RDP Guacamole errors

feldsam · June 1, 2022, 2:12pm

Hello, today I updated testing installation from 5.10 to 6.2 and I am playing with new functionalities. I try to use Guacamole for VNC - works great. When I try it for RDP I get “CLIENT_ERROR” and in logs are following details

UPDATE:
Looks like this problem is related to encrypted CONTEXT/PASSWORD variable. When I disable encryption and redeployed VM, Guacamole RDP is working

Related issue: VM Encrypted vars and contexualization

Jun  1 15:32:37 one1 guacd[24482]: Creating new client for protocol "rdp"
Jun  1 15:32:37 one1 guacd: guacd[24482]: INFO:#011Creating new client for protocol "rdp"
Jun  1 15:32:37 one1 guacd: guacd[24482]: INFO:#011Connection ID is "$e1dcc7bb-4e88-4d13-8699-df3363cca4c7"
Jun  1 15:32:37 one1 guacd[24482]: Connection ID is "$e1dcc7bb-4e88-4d13-8699-df3363cca4c7"
Jun  1 15:32:37 one1 guacd[28761]: Security mode: Negotiate (ANY)
Jun  1 15:32:37 one1 guacd[28761]: Invalid width: "0". Using default of 1024.
Jun  1 15:32:37 one1 guacd: guacd[28761]: INFO:#011Security mode: Negotiate (ANY)
Jun  1 15:32:37 one1 guacd: guacd[28761]: ERROR:#011Invalid width: "0". Using default of 1024.
Jun  1 15:32:37 one1 guacd: guacd[28761]: ERROR:#011Invalid height: "0". Using default of 768.
Jun  1 15:32:37 one1 guacd: guacd[28761]: INFO:#011Resize method: none
Jun  1 15:32:37 one1 guacd: guacd[28761]: INFO:#011User "@1b88ea59-c16e-43f2-bedc-fd51a786a521" joined connection "$e1dcc7bb-4e88-4d13-8699-df3363cca4c7" (1 users now present)
Jun  1 15:32:37 one1 guacd: guacd[28761]: ERROR:#011Unable to create directory "": No such file or directory
Jun  1 15:32:37 one1 guacd[28761]: Invalid height: "0". Using default of 768.
Jun  1 15:32:37 one1 guacd[28761]: Resize method: none
Jun  1 15:32:37 one1 guacd[28761]: User "@1b88ea59-c16e-43f2-bedc-fd51a786a521" joined connection "$e1dcc7bb-4e88-4d13-8699-df3363cca4c7" (1 users now present)
Jun  1 15:32:37 one1 guacd[28761]: Unable to create directory "": No such file or directory
Jun  1 15:32:37 one1 guacd[28761]: Loading keymap "base"
Jun  1 15:32:37 one1 guacd: guacd[28761]: INFO:#011Loading keymap "base"
Jun  1 15:32:37 one1 guacd: guacd[28761]: INFO:#011Loading keymap "en-us-qwerty"
Jun  1 15:32:37 one1 guacd[28761]: Loading keymap "en-us-qwerty"
Jun  1 15:32:37 one1 guacd[28761]: Cannot create static channel "rdpdr": failed to load "guac-common-svc" plugin for FreeRDP.
Jun  1 15:32:37 one1 guacd: guacd[28761]: WARNING:#011Cannot create static channel "rdpdr": failed to load "guac-common-svc" plugin for FreeRDP.
Jun  1 15:32:37 one1 guacd: guacd[28761]: WARNING:#011Support for the RDPDR channel (device redirection) could not be loaded. Drive redirection and printing will not work. Sound MAY not work.
Jun  1 15:32:37 one1 guacd: guacd[28761]: WARNING:#011Cannot create static channel "rdpsnd": failed to load "guac-common-svc" plugin for FreeRDP.
Jun  1 15:32:37 one1 guacd: guacd[28761]: WARNING:#011Support for the RDPSND channel (audio output) could not be loaded. Sound will not work. Drive redirection and printing MAY not work.
Jun  1 15:32:37 one1 guacd[28761]: Support for the RDPDR channel (device redirection) could not be loaded. Drive redirection and printing will not work. Sound MAY not work.
Jun  1 15:32:37 one1 guacd[28761]: Cannot create static channel "rdpsnd": failed to load "guac-common-svc" plugin for FreeRDP.
Jun  1 15:32:37 one1 guacd[28761]: Support for the RDPSND channel (audio output) could not be loaded. Sound will not work. Drive redirection and printing MAY not work.
Jun  1 15:32:37 one1 guacd[28761]: Error connecting to RDP server
Jun  1 15:32:37 one1 guacd: guacd[28761]: ERROR:#011Error connecting to RDP server
Jun  1 15:32:37 one1 guacd[28761]: User "@1b88ea59-c16e-43f2-bedc-fd51a786a521" disconnected (0 users remain)
Jun  1 15:32:37 one1 guacd: guacd[28761]: INFO:#011User "@1b88ea59-c16e-43f2-bedc-fd51a786a521" disconnected (0 users remain)
Jun  1 15:32:37 one1 guacd: guacd[28761]: INFO:#011Last user of connection "$e1dcc7bb-4e88-4d13-8699-df3363cca4c7" disconnected
Jun  1 15:32:37 one1 guacd[28761]: Last user of connection "$e1dcc7bb-4e88-4d13-8699-df3363cca4c7" disconnected
Jun  1 15:32:37 one1 guacd[24482]: Connection "$e1dcc7bb-4e88-4d13-8699-df3363cca4c7" removed.
Jun  1 15:32:37 one1 guacd: guacd[24482]: INFO:#011Connection "$e1dcc7bb-4e88-4d13-8699-df3363cca4c7" removed.```

Please help.

sbetanzos · June 2, 2022, 7:31am

Hi @feldsam,

This new funcionality of Sunstone and Guacamole that you comment is related to the context variables.

