Unable to connect from windows RDP to VRDP

[runsoverfrogs]

I'm able to connect to my site with a null authentication using VRDP with a Windows RDP client.

client rdp is windows vista business 32 bit
host is windows server 2008, guest is ubuntu 8.04

but when i turn on external, or host for authentication and try to connect using windows RDP..

it will take its time..

and come back with this message:

[Window Title]
Fatal Error (Error Code: 5)

[Content]
Your Remote Desktop session is about to end.

This computer might be low on virtual memory. Close your other programs, and then try connecting to the remote computer again. If the problem continues, contact your network administrator or technical support.

[OK]

I'm using port 3393, and it works fine when I use null as my authentication for VRDP.


vb log..


00:02:40.044 VRDPAUTH: User: [Jason]. Domain: [DESKTOP-HOME]. Authentication type: [External]
00:02:40.046 VRDPAUTH: ConsoleVRDPServer::Authenticate: loading external authentication library 'C:\Program Files\Sun\xVM VirtualBox\VRDPAuth.dll'
00:02:40.046 VRDPAUTH: Could not resolve import 'VRDPAuth2'. Error code: VERR_SYMBOL_NOT_FOUND
00:02:40.079 VRDPAUTH: Using entry point 'VRDPAuth'.
00:02:40.093 VRDPAUTH: external authentication module returned 'access denied'

[adambot]

I am having this exact same problem, here is my setup:

Virtualbox 1.6.2 running on Windows Vista x64
Ubuntu 8.04 running NAT'ted with the 1.6.2 additions installed
Gentoo 2008.0 running bridged with the 1.6.2 additions installed
Windows XP SP3 running bridged with the 1.6.2 additions installed

Errors are exactly the same, I have tried different combinations of network settings on the hosts, as well as different VRDP ports.

Does anyone have any thoughts/things they want me to try?

[adambot]

Sorry to reply to my own post, but after i thought about it more, i figured it out

Here's what i did:

Connect to my Ubuntu - change no settings: FAILED

Connect to my Ubuntu - click options, then check "Allow me to save credentials", connect: SUCCESS

Delete credentials: Started failing again... (deleting automatically brings back the "all me to save credentials" check box unchecked)

Experiment:
Put in a false username, check "allow me to save credentials", click "connect", click "use another account"; put in valid credentials, uncheck "Remember my credentials"; click "OK": SUCCESS


There seems to be something about the allow me to save credentials option that makes everything start to work... I would appreciate an innotek/sun rep's view/thoughts on this one before i open a bug

[Sasquatch]

Did you read the manual concerning the other authentication options? There are a few things you need to do when using authentication for VRDP. Keep in mind that, if you enable normal RDP for the Guest system and you either have port forwarding with NAT, or use HIF, you can use the normal RDP server of Windows instead of VB.

[adambot]

Yes i read the manual and NO we are not talking about port forwarding into the guest OS, we are talking about using Vista RDP to connect to the VRDP module with external authentication enabled.

Furthermore, guest RDP is not available for linux installs and i don't want to use VNC because i don't want to deal with ssh tunneling for encryption...

Finally -- if you are doing a new install remotely or troubleshooting you need to be able to see the whole boot process so that you can deal with errors/bugs. In addition to the bug troubleshooting there are some applications on Windows server that cannot be installed without being in console mode:

EX: you are running a terminal server in a production environment that has multiple users connecting to the bridged VM. You need to install an additional app, however, because the TS server is running in application mode, to avoid an outage you need to use the console. The datacenter that houses the server the vbox is installed on is on the other side of the country so flying there to use the server console is not really an option and using rdp to connect to run the vbox console won't help either because the server is running headless.

In this situation you NEED to be able to connect to the VRDP server for speed of connection/cost/reliability. and this was just one example that flew off the top of my head... there are many more that i can bring up.

Not to sound like a jerk (since when typing, most of my attempts at humor are lost...) but for many people and in many cases using the guest OS's remote access features are just not good enough... SO STOP SUGGESTING IT (that last part was a joke btw)

[Sasquatch]

Even with all the talking you did, you never mentioned what you did to the advise of the manual. I will quote the needed part:

7.4.4 RDP authentication For each virtual machine that is remotely accessible via RDP, you can individually determine if and how RDP connections are authenticated.
For this, use VBoxManage modifyvm command with the -vrdpauthtype op-
tion; see chapter 8.5, VBoxManage modifyvm, page 102 for a general introduction.

