2026年3月30日 星期一

On FreeBSD change xrdp daemon user from root to xrdp (unprivileged)

# Why

Because you got this log message if you did not do it:
```
Mar 30 10:58:42 hostname xrdp[1602]: [CORE ] You are running xrdp as uid=0 gid=0. This is not recommended.

```

# Steps

* Stop services
    # service xrdp stop
    # service xrdp-sesman stop

* create daemon user
    # pw group add -n _xrdp
    # pw user add -n _xrdp -g _xrdp -c 'XRDP daemon' -d /var/empty -s /usr/sbin/nologin

* edit /usr/local/etc/xrdp/xrdp.ini
    runtime_user=_xrdp
    runtime_group=_xrdp
* edit /usr/local/etc/xrdp/sesman.ini
    SessionSockdirGroup=_xrdp

* chown /usr/local/etc/xrdp/cert.pem and /usr/local/etc/xrdp/key.pem to _xrdp
* chmod to 400

* check privilege of xrdp.ini for daemon user
    # /usr/local/share/xrdp/xrdp-chkpriv

* Start service
    # service xrdp-sesman start
    # service xrdp start
 

* Test

沒有留言:

張貼留言