If the VM has a PASSWORD and USERNAME set in the contextualization section, this will be reflected in the RDP connection. You can read more in the documentation.

On the other hand, in OpenNebula 6.2.0, Sunstone didn’t support the encrypted attributes on the VM context. But if you can update to 6.2.1 it should be resolved.

You can see in the documentation the other new features 6.2.1 includes:
https://docs.opennebula.io/6.2/intro_release_notes/release_notes_enterprise/resolved_issues_621.html

Best,
Sergio

feldsam · June 2, 2022, 9:25am

Hello, yes, I applied all paches from 6.2.1 and 6.2.2, it shoudlk be related to this issue

github.com/OpenNebula/one

Unreliable CONTEXT/PASSWORD encryption in VM/template

opened 12:18PM - 01 Oct 21 UTC

closed 08:41PM - 25 Nov 21 UTC

vholer

Category: Core & System Type: Bug Status: Accepted Priority: High Security

**Description** It can be observed broken or unreliable encryption of virtual… machine (template) part of `CONTEXT/PASSWORD` (resp. handling of `VM_ENCRYPTED_ATTR`), during which password is not encrypted on VM/template creation, or is spontaneously decrypted later. **To Reproduce** #### Case 1. VM template `CONTEXT/PASSWORD` not encrypted on template creation Example: - Having a simple template ``` # cat template.txt NAME = "test" MEMORY = "1" VCPU = "1" CPU = "1" CONTEXT = [ PASSWORD = "test" ] ``` - Password is not encrypted on template creationg ``` # onetemplate create template.txt ID: 2828 # onetemplate show 2828 ... TEMPLATE CONTENTS CONTEXT=[ PASSWORD="test" ] CPU="1" MEMORY="1" VCPU="1" ``` - But, password is encrypted on template update ``` # onetemplate update 2828 template.txt # onetemplate show 2828 ... TEMPLATE CONTENTS CONTEXT=[ PASSWORD="mU18gesj9B80f/iOrZrg8A==" ] CPU="1" MEMORY="1" NAME="test" VCPU="1" ``` #### Case 2. VM metadata with unencrypt CONTEXT/PASSWORD on instantiation Example: - Instantiate VM from same template, see PASSWORD gets unencrypted !!!**after a while**!!! ``` # cat template.txt NAME = "test" MEMORY = "1" VCPU = "1" CPU = "1" CONTEXT = [ PASSWORD = "test" ] # onetemplate create template.txt ID: 2831 # onetemplate show 2831 | grep PASSWORD PASSWORD="test" ] # onetemplate instantiate 2831 VM ID: 2830 # while true; do onevm show 2830 | grep PASSWORD; sleep 1; done PASSWORD="vMku31tvO4fhVej9Az3qHg==", PASSWORD="vMku31tvO4fhVej9Az3qHg==", PASSWORD="vMku31tvO4fhVej9Az3qHg==", PASSWORD="vMku31tvO4fhVej9Az3qHg==", PASSWORD="test", PASSWORD="test", PASSWORD="test", PASSWORD="test", PASSWORD="test", ^C ``` - On any template update (e.g., due to REPORT_READY), the password gets encrypted again ``` # touch nothing # onevm show 2830 | grep PASSWORD PASSWORD="test", # touch nothing # onevm update 2830 --append nothing # onevm show 2830 | grep PASSWORD PASSWORD="vMku31tvO4fhVej9Az3qHg==", ``` **Expected behavior** 1. OpenNebula reliably encrypts on creation what's in `VM_ENCRYPTED_ATTR` 2. Once encrypted, forever encrypted. **Details** - Affected Component: oned - Version: 5.12.10+ ## Progress Status - [ ] Branch created - [ ] Code committed to development branch - [ ] Testing - QA - [ ] Documentation - [ ] Release notes - resolved issues, compatibility, known issues - [ ] Code committed to upstream release/hotfix branches - [ ] Documentation committed to upstream release/hotfix branches

there are some changes in VirtualMachineContext.cc file, but it still doesnt work as excepted.

feldsam · June 8, 2022, 4:00pm

Decryption of CONTEXT/PASSWORD fixed in context.sh generation, but looks like, stil persist in remote console code, because RDP can not be autentificated via guacamole.

In meantime I fix problem, PR: B #5871: Guacamole RDP doesn't work with encrypted CONTEXT/PASSWORD by feldsam · Pull Request #5872 · OpenNebula/one · GitHub

sbetanzos · June 10, 2022, 7:26am

Hi @feldsam,

Thanks for the pull request!

We are working to test that everything works well. As soon as possible, we will merge it.

Bests,
Sergio

Topic		Replies	Views
Basic Guacamole/OpenNebula integration Development	3	2311	March 14, 2019
Troubleshoot VNC 500 Error GUI - Sunstone	2	429	June 21, 2023
Apache Guacamole Integration Linux Community Support	3	635	October 25, 2023
Having Issue while Setting up ssh to vm Community Support	1	141	March 4, 2024
Firecracker VMs Community Support	2	454	July 14, 2023

RDP Guacamole errors

Related topics