How do I set up multi factor authentication ?

[ToddAndMargo]

Hi All,

Fedora 41
xrdp-0.10.2-11.fc41.x86_64

I have a customer that I set up a FC41 server with xRDP.

I won't port forward to it through the firewall because bad actors are attacking RDP service, even on different ports.

How do I set up Multi Factor Authentication (QR tabs, Red Hat Free OTP, etc.)?

Many thanks,
-T

[matt335672]

Very short of time this week, but read this:-

https://github.com/neutrinolabs/xrdp/wiki/Using-Authy-or-Google-Authenticator-for-2FA-with-XRDP

HTH

[ToddAndMargo]

I only want 2FA on xrdp. It is not clear in the link if I can configure this. If he console users have to use 2FA, they will be very upset with me.

[matt335672]

The 2FA is configured in xrdp-sesman, which is only used for xrdp logins.

[matt335672]

One thing I forgot to add, but which is very important, is this:-

https://github.com/neutrinolabs/xrdp/wiki/Tips-and-FAQ#is-it-safe-to-set-up-xrdp-to-listen-on-the-internet

Apologies.

[ToddAndMargo]

On 4/8/25 9:08 AM, matt335672 wrote: One thing I forgot to add, but which is very important, is this:- https://github.com/neutrinolabs/xrdp/wiki/Tips-and-FAQ#is-it-safe-to- set-up-xrdp-to-listen-on-the-internet <https://github.com/neutrinolabs/ xrdp/wiki/Tips-and-FAQ#is-it-safe-to-set-up-xrdp-to-listen-on-the-internet> Apologies.

No apology necessary. I appreciate your help! Your link is just one more reason for me to get Multi Factor Authentication going before releasing this machine to the Internet! I have a strong firewall on this and other customer's machines using RDP for remote access. Occasionally I will download the bad actors and put them in my firewall's exclude list. Checking where they are from, 95% are from Russia. But that could be spoofed as well, so who knows where they are actually from. For Windows machines, I adore Rohos for MFA. They said they'd look at support Linux in the future, but they may have just been being nice to me.

[ToddAndMargo]

On 4/14/25 3:08 AM, matt335672 wrote: The 2FA is configured in xrdp-sesman, which is only used for xrdp logins.

Thank you!