Group membership not working in xrdp session

[Freek07]

Hi,

I have a simple question but I've been banging my head for some time and can't find a solution: group memberships don't get loaded when I login (to xfce) via xrdp.

I'm a member of multiple groups and if I ssh onto machine, they work. If I sudo, they work.
If I xrdp onto it, I'm just a member of (me) and "users".
If I open a terminal in xrdp session and sudo [my_username], I get the groups.

I need the groups in GUI (without sudoing to myself).

I tried altering the startvm.ini to make sure it reads bash:
exec /bin/bash --login -c /etc/X11/Xsession

I have profile stiff in startvm.ini:

if test -r /etc/profile; then
        . /etc/profile
fi

if test -r ~/.profile; then
        . ~/.profile
fi

And I tried adding pam_unix to /etc/pam.d/xrdp-sesman:

#%PAM-1.0
auth     required  pam_env.so readenv=1
auth     required  pam_env.so readenv=1 envfile=/etc/default/locale


auth       required   pam_unix.so
account    required   pam_unix.so
password   required   pam_unix.so
session    required   pam_unix.so


@include common-auth
-auth    optional  pam_gnome_keyring.so
-auth    optional  pam_kwallet5.so

@include common-account

@include common-password

@include common-session
-session optional  pam_gnome_keyring.so auto_start
-session optional  pam_kwallet5.so auto_start

Nothing works. So...what have I missed?
I'm using debian stable, so:

# xrdp -v
xrdp 0.10.1
  A Remote Desktop Protocol Server.
  Copyright (C) 2004-2024 Jay Sorg, Neutrino Labs, and all contributors.
  See https://github.com/neutrinolabs/xrdp for more information.

  Configure options:
      --enable-ipv6
      --enable-jpeg
      --enable-fuse
      --enable-rfxcodec
      --enable-opus
      --enable-painter
      --enable-vsock
      --build=x86_64-linux-gnu
      --prefix=/usr
      --includedir=${prefix}/include
      --mandir=${prefix}/share/man
      --infodir=${prefix}/share/info
      --sysconfdir=/etc
      --localstatedir=/var
      --disable-silent-rules
      --libdir=${prefix}/lib/x86_64-linux-gnu
      --libexecdir=${prefix}/lib/x86_64-linux-gnu
      --disable-maintainer-mode
      --disable-dependency-tracking
      --with-socketdir=/run/xrdp/sockdir
      build_alias=x86_64-linux-gnu
      CFLAGS=-g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/xrdp-0.10.1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection 
      LDFLAGS=-Wl,-z,relro -Wl,-z,now -Wl,--as-needed
      CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2 
      CXXFLAGS=-g -O2 -ffile-prefix-map=/build/reproducible-path/xrdp-0.10.1=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection
      PKG_CONFIG_PATH=/build/reproducible-path/xrdp-0.10.1/pkgconfig

  Compiled with OpenSSL 3.5.0 8 Apr 2025

I saw a similar discussion, but that was for an old version in 2021, so I guess it must be me doing something wrong.
Thanks!

[matt335672]

Is this a standard files-based system, with the group membership being defined in /etc/groups? I'll assume it is.

When sesexec changes context to a particular user, it calls initgroups() to set up the secondary group membership. If this fails, this message will be logged in the sesman log:-

Failed to initialise secondary groups for <user>: <errormsg>

Have a look to see if you're getting that message.

It's also interesting you're part of the users group. Have a look in the groups file to see what if anything is different about the users group definition.

[cjhabs]

I was having a similar issue today.
Ubuntu 24.04 with xfce4
xrdp 0.10.3

Added my user to the "sudo" group.
ssh session reflected the new group, xrdp login did not.
I logged out and in and also restarted the xrdp service - still did not work.

I then ran "sudo apt update/upgrade" and rebooted. This resolved my issue. Whether the patching or the reboot made the difference I unfortunately do not know, but xrdp login works as expected now.