https://bugs.kde.org/show_bug.cgi?id=526514
[email protected] changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] --- Comment #1 from [email protected] --- Also seen on Fedora 44 with krdp 6.7.5 and FreeRDP 3.32.1, with the Microsoft Windows App for Android as the client. Details below. Summary: System users (PAM) mode still selects HYBRID_EX, so Windows clients cannot log in With "System users" login enabled, KRdp disables NLA but leaves HYBRID_EX (extended NLA) enabled, so Windows clients can never log in. Versions: - krdp 6.7.5 (Fedora 44, krdp-6.7.5-1.fc44) - freerdp 3.32.1 (freerdp-libs-3.32.1-1.fc44) - Plasma 6.7.5, Wayland - Client: Microsoft Windows App for Android Steps to reproduce: 1. System Settings > Remote Desktop: enable the server and enable "System users" login (SystemUserEnabled=true in krdpserverrc), with no "Other users" entries. 2. Connect with Microsoft Windows App (Android). It sends RDP_NEG_REQ requestedProtocols = 0xb (SSL | HYBRID | HYBRID_EX). 3. Enter correct system credentials. Actual result: "The user name or password did not work". Server log (WLOG_LEVEL=DEBUG): Client Security: RDSTLS:0 NLA:1 EXT:1 TLS:1 RDP:0 Server Security: RDSTLS:0 NLA:0 EXT:1 TLS:1 RDP:0 [com.winpr.sspi.NTLM] ntlm_fetch_ntlm_v2_hash: Could not find user in SAM database [com.freerdp.core.auth] credssp_auth_authenticate: AcceptSecurityContext status SEC_E_NO_CREDENTIALS The server selects HYBRID_EX (selectedProtocol 8), runs CredSSP/NTLM against an empty SAM, and PAM is never consulted. A client that offers only SSL|HYBRID (0x3) gets TLS, and PAM login works (verified with xfreerdp /sec:tls). Expected result: In PAM mode, the server should select TLS for any client that offers it, including clients that also offer HYBRID_EX, and then authenticate via PAM. Probable fix: Wherever NlaSecurity is set to false for PAM mode, also set FreeRDP_ExtSecurity to false. Notes: - Rewriting the client request to 0x3 in a proxy does not work around this. The server echoes clientRequestedProtocols = 0x3 in Server Core Data (MCS Connect Response), the Windows client compares it with the 0xb it sent, and it disconnects with error 0x609 after Erect Domain. - The RDP_NEG_RSP flags advertise RESTRICTED_ADMIN_MODE_SUPPORTED (flags 0x0b) while TLS-only is selected, but restricted admin needs NLA. Clearing that flag alone did not fix the Windows client. - Separately, the auto-generated certificate (~/.local/share/krdpserver/krdp.crt) was valid for one day only (Not Before Sep 29, Not After Sep 30). -- You are receiving this mail because: You are watching all bug changes.
