Error connecting to sesman: 127.0.0.1 port: 3350

Hello,

I run a little ubuntu box as a plex server. To access it from my windows machine I use xrdp. I also use a VPN (expressVPN) so that I don't have any complaints with my ISP from torrenting.

My issue is:

If my VPN is connected before start my XRDP session, I cannot log in. It just freezes at the teal login screen.

If I putty into the box and disable the VPN first, I can connect, and after I'm connected I can turn the VPN back on.

systemctl says:

ERROR xrdp_wm_log_msg: Error connecting to sesman: 127.0.0.1 port: 3350

Is there a way to get XRDP to play nice with the VPN so I can remote into it while also allowing the VPN to remain always connected?

If there is a better place to ask this question, let me know.

Thanks!

[matt335672]

hi @mokgrem

It's not entirely clear what's happening here.

• What's your xrdp version (xrdp -v)?
• What do you get for grep ^Listen /etc/xrdp/sesman.ini
• What do you get for sudo ss -lnp '( sport = 3350 )' when the VPN is connected?

hi @matt335672 thank you for your review. Answers below.

xrdp -v
version: xrdp 0.9.12

grep ^Listen /etc/xrdp/sesman.ini outputs:

ListenAddress=127.0.0.1
ListenPort=3350

sudo ss -lnp '( sport = 3350 )'

netid tcp
state LISTEN
Recv-Q 0
Send-Q 2
Local Address:Port [[::ffff:127.0.0.1]:3350
Peer Address:Port *:*
Process users:(("xrdp-sesman",pid=42600,fd=7))

Do also note that restarting the xrdp service from Putty SSH (temporarily) resolves the issue. But having to do this anytime (most of the time?) the state of the VPN changes is rather tedious.

[matt335672]

On the face of it, that all appears to be fine. When you got the output of ss above was xrdp working correctly or not. We need to see what it looks like when xrdp is not working correctly.

[naughtius-maximus-8492]

Hi,
I can confirm I get the exact same issue with the same steps with the latest version. To answer the last question, I've invoked the same error by logging in whilst a VPN was active;

Error connecting to sesman: 127.0.0.1 port: 3350

And ran sudo ss -lnp '( sport = 3350 )' whilst xrdp was not working correctly;

Netid      State       Recv-Q      Send-Q            Local Address:Port             Peer Address:Port      Process
tcp        LISTEN      0           2                         [::1]:3350                     [::]:*          users:(("xrdp-sesman",pid=911,fd=11))

Apologies if this is in the wrong place, let me know if this information is of any use. Currently, I can use xrdp with the same method as OP (SSHing into the server, disconnecting the VPN, logging in with XRDP, enabling the VPN) but it is tedious.

OS: Debian 12
NordVPN
xrdp 0.9.21.1

[matt335672]

Hi @DohnJenver

Yes, this is very much of use - thanks.

I've just built 0.9.21.1, and have configured it with these settings:-

xrdp.ini

. .
[Xorg]
. .
ip=127.0.0.1

sesman.ini

. .
[Globals]
ListenAddress=127.0.0.1
ListenPort=3350

$ sudo ss -lnp '( sport = 3350 )'
Netid  State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port Process  
tcp    LISTEN  0       2                [::1]:3350           [::]:*     users:(("xrdp-sesman",pid=17534,fd=11))

I'm not using a VPN. Everything appears to work.

This is despite the ip=127.0.0.1 in the xrdp.ini file. There is a series of hacks which happened earlier to get IPv6 working in a non-disruptive fashion. Sadly these make the current software difficult to fathom just by looking at the parameters.

The latest development versions of xrdp don't use the IP stack for sesman, so all of these problems go away.

What is/are your ip= settings in xrdp.ini?

[naughtius-maximus-8492]

xrdp.ini settings;

[Xorg]
[...]
ip=127.0.0.1
port=-1
code=20

So in theory, with the latest development versions not using the IP stack for sesman, it should be fixed^tm?

[matt335672]

The problem doesn't arise in the devel branch.

What do you get for xrdp -v?

[naughtius-maximus-8492]

xrdp -v nets me;

xrdp 0.9.21.1

[matt335672]

Try building it with --enable-ipv6

My development build looks like this:-

$ xrdp -v
Argument 0 - xrdp
Argument 1 - -v
xrdp 0.9.21.1
  A Remote Desktop Protocol Server.
  Copyright (C) 2004-2020 Jay Sorg, Neutrino Labs, and all contributors.
  See https://github.com/neutrinolabs/xrdp for more information.

  Configure options:
      --enable-devel-all
      --enable-fuse
      --enable-pixman
      --enable-ipv6
      --enable-painter
      --enable-jpeg
      --with-imlib2
      --enable-vsock
      --with-freetype2
      --enable-neutrinordp
      CC=gcc
      CFLAGS=-g -fvar-tracking -Wl,-z,now

  Compiled with OpenSSL 3.0.2 15 Mar 2022

[naughtius-maximus-8492]

I've built it with --enable-ipv6 but I now get this error when connecting, irregardless of whether my VPN is on or off;

Keep in mind it's entirely possible this is a me problem as I've never built anything from source before and Debian is my first foray into Linux.

[naughtius-maximus-8492]

Ah, one thing to note is that xrdp -v nets me this;

xrdp 0.9.80
  A Remote Desktop Protocol Server.
  Copyright (C) 2004-2020 Jay Sorg, Neutrino Labs, and all contributors.
  See https://github.com/neutrinolabs/xrdp for more information.

  Configure options:
      --enable-ipv6

  Compiled with OpenSSL 3.0.9 30 May 2023

Should I be adding anything else to ./configure --enable-ipv6?

[matt335672]

You're using the devel branch at the moment now, rather than v0.9.22.1

That shouldn't need --enable-ipv6 to allow xrdp to talk to sesman!

As to whether you use v0.9.22.1 or what other options to use from ./configure --help, that's up to you. I'll give you some info to help you choose a course of action, and then we'll try to get that working for you.

• devel is considerably different from v0.9.22.1. We've changed the middleware completely, and we're currently getting it to a state where it can be the next major version of xrdp. Because of the major changes, it may contain bugs which we haven't found yet.
• The middleware change means sesman is no longer listening on TCP port 3350, but on a Unix Domain Socket (UDS). This is more secure and allows us to implement some more advanced features. Consequently, the --enable-ipv6 switch has no bearing at all now on the sesman problem you have encountered. It may do so for v0.9.22.1
• The packages used by Debian, EPEL, etc add quite a few options to configure. Here's a link to the configure command used by Debian, and here's a link to the EPEL equivalent.
• One of the other changes made to devel is that we now check the X server is working before we start the session. V0.9.22.1 starts these in parallel which is fine if it all works, but a pig to debug if it doesn't. Your problem above is that the X server isn't starting. We can look into that if you like, but my guess is you also need to build xorgxrdp if you haven't already (making sure the old one is COMPLETELY removed first), and then check that the param=Xorg line in /etc/xrdp/sesman.ini has got a path added to the Xorg command. There are instructions in the file.

I suggest you choose whether you want to try getting v0.9.22.1 working, or devel. I don't know your requirement so I can't really advise you there.

Is that useful?

[zobi]

Hello i have exactly the same issue.
xrdp works find if i don't use my VPN connection, but if my VPN is active i can't connect in RDP.
I found a solution but i don't know if it's secure or not.
In /etc/xrdp/sesman.ini, i change IP=127.0.0.1 to IP=0.0.0.0 and now i can connect in RDP even if my VPN is connected.

[matt335672]

It's secure if you're using a firewall to make sure sesman is unreachable on either your LAN connection, or on your VPN.