Installing XRDP with update for Larger Monitors

Option 1a: Configure the TCP send buffer size

• Edit the file /etc/xrdp/xrdp.ini

• Locate the line that reads "tcp_send_buffer_bytes". Remove the comment character ("#").

• Edit the value so it now reads: 

tcp_send_buffer_bytes=4194304

• Restart the service:

# systemctl restart xrdp

Option 1b: Configure the kernel network buffer size

• Change the current network buffer size to a larger value with the following command:

sysctl -w net.core.wmem_max=8388608

• Create a new file /etc/sysctl.d/xrdp.conf with the following content:

net.core.wmem_max = 8388608

This will ensure that the value is properly set between reboots. 

Source: Link

------

I followed the 2nd option and I have a 35in samsung wide screen monitor.  It would lock up and randomly come back.  User FitAward_6935 goes on to explain that larger monitors now require a higher tcp send buffer.  There is too much fragmentation over the xrdp protocol which then slows the performance.

Fixing Nessus Finding Remote Desktop Protocol Network Level Authentication through GPO

How to fix the Nessus Finding Remote Desktop Protocol Network Level Authentication through GPO.

Click Start -> Control Panel -> Administrative Tools -> Group Policy Management

Step 1:

Open Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security ->

Require User Authentication for Remote Connections by Using Network Level Authentication -> Enabled

Set Client Connection Encryption Level - > Enabled
Encryption Level: High Level

Configuring Xrdp in Redhat (RHEL) 7 / CentOS 7

First thing is to install some type of desktop:

yum groupinstall "Gnome Desktop"

You need to install the epel repo. ****(The Next two lines may change if the version is not 7.8)****

wget http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-8.noarch.rpm

rpm -ivh epel-release-7-8.noarch.rpm

yum clean all
yum repolist

Next install VNC and XRDP

yum install tigervnc-server xrdp

cp /etc/pam.d/sshd /etc/pam.d/xrdp-sesman
systemctl restart xrdp
systemctl enable xrdp

cp /lib/systemd/system/vncserver\@.service /etc/systemd/system/vncserver@.service

Orginal:

[Service]
Type=forking
# Clean any existing files in /tmp/.X11-unix environment
ExecStartPre=/bin/sh -c '/usr/bin/vncserver -kill %i > /dev/null 2>&1 || :'
ExecStart=/usr/sbin/runuser -l  -c "/usr/bin/vncserver %i"
PIDFile=/home//.vnc/%H%i.pid
ExecStop=/bin/sh -c '/usr/bin/vncserver -kill %i > /dev/null 2>&1 || :'

I used the root account for testing. Use any account you would like.
Working:

[Service]
Type=forking
# Clean any existing files in /tmp/.X11-unix environment
ExecStartPre=/bin/sh -c '/usr/bin/vncserver -kill %i > /dev/null 2>&1 || :'
ExecStart=/usr/sbin/runuser -l root -c "/usr/bin/vncserver %i -geometry 1280x1024"
PIDFile=/root/.vnc/%H%i.pid
ExecStop=/bin/sh -c '/usr/bin/vncserver -kill %i > /dev/null 2>&1 || :'

I did the above with sed:

sed -i 's/ -c/root -c/g' /etc/systemd/system/vncserver@.service
sed -i 's/vncserver %i/vncserver %i -geometry 1280x1024/g' /etc/systemd/system/vncserver@.service
sed -i 's/\/home\//\/root/g' /etc/systemd/system/vncserver@.service

Reload the services

systemctl daemon-reload

Set the VNC Password

vncpasswd

Start the service and enable it on boot

systemctl start vncserver@:1.service
systemctl enable vncserver@:1.service