XRDP Geolocation / Tcp Wrapper

[araujofrancisco]

I am trying to setup Geolocation filter using tcp wrapper implementing what I found in (https://blog.reinhard.codes/2023/04/02/restricting-access-to-ssh-using-fail2ban-and-geoip/), it is currently working fine for ssh, however I have not been able to set it up for xrpd.

For ssh I set hosts.allow with:
sshd: ALL: aclexec /usr/local/bin/ssh-filter.sh %a

I have tried doing the same for xrdp without success. Any ideas on how to get it working?

[matt335672]

Provided you're using v0.9.18 or later which incorporates #1976 this should be possible.

You'll need to provide a filter script to find the required messages in syslog, or xrdp-sesman.ini.

I'd be remiss if I didn't point you at this FAQ. I'd urge you to use a VPN for accessing xrdp over the Internet.

[araujofrancisco]

I am using v.0.9.25 (compiled from source). However, I think you might not understood the issue. I want the tcp wrapper DENY access to xrdp depending on the result returned by the script I am using. I tried setting it up for all the services (ALL: ALL: aclexec /usr/loca/bin/ssh-filter.sh %a) and it works just fine for SSH but it does not affect xrdp.

I do not need logs from xrdp or xrdp-sesman, I just need the tcp wrapper working on it.

About VPN, sure I would like to kill RDP since it is not strictly required, but my boss want to been able to RDP no VPN, so I am just trying to secure as much as I can on these conditions.

[metalefty]

xrdp doesn't rely on TCP wrapper.

[matt335672]

Yes, you're right @araujofrancisco - I've misunderstood your question.

Speaking as an ex-systems admin, I think you need to push back on the 'XRDP without VPN' decision - it's your responsibility to inform your boss he's taking a significant risk with his attitude. Point your boss at this FAQ. Use an email so there's a trail.