29

I can connect to my Ubuntu 22.04 computer using Remmina RDP with "Remote Login" enabled when I'm logged in. However, as soon as the target's console is locked, I can no longer connect. Port 3389 is open but it shuts down the connection immediately. As soon as I log in physically I can access it remotely again (until the display lock kicks in).

I can disable the display lock but then anyone can access the display without needing my credentials.

I can change my account to autologin and disable the keysafe but then the computer is accessible all the time.

How do I protect my 22.04 machine while being able to access it remotely using the new "Remote Login" RDP method?

pa4080
  • 30,621

2 Answers2

40

Update for Ubuntu 24.04

Ubuntu 24.04 has a new Remote Login feature under Settings > System > Remote Access, along with the old Desktop Sharing.

Remote Login allows remotely logging into the Ubuntu 24.04 using RDP protocol if no one is logged in locally. For example, if the computer is restarted and automatic login is disabled, you can use this feature to login remotely.

Unlike the Remote Desktop Sharing, when you login remotely using this feature a local intruder will not be able to see the screen on the attached monitor or interact with it. If you are remotely logged in and try to login locally at the same time you will see this message on the local monitor:

Warning on the local monitor

Unfortunately if you get disconnected or close the RDP session, the remote session will be lost, in my limited testing. When you try to connect again you will get the login screen and login to a new session, rather than the existing remote session you disconnected from.

Securing Local Display for Remote Connection

It is my understanding that it is not possible to protect your computer from local physical intrusion while using it remotely using the new "Remote Login" RDP method.

If your concern is someone may watch your screen locally and get sensitive information, or worse, takeover your computer locally while you are connected remotely, then install xrdp and bypass the "new Remote login" RDP method.

The new (as of Ubuntu 22.04) GNOME Remote Desktop (Sharing) does allow a remote connection if you are logged in locally in the remote computer. On the other hand, xrdp does not allow remote connection if you are logged in locally.

To install the xrdp server, open a terminal and enter:

sudo apt install xrdp

This will install the full xrdp server app. It will allow you to remotely connect to your computer if and only if you are NOT logged in locally. When you login remotely using RDP (xrdp) your local monitor will not turn on and show potential observers and intruders what you are doing.

See Ubuntu 22.04 remote desktop headless? for more details.

Remote Connection with Local login (Original Answer)

GNOME Shell Extension: Allow locked Remote Desktop

The solution below is for problem with screen lock and the new GNOME Remote Desktop in Ubuntu 22.04 that allows RDP (and legacy VNC) protocol for remote desktop sharing. If someone is physically near your your computer they will see your activities on the connected monitor and thus be able to collect sensitive information.

You will need a GNOME Shell extension to solve this problem.

First, install install gnome-shell-extension-manager with this command:

sudo apt install gnome-shell-extension-manager

The open the newly installed app called Extension in the GUI. Within this app, search for and install the Allow locked Remote Desktop GNOME Shell extension.

Now you will be able to remotely connect to this computer even when the screen is locked. You will still need to be logged in locally first.

Hope this helps

user68186
  • 37,461
2

The issue is well documented here: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/3212#note_992252

As answered by @user68186, the gnome shell extension to disable this behavior is "Allow locked Remote Desktop"

I couldn't find it in gnome-shell-extension-manager. So I installed it manually with these steps:

  1. get your shell version with gnome-shell --version
  2. download the corresponding version at https://extensions.gnome.org/extension/4338/allow-locked-remote-desktop/
  3. install the extension with gnome-extensions install <downloaded_file.zip> (and reboot)
  4. enable the extension with gnome-extensions enable allowlockedremotedesktop@kamens.us (and reboot)

This method has 2 advantages:

  • gnome-extensions is installed by default, so you don't need to install gnome-shell-extension-manager (the GUI manager)
  • gnome-extensions doesn't need any browser integration (contrary to gnome-shell-extension-manager)
max
  • 445
  • 4
  • 9