動機
lxc launch で作成したubuntu server 22.04にデスクトップ環境を入れてRDPで接続したい (headlessはできないのか？)
早速、色々設定するコンテナに入り、ubuntu-desktopを入れる
※パッケージは20.04のときになんとなく選定したもので、音は要らんとか割り切っている
~$ sudo apt install --no-install-recommends ubuntu-desktop fonts-roboto fonts-noto ibus-mozc
※上記でgnome-remote-desktopも入った状態となっている
GUIじゃないほうが後々楽なので、gnome-remote-desktopの設定をCLIで進める
どこかで見かけた grdctl を使う
※以前はgrdctlもなかったようだ
~$ grdctl status
RDP:
Status: disabled
TLS certificate:
TLS key:
View-only: yes
Username: (empty)
Password: (empty)
VNC:
Status: disabled
Auth method: password
View-only: no
Password: (empty)
上記のRDPの項目を埋めていったらよさそう？
~$ grdctl rdp enable
~$ grdctl rdp disable-view-only
~$ grdctl status
RDP:
Status: enabled
TLS certificate:
TLS key:
View-only: no
Username: (empty)
Password: (empty)
VNC:
Status: disabled
Auth method: password
View-only: no
Password: (empty)
~$
~$ systemctl --user restart gnome-remote-desktop.service
~$ systemctl --user status gnome-remote-desktop.service
● gnome-remote-desktop.service - GNOME Remote Desktop
Loaded: loaded (/usr/lib/systemd/user/gnome-remote-desktop.service; disabled; vendor preset: enabled)
Active: active (running) since Fri 2022-09-09 13:40:29 UTC; 41s ago
Main PID: 498 (gnome-remote-de)
CGroup: /user.slice/user-xxxxxx.slice/user@xxxxxx.service/app.slice/gnome-remote-desktop.service
└─498 /usr/libexec/gnome-remote-desktop-daemon
Sep 09 13:40:29 lxdgst systemd[191]: Stopped GNOME Remote Desktop.
Sep 09 13:40:29 lxdgst systemd[191]: Starting GNOME Remote Desktop...
Sep 09 13:40:29 lxdgst systemd[191]: Started GNOME Remote Desktop.
~$
# 別のマシンから、リッスンしてない・・？
~$ telnet 192.168.12.34 3389
Trying 192.168.12.34...
telnet: Unable to connect to remote host: Connection refused
~$
設定を進める
~$ grdctl rdp set-credentials username_plain password_plain
Object does not exist at path ?/org/freedesktop/secrets/collection/login?
わからんエラー・・ぐぐって以下で設定できた
# pamの設定をいじった意味があったのかどうかよく考えていないのでわからん
~$ grep gnome /etc/pam.d/login
auth optional pam_gnome_keyring.so
session optional pam_gnome_keyring.so auto_start
~$
# なんとかなったらしい
~$ dbus-run-session -- bash --noprofile --norc
bash-5.1$
bash-5.1$ echo 'db' | gnome-keyring-daemon --unlock
SSH_AUTH_SOCK=/run/user/xxxxxx/keyring/ssh
bash-5.1$
bash-5.1$ grdctl rdp set-credentials username_plain password_plain
bash-5.1$
bash-5.1$ grdctl status
RDP:
Status: enabled
TLS certificate:
TLS key:
View-only: no
Username: (hidden)
Password: (hidden)
VNC:
Status: disabled
Auth method: password
View-only: no
Password: (empty)
bash-5.1$
雑証明書づくり
~$ mkdir -p ~/.config/remote-desktop
~$ cd ~/.config/remote-desktop
~/.config/remote-desktop$ openssl genrsa -out tls.key 4096
~/.config/remote-desktop$ openssl req -new -key tls.key -out tls.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
~/.config/remote-desktop$ openssl x509 -req -days 730 -signkey tls.key -in tls.csr -out tls.crt
Certificate request self-signature ok
subject=C = JP, ST = Some-State, O = Internet Widgits Pty Ltd
~/.config/remote-desktop$ ls
tls.crt tls.csr tls.key
~/.config/remote-desktop$ grdctl rdp set-tls-cert "$HOME/.config/remote-desktop/tls.crt"
~/.config/remote-desktop$ grdctl rdp set-tls-key "$HOME/.config/remote-desktop/tls.key"
~/.config/remote-desktop$
~/.config/remote-desktop$ grdctl status
RDP:
Status: enabled
TLS certificate: /home/username/.config/remote-desktop/tls.crt
TLS key: /home/username/.config/remote-desktop/tls.key
View-only: no
Username: (empty)
Password: (empty)
VNC:
Status: disabled
Auth method: password
View-only: no
Password: (empty)
~/.config/remote-desktop$
~$ systemctl --user restart gnome-remote-desktop.service
~$ systemctl --user status gnome-remote-desktop.service
● gnome-remote-desktop.service - GNOME Remote Desktop
Loaded: loaded (/usr/lib/systemd/user/gnome-remote-desktop.service; disabled; vendor preset: enabled)
Active: active (running) since Fri 2022-09-09 14:49:39 UTC; 1s ago
Main PID: 510 (gnome-remote-de)
CGroup: /user.slice/user-xxxxxx.slice/user@xxxxxx.service/app.slice/gnome-remote-desktop.service
└─510 /usr/libexec/gnome-remote-desktop-daemon
Sep 09 14:49:39 lxdgst systemd[191]: Starting GNOME Remote Desktop...
Sep 09 14:49:39 lxdgst systemd[191]: Started GNOME Remote Desktop.
~$
# 別のマシンから、やっぱりだめなのか
~$ telnet 192.168.12.34 3389
Trying 192.168.12.34...
telnet: Unable to connect to remote host: Connection refused
~$
追記 @2022.09.11
tigervncserverを入れ、VNCでアクセスしてみたら上記の設定は反映されていなかった。
しかしながら、VNCでアクセス中にGUIでremote-desktopに設定すると、RDP待ちが行われるように。
~$ sudo lsof -iTCP:3389
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
gnome-rem 3494 username 8u IPv6 16705330 0t0 TCP *:ms-wbt-server (LISTEN)
~$
その後VNCサーバをkillするとRDP待ちなどしていなかったかのように知らんぷりされてしまった・・headless・・
~$ sudo lsof -iTCP:3389
~$
tigervncserverを実行せずとも、 $ gnome-sell コマンドで画面を追加すると動くのかも (未確認)