{"id":543,"date":"2015-08-29T00:24:40","date_gmt":"2015-08-29T00:24:40","guid":{"rendered":"https:\/\/www.nicktailor.com\/?p=543"},"modified":"2022-10-21T11:48:42","modified_gmt":"2022-10-21T11:48:42","slug":"how-to-setup-vnc-through-rdp-and-authenticate-through-ad","status":"publish","type":"post","link":"https:\/\/nicktailor.com\/tech-blog\/how-to-setup-vnc-through-rdp-and-authenticate-through-ad\/","title":{"rendered":"How to RDP  to VNC and authenticate using AD (Redhat 6)"},"content":{"rendered":"<p>For this we will be setting up VNC server and XRDP which allow you to use windows remote desktop terminal services client to connect to your linux desktop as you would any windows machine with centralized authentication using Active directory.<\/p>\n<p>XRDP is a wonderful Remote Desktop protocol application that allows you to RDP to your servers\/workstations from any Windows machine, MAC running an RDP app or even Linux using an RDP app such as <a href=\"http:\/\/remmina.sourceforge.net\/\" target=\"_blank\" rel=\"noopener\">Remmina<\/a>. This was written for the new CentOS 6.5 on 64-bit but should work the same on any 6.x and 5.x Red Hat clone with the correct EPEL repositories.<\/p>\n<p>Virtual Network Computing (<b>VNC<\/b>) is a graphical desktop sharing system that uses the Remote Frame Buffer protocol (RFB) to remotely control another computer. Essentially the Linux version of windows RDP.<\/p>\n<p>We are going to make them work together so you can RDP from your windows machine to you linux desktop as you would any other windows machine using a windows RDP service. It create an ssh tunnel inside the RDP protocol to get to the vnc server and then authenicate against the active directory domain controller so you dont need to create users individually for vncserver.<\/p>\n<p>First we need to download and install the EPEL repository for your correct version if you do now know what architecture you are using you can verify it with the below command. If the end shows x86_64 then you have a 64-bit install, if it shows i386 then it is a 32-bit install:<\/p>\n<div>\n<div id=\"highlighter_329927\" class=\"syntaxhighlighter  bash\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td class=\"gutter\">\n<div class=\"line number1 index0 alt2\">1<\/div>\n<div class=\"line number2 index1 alt1\">2<\/div>\n<\/td>\n<td class=\"code\">\n<div class=\"container\">\n<div class=\"line number1 index0 alt2\"><code class=\"bash plain\">[root@server ~]<\/code><code class=\"bash comments\"># uname -r<\/code><\/div>\n<div class=\"line number2 index1 alt1\"><code class=\"bash plain\">2.6.32-431.el6.x86_64<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p>Once you determine your architecture then you can install the correct EPEL repository with the below commands:<\/p>\n<div>\n<div id=\"highlighter_622633\" class=\"syntaxhighlighter  bash\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<caption>RHEL\/CentOS 6 32-Bit<\/caption>\n<tbody>\n<tr>\n<td class=\"gutter\">\n<div class=\"line number1 index0 alt2\">1<\/div>\n<div class=\"line number2 index1 alt1\">2<\/div>\n<\/td>\n<td class=\"code\">\n<div class=\"container\">\n<div class=\"line number1 index0 alt2\"><code class=\"bash plain\">wget http:<\/code><code class=\"bash plain\">\/\/download<\/code><code class=\"bash plain\">.fedoraproject.org<\/code><code class=\"bash plain\">\/pub\/epel\/6\/i386\/epel-release-6-8<\/code><code class=\"bash plain\">.noarch.rpm<\/code><\/div>\n<div class=\"line number2 index1 alt1\"><code class=\"bash plain\">rpm -ivh epel-release-6-8.noarch.rpm<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<div>\n<div id=\"highlighter_922678\" class=\"syntaxhighlighter  bash\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<caption>RHEL\/CentOS 6 64-Bit<\/caption>\n<tbody>\n<tr>\n<td class=\"gutter\">\n<div class=\"line number1 index0 alt2\">1<\/div>\n<div class=\"line number2 index1 alt1\">2<\/div>\n<\/td>\n<td class=\"code\">\n<div class=\"container\">\n<div class=\"line number1 index0 alt2\"><code class=\"bash plain\">wget http:<\/code><code class=\"bash plain\">\/\/download<\/code><code class=\"bash plain\">.fedoraproject.org<\/code><code class=\"bash plain\">\/pub\/epel\/6\/x86_64\/epel-release-6-8<\/code><code class=\"bash plain\">.noarch.rpm<\/code><\/div>\n<div class=\"line number2 index1 alt1\"><code class=\"bash plain\">rpm -ivh epel-release-6-8.noarch.rpm<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p>You can verify that the EPEL repository is there by running the below command and you should see the EPEL repository listed as you can see here in line #10 which is highlighted:<\/p>\n<div>\n<div id=\"highlighter_883565\" class=\"syntaxhighlighter  bash\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td class=\"gutter\">\n<div class=\"line number1 index0 alt2\">1<\/div>\n<div class=\"line number2 index1 alt1\">2<\/div>\n<div class=\"line number3 index2 alt2\">3<\/div>\n<div class=\"line number4 index3 alt1\">4<\/div>\n<div class=\"line number5 index4 alt2\">5<\/div>\n<div class=\"line number6 index5 alt1\">6<\/div>\n<div class=\"line number7 index6 alt2\">7<\/div>\n<div class=\"line number8 index7 alt1\">8<\/div>\n<div class=\"line number9 index8 alt2\">9<\/div>\n<div class=\"line number10 index9 alt1 highlighted\">10<\/div>\n<div class=\"line number11 index10 alt2\">11<\/div>\n<div class=\"line number12 index11 alt1\">12<\/div>\n<div class=\"line number13 index12 alt2\">13<\/div>\n<\/td>\n<td class=\"code\">\n<div class=\"container\">\n<div class=\"line number1 index0 alt2\"><code class=\"bash plain\">[root@server ~]<\/code><code class=\"bash comments\"># yum repolist<\/code><\/div>\n<div class=\"line number2 index1 alt1\"><code class=\"bash plain\">Loaded plugins: fastestmirror, refresh-packagekit, security<\/code><\/div>\n<div class=\"line number3 index2 alt2\"><code class=\"bash plain\">Loading mirror speeds from cached hostfile<\/code><\/div>\n<div class=\"line number4 index3 alt1\"><code class=\"bash spaces\">&nbsp;<\/code><code class=\"bash plain\">* base: mirror.thelinuxfix.com<\/code><\/div>\n<div class=\"line number5 index4 alt2\"><code class=\"bash spaces\">&nbsp;<\/code><code class=\"bash plain\">* epel: mirror.cogentco.com<\/code><\/div>\n<div class=\"line number6 index5 alt1\"><code class=\"bash spaces\">&nbsp;<\/code><code class=\"bash plain\">* extras: centos.mirror.nac.net<\/code><\/div>\n<div class=\"line number7 index6 alt2\"><code class=\"bash spaces\">&nbsp;<\/code><code class=\"bash plain\">* updates: centos.mirror.netriplex.com<\/code><\/div>\n<div class=\"line number8 index7 alt1\"><code class=\"bash plain\">repo <\/code><code class=\"bash functions\">id<\/code>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <code class=\"bash plain\">repo name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; status<\/code><\/div>\n<div class=\"line number9 index8 alt2\"><code class=\"bash plain\">base&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CentOS-6 - Base&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6,367<\/code><\/div>\n<div class=\"line number10 index9 alt1 highlighted\"><code class=\"bash plain\">epel&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Extra Packages <\/code><code class=\"bash keyword\">for<\/code> <code class=\"bash plain\">Enterprise Linux 6 - x86_64&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10,220<\/code><\/div>\n<div class=\"line number11 index10 alt2\"><code class=\"bash plain\">extras&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CentOS-6 - Extras&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 14<\/code><\/div>\n<div class=\"line number12 index11 alt1\"><code class=\"bash plain\">updates&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CentOS-6 - Updates&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 286<\/code><\/div>\n<div class=\"line number13 index12 alt2\"><code class=\"bash plain\">repolist: 16,887<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<div><\/div>\n<p>Once you have verified the EPEL repository is installed correctly you need to perform the last few steps below this will install XRDP and Tiger VNC Server for you to connect to. The Front end of XRDP uses the RDP protocol and internally it uses VNC to connect and display the Remote Desktop to you.<\/p>\n<div>\n<div id=\"highlighter_843887\" class=\"syntaxhighlighter  bash\">\n<table border=\"0\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td class=\"gutter\">\n<div class=\"line number1 index0 alt2\">1<\/div>\n<div class=\"line number2 index1 alt1\">2<\/div>\n<div class=\"line number3 index2 alt2\">3<\/div>\n<div class=\"line number4 index3 alt1\">4<\/div>\n<div class=\"line number5 index4 alt2\">5<\/div>\n<\/td>\n<td class=\"code\">\n<div class=\"container\">\n<div class=\"line number1 index0 alt2\"><code class=\"bash plain\">[root@server ~]<\/code><code class=\"bash comments\"># yum install xrdp tigervnc-server<\/code><\/div>\n<div class=\"line number2 index1 alt1\"><code class=\"bash plain\">[root@server ~]<\/code><code class=\"bash comments\"># service vncserver start<\/code><\/div>\n<div class=\"line number3 index2 alt2\"><code class=\"bash plain\">[root@server ~]<\/code><code class=\"bash comments\"># service xrdp start<\/code><\/div>\n<div class=\"line number4 index3 alt1\"><code class=\"bash plain\">[root@server ~]<\/code><code class=\"bash comments\"># chkconfig xrdp on<\/code><\/div>\n<div class=\"line number5 index4 alt2\"><code class=\"bash plain\">[root@server ~]<\/code><code class=\"bash comments\"># chkconfig vncserver on<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<ul>\n<li>If your vncserver did not start..probably due the \/etc\/sysconfig\/vncserver file. You need at least one user and password configured.<\/li>\n<li>&nbsp;edit the file&nbsp;<em><strong>\/etc\/sysconfig\/vncserver&nbsp;<\/strong><\/em><\/li>\n<li>add the following below; adjust the users accordingly and save<\/li>\n<\/ul>\n<div>=======================<\/div>\n<div>VNCSERVERS=&#8221;1:nicktailora 2:nicktailorb&#8221;<\/div>\n<div>VNCSERVERARGS[1]=&#8221;-geometry 800&#215;600 -nolisten tcp -localhost&#8221;<br \/>\nVNCSERVERARGS[2]=&#8221;-geometry 800&#215;600 -nolisten tcp -localhost&#8221;<\/div>\n<div>=========================<\/div>\n<ul>\n<li>Now you su to your the user you created\n<ul>\n<li>su ntailora<\/li>\n<li>then run<strong><em> vncpasswd<\/em><\/strong><\/li>\n<li>type a complex password twice<\/li>\n<li>exit back to root by typing<em> exit<\/em><\/li>\n<li>restart vncserver<strong><em> \/etc\/init.d\/vncserver restart<\/em><\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Now to make it so that xrdp will authenticate against AD when creating a ssh tunnel through the rdp protocol.<\/p>\n<p><em><strong>NOTE<\/strong>:<\/em><strong> <em>YOU WILL OF HAVE HAD TO FOLLOW MY EARLIER BLOG POST ON &#8220;HOW TO ADD A REDHAT SERVER TO ACTIVE DIRECTORY&#8221; FOR THIS PORTION TO WORK.&nbsp;<\/em><\/strong><\/p>\n<div>Since your already authenticating using sssd\/kerberos\/ldap.<\/div>\n<div><\/div>\n<ul>\n<li>we just need edit the pam authentication file that was created when xrdp was installed<\/li>\n<li><strong><em>\/etc\/pam.d\/xrdp-sesman<\/em><\/strong><\/li>\n<\/ul>\n<div><\/div>\n<div>Its should look like this something like this<\/div>\n<div>===============================<\/div>\n<div style=\"text-align: left;\">#%PAM-1.0<br \/>\nauth include password-auth<br \/>\naccount include password-auth<br \/>\nsession include password-auth<\/div>\n<div><\/div>\n<ol>\n<li>Make a back up of the file <em>\/etc\/pam.d\/xrdp-sesman<\/em>\n<ul>\n<li>cp&nbsp; <em>\/etc\/pam.d\/xrdp-sesman&nbsp; <\/em><em>\/etc\/pam.d\/xrdp-sesman.bak<\/em><\/li>\n<\/ul>\n<\/li>\n<li>Now copy your system-auth file over the&nbsp;<em>\/etc\/pam.d\/xrdp-sesman<\/em>\n<ul>\n<li>cp \/etc\/pam.d\/system-auth&nbsp;<em>\/etc\/pam.d\/xrdp-sesman<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>It should look something like below. Iv bolded the sections that show the sssd authentication section in the file. Now you should be able to use your Active Directory(AD) credentials to authentication when trying to rdp to your linux desktop.<\/p>\n<p>===================================================<br \/>\n#%PAM-1.0<br \/>\n# This file is auto-generated.<br \/>\n# User changes will be destroyed the next time authconfig is run.<br \/>\nauth required pam_env.so<br \/>\n<strong>auth sufficient pam_fprintd.so<\/strong><br \/>\nauth sufficient pam_unix.so nullok try_first_pass<br \/>\nauth requisite pam_succeed_if.so uid &gt;= 500 quiet<br \/>\n<strong>auth sufficient pam_sss.so use_first_pass<\/strong><br \/>\nauth required pam_deny.so<\/p>\n<p>account required pam_unix.so<br \/>\naccount sufficient pam_localuser.so<br \/>\naccount sufficient pam_succeed_if.so uid &lt; 500 quiet<br \/>\n<strong>account [default=bad success=ok user_unknown=ignore] pam_sss.so<\/strong><br \/>\naccount required pam_permit.so<\/p>\n<p>password requisite pam_cracklib.so try_first_pass retry=3<br \/>\npassword sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok<br \/>\n<strong>password sufficient pam_sss.so use_authtok<\/strong><br \/>\npassword required pam_deny.so<\/p>\n<p>session optional pam_keyinit.so revoke<br \/>\nsession required pam_limits.so<br \/>\nsession optional pam_oddjob_mkhomedir.so skel=\/etc\/skel<br \/>\nsession [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid<br \/>\nsession required pam_unix.so<br \/>\n<strong>session optional pam_sss.so<br \/>\n<\/strong>============================================================<\/p>\n<p>Cheers<\/p>\n<p>If you have any questions email nick@nicktailor.com<\/p>\n","protected":false},"excerpt":{"rendered":"<p>For this we will be setting up VNC server and XRDP which allow you to use windows remote desktop terminal services client to connect to your linux desktop as you would any windows machine with centralized authentication using Active directory. XRDP is a wonderful Remote Desktop protocol application that allows you to RDP to your servers\/workstations from any Windows machine,<a href=\"https:\/\/nicktailor.com\/tech-blog\/how-to-setup-vnc-through-rdp-and-authenticate-through-ad\/\" class=\"read-more\">Read More &#8230;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[138,32],"tags":[],"class_list":["post-543","post","type-post","status-publish","format-standard","hentry","category-linux","category-vnc-rdp"],"_links":{"self":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/543","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=543"}],"version-history":[{"count":16,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/543\/revisions"}],"predecessor-version":[{"id":1611,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/543\/revisions\/1611"}],"wp:attachment":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=543"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=543"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=543"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}