g. on a console. Whoever has permissions to log into this computer can see and interact with the physical desktop, independent of the actual user which runs the desktop session.

In this and only this mode you can even access the login window of the session manager gdm. Note that you cannot login with your own account, you need to use another one, e.g. the GAC-account. After successful login you connection terminates as the Xorg session of gdm terminates too. But if you connect again you get access to the new desktop session.

There are no virtual sessions possible in this mode.

xrdp::mode: 'user_selects_physical_or_virtual_desktop'

If you or your users can make an informed decision if they want to use a virtual session or access the physical session then you can give offer them the selection using this mode.

Automatically Close Sessions

If you may want that the users cannot keep their desktop sessions open forever, you may configure their sessions to be closed after they have been disconnected for some time (seconds). The default value is 0 which disables this feature.

xrdp::disconnected_session_timeout: 3600

Legacy Settings

These settings apply if one of the two Hiera keys below are set to true or false:

Allow to connect to a VNC server listening on localhost:5900:

xrdp::shared_desktop::enable: true

Allow virtual desktop sessions:

xrdp::virtual_desktop::enable: true

"Unsupported" Settings

If you want to allow the same user to be able to open in parallel a local and a remote session then you can enable the systemd nest feature. Note that this is a hack and goes against the systemd design and thus this can lead to unexpected problems.

xrdp::nest_systemd::enable: true

Notes

• Changes are not automatically applided, it needs a restart of xrdp first (e.g. reboot or systemctl restart xrdp) which will close all running connections.
• Users that are only allowed to login locally to the system (i.e. with an entry like this +:ebner-adm:LOCAL in /etc/security/access_users.conf) cannot use RDP virtual sessions.

Troubleshouting

Gnome does not start despite proper login

If the log shows

xrdp-sesexec[3145015]: [WARN ] Window manager (pid 3145116, display 11) exited quickly (0 secs). This could indicate a window manager config problem

then there is probably a half dead Gnome session around. Check with loginctl for such a session of given user and terminate it with

loginctl kill-session $SESSION_NUMBER

After Gnome should start properly again.

Session Already Running

Systemd and Gnome do not really allow for more than one concurrent session for the same user.

Easiest solution: reboot/powercycle the machine.

Or somehow connect to the other session and close it (using RDP from a colleagues machine, etc.).

If you can log in with ssh you can also terminate the session from the shell:

[buchel_k@lxdev08 ~]$ loginctl 
SESSION   UID USER     SEAT  TTY   STATE  IDLE SINCE
     11 44951 buchel_k       pts/0 active no        
     13 44951 buchel_k seat0 tty2  active no        

2 sessions listed.
[buchel_k@lxdev08 ~]$ loginctl kill-session 13
[buchel_k@lxdev08 ~]$ 

As seen above, physical sessions have a "seat", whereas the ssh session has a pts (pseudo terminal).

Virtual sessions do not have a "tty":

[buchel_k@lxdev08 ~]$ loginctl 
SESSION   UID USER     SEAT  TTY   STATE  IDLE SINCE
     11 44951 buchel_k       pts/0 active no        
     15 44951 buchel_k       n/a   active no        
     c3    42 gdm      seat0 tty1  active no        

3 sessions listed.
[buchel_k@lxdev08 ~]$
[buchel_k@lxdev08 ~]$ loginctl  show-session 15
Id=15
User=44951
Name=buchel_k
Timestamp=Fri 2026-03-20 10:21:03 CET
TimestampMonotonic=59919783992
VTNr=0
Display=:11
Remote=yes
RemoteHost=::ffff:129.129.175.98
Service=xrdp-sesman
Scope=session-15.scope
Leader=95172
Audit=15
Type=x11
Class=user
Active=yes
State=active
IdleHint=no
IdleSinceHint=0
IdleSinceHintMonotonic=0
LockedHint=no
[buchel_k@lxdev08 ~]$ 

To kill a session of another user you need to be root.