github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security improvements

Browse Source 
1) In FIPS mode, Classic RDP security is not allowed at all.
2) In FIPS mode xrdp-keygen creates an empty file
3) Documentation wording improved around the security_level setting
4) Logging improved around the security negotiation
5) Warnings now generated if Classic RDP security is negotiated
This commit is contained in:
matt335672
2025-03-10 20:36:50 +00:00
parent 45ccd2d356
commit 463e500f77
8 changed files with 164 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libxrdp/xrdp_rdp.c
+4 -8
View File
@@ -193,26 +193,22 @@ xrdp_rdp_read_config(const char *xrdp_ini, struct xrdp_client_info *client_info)
{
if (g_strcasecmp(value, "rdp") == 0)
{
client_info->security_layer = PROTOCOL_RDP;
client_info->security_layer = SECURITY_LAYER_RDP;
}
else if (g_strcasecmp(value, "tls") == 0)
{
client_info->security_layer = PROTOCOL_SSL;
}
else if (g_strcasecmp(value, "hybrid") == 0)
{
client_info->security_layer = PROTOCOL_SSL | PROTOCOL_HYBRID;
client_info->security_layer = SECURITY_LAYER_TLS;
}
else if (g_strcasecmp(value, "negotiate") == 0)
{
client_info->security_layer = PROTOCOL_SSL | PROTOCOL_HYBRID | PROTOCOL_HYBRID_EX;
client_info->security_layer = SECURITY_LAYER_NEGOTIATE;
}
else
{
LOG(LOG_LEVEL_WARNING, "security_layer=%s is not "
"recognized, will use security_layer=negotiate",
value);
client_info->security_layer = PROTOCOL_SSL | PROTOCOL_HYBRID | PROTOCOL_HYBRID_EX;
client_info->security_layer = SECURITY_LAYER_NEGOTIATE;
}
}
else if (g_strcasecmp(item, "certificate") == 0)