1

I can remote into a Windows machine using Windows' default RDP client, but I would like to do it from Linux.

The clients I have tried so far complain about a self-signed certificate, although Windows had no complaint. I don't know much about the remote end, but I may ask to provide more info.

Vinagre:

[11:54:25:962] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[11:54:25:962] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[11:54:25:962] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[11:54:25:962] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1
[11:54:25:066] [WARN][com.freerdp.crypto] - Certificate verification failure 'self signed certificate (18)' at stack position 0
[11:54:25:066] [WARN][com.freerdp.crypto] - CN = heatchamber-pc

Remmina:

[12:15:59:884] [WARN][com.freerdp.crypto] - Certificate verification failure 'self signed certificate (18)' at stack position 0
[12:15:59:884] [WARN][com.freerdp.crypto] - CN = heatchamber-pc
[12:16:25:423] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[12:16:25:423] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[12:16:25:423] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[12:16:25:423] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

Software versions (openSUSE Tumbleweed):

  • libfreerdp2-2 2.9.0-3.1
  • remmina 1.4.27-3.1
  • vinagre 3.22.0-15.7

I also tried Rustdesk, but I really didn't understand that one (its GUI was oriented towards connecting to a remote server with a random ID rather than the correct hostname with the correct username and password).

2 Answers 2

1

A native Windows client will attempt to secure the session using Kerberos, before reverting to checking certificates.

You can check this by looking for the padlock symbol in the connection bar (top). Click on it and it should tell you that The identity of the remote computer was verified by using Kerberos.

If the Windows client is not domain-joined, it will revert to using certificates and the first time you try to connect you will see a dialogue stating that the certificate isn't trusted.

The Linux clients don't use Kerberos so will always complain of a self-signed certificate, if that's what the Windows remote has sent.

2
  • I don't see a padlock symbol on the connection bar. But that's enlightening. I tried to find other ways to see if Kerberos is being used, but I haven't found one written for mere mortals. Feb 1, 2023 at 8:12
  • 1
    If you don't see the padlock symbol, then you are not using Kerberos for session security. Feb 1, 2023 at 8:35
1

Remmina TLS

If you're using Remmina setting the security protocol negotiation to TLS instead of auto negotiate solved this issue for me.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .