Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MaxLoginRetry for xrdp-sesman effectively broken #1739

Closed
dmwarren opened this issue Dec 1, 2020 · 0 comments · Fixed by #2472
Closed

MaxLoginRetry for xrdp-sesman effectively broken #1739

dmwarren opened this issue Dec 1, 2020 · 0 comments · Fixed by #2472

Comments

@dmwarren
Copy link

dmwarren commented Dec 1, 2020

Issue description

The MaxLoginRetry parameter in /etc/xrdp/sesman.ini is effectively broken. Attackers can make an infinite number of login attempts in a single session because they are never disconnected.

Observed on Ubuntu 20.04 with:

  • xrdp 0.9.12-1 as shipped by Ubuntu
  • xrdp commit 19260cc

Steps to reproduce the issue

  1. Install xrdp.
  2. Set /etc/xrdp/sesman.ini:MaxLoginRetry=1
  3. (Re)start xrdp. Verify that xrdp-sesman has been restarted as well.
  4. Connect to xrdp with any RDP client.
  5. Enter random credentials in the login dialog and click [OK].
  6. Repeat Step 5 several times. Note that you are never disconnected.

What's the expected result?

xrdp sessions should be disconnected after ${MaxLoginRetry} failed logins.

What's the actual result?

Sessions are never disconnected, regardless of the number of failed attempts.

Additional Details

Discussion in the xrdp-questions gitter:
https://gitter.im/neutrinolabs/xrdp-questions?at=5fbce7610451324f15318c90
@matt335672 matt335672 mentioned this issue Mar 28, 2022
Closed
matt335672 added a commit to matt335672/xrdp that referenced this issue Dec 14, 2022
@matt335672
Update sesman authentication processing
3928a48 
Update sesman to cope with separate authentication/authorization (AA) and
command processing.

Also, internally users are now tracked by UID rather thn username.
This addresses a problem found by some users using federated naming
services (e.g. Active Directory) where the same user can be referred to
in more than one way. See neutrinolabs#1823

The separation of AA in this way allows for multiple attempts to be made
on one connection to get a password right. This addresses MaxLoginRetry
not working (neutrinolabs#1739)
matt335672 added a commit to matt335672/xrdp that referenced this issue Dec 14, 2022
@matt335672
Update sesman authentication processing
04efb06 
Update sesman to cope with separate authentication/authorization (AA) and
command processing.

Also, internally users are now tracked by UID rather thn username.
This addresses a problem found by some users using federated naming
services (e.g. Active Directory) where the same user can be referred to
in more than one way. See neutrinolabs#1823

The separation of AA in this way allows for multiple attempts to be made
on one connection to get a password right. This addresses MaxLoginRetry
not working (neutrinolabs#1739)
@matt335672 matt335672 mentioned this issue Dec 14, 2022
Merged
matt335672 added a commit to matt335672/xrdp that referenced this issue Dec 15, 2022
@matt335672
Update sesman authentication processing
38c5f05 
Update sesman to cope with separate authentication/authorization (AA) and
command processing.

Also, internally users are now tracked by UID rather thn username.
This addresses a problem found by some users using federated naming
services (e.g. Active Directory) where the same user can be referred to
in more than one way. See neutrinolabs#1823

The separation of AA in this way allows for multiple attempts to be made
on one connection to get a password right. This addresses MaxLoginRetry
not working (neutrinolabs#1739)
matt335672 added a commit to matt335672/xrdp that referenced this issue Dec 22, 2022
@matt335672
Update sesman authentication processing
fd99653 
Update sesman to cope with separate authentication/authorization (AA) and
command processing.

Also, internally users are now tracked by UID rather thn username.
This addresses a problem found by some users using federated naming
services (e.g. Active Directory) where the same user can be referred to
in more than one way. See neutrinolabs#1823

The separation of AA in this way allows for multiple attempts to be made
on one connection to get a password right. This addresses MaxLoginRetry
not working (neutrinolabs#1739)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Implement uds authentication matt335672/xrdp
1 participant
@dmwarren