Use Fail2Ban together with xrdp

[hubeny]

Hi,

we have deployed xrdp server and use it as the remote desktop server for our users. Everyting works fine, but....
We want to ban ip addresses with fail2ban after several failed attemps to togin via xrdp.

There are tree log files on ubuntu where goes logs from xrdp (or logs of actions invoked by login attempt to xrdp)
/var/log/xrdp-sesman.log
/var/log/auth.log
/var/log/xrdp.log

The only usable info for fail2ban is in file /var/log/auth.log example:
10:16:04 rdplin xrdp-sesman[34403]: pam_unix(xrdp-sesman:auth): authentication failure; logname= uid=0 euid=0 tty=xrdp-sesman ruser= rhost= user=testuser
However, there is no information about rhost (no ip) in the log. We have build latest version xrdp from sources, but without any change in the log. Further we have found four years opened feature request #392. Therefore, we assume, that use fail2ban together with xrdp is not possible now.

Can anybody give an advice, how to use these two softwares together (xrdp and fail2ban)?

Thank you,

Jan Hubený

[matt335672]

Hi @hubeny

Can you have a look at #1946 and #1947? I was hoping for some feedback from @MikoyChinese on this feature. I'll be happy to work with you to get this doing what you want.

[matt335672]

Looking in your sesman log, it looks like you've got a problem starting the session or the X server.

Have a look in these places:-

• ~/.xorgxrdp.10.log will tell us what the X server is doing.
• sudo journalctl -S -5m will give you the last 5 minutes of what's happening on the system, so should include your session. Adjust the timeout to suit.

Have you also rebuilt xorgxrdp? the one which comes with 20.04 is not compatible with the latest devel sources.

[hubeny]

I have done these steps:

1. build latest devel xrdp from sources and did make install and reboot
2. buid xorgxrdp did make install and reboot

The ~/.xorgxrdp.10.log is not even created in this setup.

I did not unistall the distribution packages before installing the xrdp a nd the xorgxrdp module from sources. I will give another try and upload also the journalctl.

[matt335672]

The uninstall might well be it. If you've got a source build and a package build on the same system they will probably pick up on the shared libraries for the installed build.

[matt335672]

@hubeny - I'm about to sign off for a long weekend. I've just raised PR #1976 which you might be interested in. Feel free to comment on it.

[hubeny]

The simple procedure
uninstall ubuntu's packages xrdp and xorgxrdp
reboot; make and make install of xrdp; reboot; make and make install of xorgxrdp

did not help.

What really helps was:
uninstall ubuntu's packages xrdp and xorgxrdp reboot
and use the xrdp easy install from https://c-nergy.be/blog/?p=15978
here I use the -c -s command line args and apply the patch into the sources downloaded by git.

Thank you for your help. Now everything works together with fail2ban.

[SxnSess]

hi @hubeny would like to know what settings you made for fail2ban to monitor xrdp.