VRDP not working after upgrading to 5.1

[VBoxVM]

Host: Debian 8. Updated from 5.0.26 to 5.1. Extension Pask updated. Firewall is not set, the ports are opened.
VBoxManage showvminfo:
VRDE: enabled (Address 0.0.0.0, Ports 5004, MultiConn: on, ReuseSingleConn: off, Authentication type: external)
VRDP not working after upgrading.

[Perryg]

Post the guests log file ( as an attachment ). Right click on the guest in the Main Manager then click show log. Save and post as an attachment. Compress if it is too large to post.

[VBoxVM]

Added log file

[Perryg]

Code: Select all

00:00:16.004243 VRDP: Connection opened (IPv4): 0
00:00:16.004579 VRDP: Negotiating security method with the client.
00:00:16.005191 VRDP: Connection closed: 0
00:00:16.111891 VRDP: New connection: 
00:00:16.111931 VRDP: Connection opened (IPv4): 1
00:00:16.112203 VRDP: Negotiating security method with the client.
00:00:16.112760 VRDP: Connection closed: 1
00:00:16.220204 VRDP: New connection: 
00:00:16.220240 VRDP: Connection opened (IPv4): 2
00:00:16.220655 VRDP: Negotiating security method with the client.

Code: Select all

00:00:16.585942 AUTH: Using entry point 'AuthEntry'
00:00:16.586031 ERROR [COM]: aRC=NS_ERROR_FAILURE (0x80004005) aIID={d2937a8e-cb8d-4382-90ba-b7da78a74573} aComponent={VirtualBoxClientWrap} aText={Attempted to create more than one VirtualBoxClient instance}, preserve=false aResultDetail=0
00:00:16.652642 AUTH: external authentication module returned 'access denied'
00:00:16.652659 AUTH: Access denied.
00:00:16.652664 VRDP: Connection closed: 2

For what ever reason the first connection fails which is setting up the failure. One possible reason is the external authentication that you are using and it is not returning the validation fast enough for what ever reason. Does the it work if you set the authentication to none (null)

[VBoxVM]

Without authentication works.

[Perryg]

I am not sure of any real work on the vRDP section lately, but it could have happened. You might want to post a ticket to bugtracker and tell your story. Be sure to tell then which version worked and post guest logs.

[VBoxVM]

Bug reports created.
Install version 5.0.26, vrdp works!

[socratis]

Bug reports created.

It would be nice if you posted a link to the tickets, so anyone landing here from a search could continue their quest to fix it. TIA.

[frank]

Should be fixed in the most recent 5.1 test builds.

[VBoxVM]

It would be nice if you posted a link to the tickets, so anyone landing here from a search could continue their quest to fix it. TIA.

https://www.virtualbox.org/ticket/15653

[offsides]

I just reopened the ticket - it's happening to me in 5.1.10 on CentOS7. This is my first 5.1.x build (I migrated to it from 5.0.x on an older server), so I don't know if earlier versions worked or not.

[offsides]

It's starting too look like a weird unix_chkpwd issue (not running as root despite being setuid root!), but I'm stumped for ideas...

[offsides]

OK, so the bottom line is that unless you run as root, the VBoxAuth.so that uses PAM just doesn't work (theoretically it should work for the user running the VM, but even that was being a problem). So I took the existing code and split it into 2 parts: a VBoxAuth module (VBoxAuthPAMnonroot.so) that doesn't call PAM directly, but instead calls a SUID helper binary that then does the PAM auth as root (VBoxAuthPAMnrhelper). As a security measure to limit the risks of abusing the SUID helper (outside of repeated VRDP auth attempts) the helper binary MUST be hardlinked to VBoxAuthPAM.nrhelper-<username>, where <username> is the name of the user running the VM. Multiple users are permitted, just create multiple hardlinks. The module will call the helper with the name of the user running the VM, and if any other user tries to run that specific link/path it will refuse to do anything.

There's probably a little cleanup that can be done, but I mostly reused existing code wherever possible, and it works on my home system.

[socratis]

@offsides
If you post the resolution to the bug you've been also reporting as well (https://www.virtualbox.org/ticket/15653), you might have a better chance for the developers to see your solution.

[frank]

I don't know why it should be necessary to have root permissions to use the services of libpam.so. My host is using shadow passwords as well but using VBoxAuth authentication I'm able to login using my local credentials. For some reason it's not possible to login if I start the VM using strace but I have no problems without strace. I'm using libpam0g 1.1.8-3.3 on a Debian/Sid installation.