xRDP with Microsoft Authenticator

[Maddiuz]

Hello :)

I've been going mad with trying to use XRDP to work with Azure Entra ID and MFA.

The setup:

• The VM is in Azure. It's Ubuntu 24.04. It's Entra ID registered with the Entra ID Extension.
• The client is Windows 11.
• We use Azure Bastion to SSH and RDP to VMs.

Main Problem:
I can RDP to the VM.
I get the XRDP login prompt.
I can login with my Entra ID credentials. But after login, the login prompt goes away and i'm left with the turkish blue background that comes with xRDP.

When checking the log (xrdp-sesman.log) i see that there's a line from PAM giving me a device code to enter with a Microsoft URL.
When i enter the URL and enter the device code given in the xrdp-sesman.log on my Windows PC i can login successfully on the VM.
This is obviously not how it should work...

I've seen a couple of users on various forums getting the same error, but i haven't seen anyone posting a real solution to this.

I've tried multiple things to no avail. But now i see that there's a Google Authenticator module for PAM. Reading the forum Wiki i see that i can work with any TOTP. That does mean it should work with Microsoft Authenticator.

So i just want to be 100 % that this will work before i try to setup this, seeing that it is a tedious setup.
Also, it would be nice to know if anyone have had direct experience with doing this with the Microsoft Authenticator, and if you experienced any shortcomings/problems.

[matt335672]

xrdp doesn't currently support additional PAM prompts. The only way to get this working currently is to enter the password and TOTP code together. Follow the wiki and you should be fine.

[matt335672]

Come back to us if you have any probs. Also, if you're successful, it would be nice to hear that too :-)

[Maddiuz]

Had a go at it, and it seems that it works with Authenticator! :D Haven't tested it yet because i'm having trouble accessing the VM now, but that's another issue...

I've switched to Red Hat Enterprise 9 on the server side to make it easier to follow the guide.

But i can't seem to get xRDP to work. Can't connect to the VM at all. This was no issue on the ubuntu, so i have probably done something wrong with the setup.

Looks like xRDP aren't reacting at all.

(I'm fairly new to xRDP, and i'm a little rusty with Linux, so bear with me....)

I've checked xsession-errors. It's empty...

/var/log/xrdp.log:
[2024-11-27T10:22:44.722+0100] [INFO ] starting xrdp with pid 1515
[2024-11-27T10:22:44.730+0100] [INFO ] address [0.0.0.0] port [3389] mode 1
[2024-11-27T10:22:44.733+0100] [INFO ] listening to port 3389 on 0.0.0.0
[2024-11-27T10:22:44.739+0100] [INFO ] xrdp_listen_pp done

/var/log/xrdp-sesman.log
[2024-11-27T10:22:44.609+0100] [INFO ] starting xrdp-sesman with pid 1506
[2024-11-27T10:22:44.622+0100] [INFO ] Sesman now listening on /run/xrdp/sesman.socket

EDIT:
Solved it! Was a firewall problem in Red Hat :D It's wierd because Network Security Group in Azure should override this..

[Maddiuz]

So far so good....

I'm now having the same problem before i setup the google authenticator stuff:

• Stuck on the blue screen after entering Entra ID credentials (password+TOTP)
• After checking the /var/log/xrdp-sesman.log, i see the same message as earlier "PAM: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code" etc. etc.

I haven't touched "authselect". Can that be the problem?

Any suggestions?

[matt335672]

I suspect the Entra stuff has modified the PAM stack in a way which isn't compatible with xrdp. Which is another way to say the problem area is around 'authselect'

Can you provide the following:-

1. The snippet of sesman.log with the error in?
2. The contents of these files:-

• /etc/pam.d/xrdp-sesman
• /etc/pam.d/common-auth
• /etc/pam.d/common-account
• /etc/pam.d/common-password
• /etc/pam.d/common-session

The xrdp-sesman file calls into the other four. We can work around the problem by making the calls in the xrdp-sesman file explicit.

[Maddiuz]

Yeah, i suspect that as well. I don't know what the Entra ID extension actually does behind the scenes, but i guess we will find out now 😅

Sesman.log

[2024-11-27T13:10:05.705+0100] [INFO ] Socket 13: connection accepted from AF_UNIX
[2024-11-27T13:10:05.714+0100] [INFO ] Received system login request from xrdp for user: myUsername@domain IP: ::ffff:
[2024-11-27T13:10:05.722+0100] [INFO ] starting xrdp-sesexec with pid 11186
[2024-11-27T13:10:05.897+0100] [INFO ] PAM: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code to authenticate.
When you sign in, verify the name of the app on the sign-in screen is "Azure Linux VM Sign-in" and the IP address of the VM is correct.

The contents of these files:

/etc/pam.d/xrdp-sesman:

%PAM-1.0
Generic Fedora config
auth include password-auth
account include password-auth
password include password-auth
session include password-auth

Gnome specific Fedora config
auth include gdm-password-ga
account include gdm-password
password include gdm-password
session include gdm-password

/etc/pam.d/common-auth:

Empty

/etc/pam.d/common-account:

Empty

/etc/pam.d/common-password:

Empty

/etc/pam.d/common-session:

Empty

... I see a pattern 🤣

Also, when i run "authselect current" i get "No existing configuration detected."

Btw: Thank you so much for helping me!

[matt335672]

There's some confusion here which is totally my fault. I missed this line:-

I've switched to Red Hat Enterprise 9 on the server side to make it easier to follow the guide.

Your edit above has removed comment characters (#) from /etc/pam.d/xrdp-sesman, so it's not useful as such to me.

When the file is delivered, the top stanzas are active (i.e. those that call password-auth). For GNOME desktops, the user needs to manually edit this file, comment out the first set and uncomment the second set (i.e. those that call gdm-password). If you don't do that, things like the GNOME password manager don't work properly. Don't blame us - it's the way it's packaged for EPEL.

Anyway, can we proceed as follows. Pick one of these:-

1. If you're not running GNOME, can you give me the contents of /etc/pam.d/password-auth?
2. If you're are running GNOME, can you give me the contents of /etc/pam.d/gdm-password?

When you paste the files, place them between two lines containing triple-backticks (see this page) like this:-

```
Pasted text
```

It'll then appear like this:-

Pasted text

Feel free to ask questions - there's a bit to take in above.