Three methods of authentication are available:
• The “null” method means that there is no authentication at all; any client can connect to the VRDP server and thus the virtual machine. This is, of course, very insecure and only to be recommended for private networks.

• The “external” method provides external authentication through a special authentication library.

VirtualBox comes with two default libraries for external authentication:
– On Linux hosts, VRDPAuth.so authenticates users against the host’s PAM
system.
– On Windows hosts, VRDPAuth.dll authenticates users against the host’s
WinLogon system.

In other words, the “external” method per default performs authentication with the user accounts that exist on the host system.
However, you can replace the default “external” authentication module with any other module. For this, VirtualBox provides a well-de?ned interface that allows you to write your own authentication module; see chapter 9.3, Custom external VRDP authentication, page 116 for details.

• Finally, the “guest” authentication method performs authentication with a special component that comes with the Guest Additions; as a result, authentication is not performed with the host users, but with the guest user accounts. This method is currently still in testing and not yet supported.

So, in order to have the proper connection, you need the appropriate libraries. Also note that Vista RDP client can give some problems with VRDP if you have SP1 installed.

[adambot]

A-HA!! NOW i see what you meant...

I got it to work the way i did using External authentication, but i didn't do it via command line, i just used the drop down in the virtualbox console. I was originally going to use guest, but because it was still in testing, i did not feel comfortable using it on my vm's.

I didn't have to worry about any libraries because the errors were a client problem not a virtualbox problem.


And i have vista SP1

[rkleemann]

Even with all the talking you did, you never mentioned what you did to the advise of the manual. I will quote the needed part:

7.4.4 RDP authentication For each virtual machine that is remotely accessible via RDP, you can individually determine if and how RDP connections are authenticated.
For this, use VBoxManage modifyvm command with the -vrdpauthtype op-
tion; see chapter 8.5, VBoxManage modifyvm, page 102 for a general introduction.

Three methods of authentication are available:
• The “null” method means that there is no authentication at all; any client can connect to the VRDP server and thus the virtual machine. This is, of course, very insecure and only to be recommended for private networks.

• The “external” method provides external authentication through a special authentication library.

VirtualBox comes with two default libraries for external authentication:
– On Linux hosts, VRDPAuth.so authenticates users against the host’s PAM
system.
– On Windows hosts, VRDPAuth.dll authenticates users against the host’s
WinLogon system.

In other words, the “external” method per default performs authentication with the user accounts that exist on the host system.
However, you can replace the default “external” authentication module with any other module. For this, VirtualBox provides a well-de?ned interface that allows you to write your own authentication module; see chapter 9.3, Custom external VRDP authentication, page 116 for details.

• Finally, the “guest” authentication method performs authentication with a special component that comes with the Guest Additions; as a result, authentication is not performed with the host users, but with the guest user accounts. This method is currently still in testing and not yet supported.

So, in order to have the proper connection, you need the appropriate libraries. Also note that Vista RDP client can give some problems with VRDP if you have SP1 installed.

Hi,

I'm using VBOX 2.0.2. Ubuntu host and guest.

I'm looking at the manual and trying to see what I could be doing wrong. I use VBoxHeadless and configured the vm for external auth. I configured the guest for port 5002. I attempt to use login credentials for a user on the host system, but all I get is "access denied". Here's the log contents:

00:15:05.696 VRDP: Channel: [rdpdr] [1004]. Not supported.
00:15:05.696 VRDP: Channel: [cliprdr] [1005]. Accepted.
00:15:05.696 VRDP: Channel: [rdpsnd] [1006]. Accepted.
00:15:05.721 VRDP: Client seems to be MSFT.
00:15:05.721 VRDP: Logon: xxxxxxx build 2600. User: [sysadmin] Domain: [] Screen: 0
00:15:05.721 VRDPAUTH: User: [sysadmin]. Domain: []. Authentication type: [External]
00:15:05.721 VRDPAUTH: external authentication module returned 'access denied'
00:15:05.721 VRDPAUTH: Access denied.
00:15:05.721 VRDP: Connection closed:
00:15:05.721 VRDP: Logoff: xxxxxxx build 2600. User: [sysadmin] Domain: [] Reason 0x0001.

[Sasquatch]

Even with all the talking you did, you never mentioned what you did to the advise of the manual. I will quote the needed part:

7.4.4 RDP authentication For each virtual machine that is remotely accessible via RDP, you can individually determine if and how RDP connections are authenticated.
For this, use VBoxManage modifyvm command with the -vrdpauthtype op-
tion; see chapter 8.5, VBoxManage modifyvm, page 102 for a general introduction.

