https://bugs.kde.org/show_bug.cgi?id=526928
Billy T <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] --- Comment #2 from Billy T <[email protected]> --- This may be old (and GOOD) news but... krdp 6.8.0 fixes this, and the fix is queued for the 6.7 branch. Cause: between freerdp 3.31.1 and 3.32.1 the default of FreeRDP_ExtSecurity changed from FALSE to TRUE (libfreerdp/core/settings.c, freerdp_settings_new). With it on, PROTOCOL_HYBRID_EX becomes selectable, so CredSSP/NTLM runs before krdp reaches its PAM path and the SAM lookup fails. krdp 6.7.5 sets RdpSecurity, TlsSecurity and NlaSecurity in src/RdpConnection.cpp but never sets ExtSecurity, so it inherits the new default. That also explains the observation in comment 1 that NlaSecurity=false has no effect: ExtSecurity is the mode left on. The fix is one line, freerdp_settings_set_bool(settings, FreeRDP_ExtSecurity, false), merged to master as https://invent.kde.org/plasma/krdp/-/merge_requests/248 and cherry-picked to Plasma/6.7 as https://invent.kde.org/plasma/krdp/-/merge_requests/253. It ships in krdp 6.8.0 (I checked src/RdpConnection.cpp in the release tarball), and the 6.7 branch carries it for the next 6.7 bugfix release. I tested krdp 6.8.0 with freerdp 3.32.2 (Arch-based distro, SystemUserEnabled=true, PAM login). Authentication works with no freerdp downgrade. On the FreeRDP side, https://github.com/FreeRDP/FreeRDP/issues/13567 is closed and 3.32.2 keeps the new default. The maintainers wrote that krdp "only set half of the security modes manually", so the krdp change above is the intended resolution. Until you can update krdp, downgrade freerdp to 3.31.1 and restart the krdpserver service. -- You are receiving this mail because: You are watching all bug changes.
