Yesterday I did an update of one of my tumbleweed systems (zypper dup), everything seemed to go as it should with no error messages. I rebooted as required and since then I have been unable to connect to the machine using remmina using xrdp, it was working before the upgrade.
Remmina just gives the error that it can’t connect to the target machine. and I get the following errors in the target machine’s /var/log/xrdp.log
[20260523-19:48:49] [ERROR] Cannot read certificate file /etc/xrdp/cert.pem: No such file or directory
[20260523-19:48:49] [ERROR] Cannot read private key file /etc/xrdp/key.pem: No such file or directory
[20260523-19:48:50] [ERROR] MAC checksum error for non-FIPS PDU
[20260523-19:48:50] [ERROR] xrdp_rdp_recv: xrdp_sec_recv failed
[20260523-19:48:50] [ERROR] libxrdp_process_data: xrdp_rdp_recv failed
[20260523-19:48:50] [ERROR] xrdp_process_data_in: xrdp_process_loop failed
I’m not sure if X is up and running, as the machine is at another location.
The first two errors are the crux of the issue. Speculating that the upgrade has either removed (or replaced) the XRDP TLS certificate symlinks, or perhaps changed permissions such that xrdp can no longer access them?
Anyway, check ls -l /etc/xrdp/ first, and see if the expected symlinks are present.
Humm, I’ve never had those certificate files, and have another machine that also has that error but I can connect to, though it has not had the latest update on it.
Yes I can still reach the misbehaving machine via ssh without problems, so it is alive.
Ok, on a whim I tried connecting from a Windows 11 machine, using it’s built in RDP client, and that connected and let me login without problems, so looks like the problem might be with remmina. Will do some updates and see if that fixes it.
Ok, on a whim I tried connecting from a Windows 11 machine, using it’s built in RDP client, and that connected and let me login without problems, so looks like the problem might be with remmina. Will do some updates and see if that fixes it.
On investigating on windows I get the graphical Xrdp login dialog. From here I can login with either an Xvnc or Xrdp connection.
Chiming in as I’ve encountered the same thing, and can add some data points:
I’m usually using xfreerdp2 as the client, which is throwing an error for me on connect since yesterday upgrading the instance running xrdp (I think Remmina uses the same backend).
Testing connecting from a Windows mstsc client is fine.
Looking at /var/log/xrdp.log*, I have previously alway had the “Cannot read certificate/private key” errors, and have connected OK.
What is new in the logs since the most recent update is the MAC checksum error for non-FIPS PDU
If I boot the remote instance running xrdp to a read-only snapshot zypper/pre, the problem vanishes.
Taking these in I feel safe in concluding the problem is a change in the xrdp server (per item 4), not an issue with the xfreerdp2 client.
Hey deano
As with the OP xrdp is definitely running after the update and I can connect with windows client, the error that is new for me (see my other post) is the MAC checksum error for non-FIPS PDU.
This is way over my head - is there a switch to tell the client backend (xfreerdp for me, Remmina for the OP) to do whatever the Windows client does?
Thanks! I’d actually had a spin through the available xfreerdp options during the 20 minutes between my two earlier posts, in case I could find something constructive to add!
My findings were the ability to trigger slightly different error logs at the server side, but none of the listed options (see bottom for everything attempted) helped. The +fipsmode gave the most interesting errors…
It may be relevant that the server logs when connecting from the windows mstsc.exe log only the missing cert/key, and nothing subsequent - and I do dismiss a Windows warning about “The identity of the remote computer cannot be verified”.
I suspect that saying ‘connect anyway’ is triggering a relatively insecure fallback that xrdp would previously have negotiated with Remmina/xfreerdp.