Three methods of authentication are available:
• The “null” method means that there is no authentication at all; any client can connect to the VRDP server and thus the virtual machine. This is, of course, very insecure and only to be recommended for private networks.

• The “external” method provides external authentication through a special authentication library.

VirtualBox comes with two default libraries for external authentication:
– On Linux hosts, VRDPAuth.so authenticates users against the host’s PAM
system.
– On Windows hosts, VRDPAuth.dll authenticates users against the host’s
WinLogon system.

In other words, the “external” method per default performs authentication with the user accounts that exist on the host system.
However, you can replace the default “external” authentication module with any other module. For this, VirtualBox provides a well-de?ned interface that allows you to write your own authentication module; see chapter 9.3, Custom external VRDP authentication, page 116 for details.

• Finally, the “guest” authentication method performs authentication with a special component that comes with the Guest Additions; as a result, authentication is not performed with the host users, but with the guest user accounts. This method is currently still in testing and not yet supported.

So, in order to have the proper connection, you need the appropriate libraries. Also note that Vista RDP client can give some problems with VRDP if you have SP1 installed.

Hi,

I'm using VBOX 2.0.2. Ubuntu host and guest.

I'm looking at the manual and trying to see what I could be doing wrong. I use VBoxHeadless and configured the vm for external auth. I configured the guest for port 5002. I attempt to use login credentials for a user on the host system, but all I get is "access denied". Here's the log contents:

00:15:05.696 VRDP: Channel: [rdpdr] [1004]. Not supported.
00:15:05.696 VRDP: Channel: [cliprdr] [1005]. Accepted.
00:15:05.696 VRDP: Channel: [rdpsnd] [1006]. Accepted.
00:15:05.721 VRDP: Client seems to be MSFT.
00:15:05.721 VRDP: Logon: xxxxxxx build 2600. User: [sysadmin] Domain: [] Screen: 0
00:15:05.721 VRDPAUTH: User: [sysadmin]. Domain: []. Authentication type: [External]
00:15:05.721 VRDPAUTH: external authentication module returned 'access denied'
00:15:05.721 VRDPAUTH: Access denied.
00:15:05.721 VRDP: Connection closed:
00:15:05.721 VRDP: Logoff: xxxxxxx build 2600. User: [sysadmin] Domain: [] Reason 0x0001.

You did use that library file correctly, right? I don't have experience with it, but I would guess you need that file on your Host system . Then use the Host user credentials to log in. If you have a user called "John" with the password "Doe" on the Host, you have to enter that in the RDP client, even though your Guest would have a user called "Jane" and password "Doe".

[rkleemann]

You did use that library file correctly, right? I don't have experience with it, but I would guess you need that file on your Host system . Then use the Host user credentials to log in. If you have a user called "John" with the password "Doe" on the Host, you have to enter that in the RDP client, even though your Guest would have a user called "Jane" and password "Doe".

Well the host does have the VRDPAuth.so file, am I supposed to move it to a paritcular spot? Looks like I missed that part.

[Sasquatch]

I don't know, as I don't use the VRDP option.

PS, I fixed your quote .

[rkleemann]

I don't know, as I don't use the VRDP option.

PS, I fixed your quote .

Anyone else know about this?

[specialagent]

Hi guys,

just want to know if there are some news with the VRDP authentication.

Im running VirtualBox 2.1.4 Headless on a Debian Host and would like to connect with a username+password combination to my guest machines (Kubuntu and FreeBSD, Kubuntu has Gust additions 2.1.4 installed) through the VRDP server from windows XP or Vista.

If Im setting the VBoxManage modifyvm "Kubuntu" -vrdpauthtype external option (or the -vrdpauthtype guest option) Im just getting some wired errors on Windows (not enough memory and stuff).

On my Debian host a tail -f /var/log/auth.log tells me:

Code: Select all

Mar 14 08:35:55 hostname VBoxHeadless: pam_unix(login:auth): authentication failure; logname=myUsername uid=0 euid=0 tty= ruser= rhost=

(I modifed hostname and myUsername manually for don't paste internal information to the internet!)

That's it... hope that someone will use this information to fix this problem.

[stevellion]

Hmm - thanks for the tips, it's lead me to a very easy fix from within Ubuntu Natty.

Add "vboxusers" into my secondary groups, log out, log in - hey presto. Simple...