mirror of https://github.com/neutrinolabs/xrdp
421 lines
13 KiB
Groff
421 lines
13 KiB
Groff
.\"
|
|
.TH "sesman.ini" "5" "@PACKAGE_VERSION@" "xrdp team" ""
|
|
.SH "NAME"
|
|
\fBsesman.ini\fR \- Configuration file for \fBxrdp-sesman\fR(8)
|
|
|
|
.SH "DESCRIPTION"
|
|
\fBsesman.ini\fR consists of several sections. Each section starts with
|
|
the section name in square brackets, followed by a list of
|
|
\fIparameter\fR=\fIvalue\fR lines. Following sections are recognized:
|
|
|
|
.TP
|
|
\fB[Globals]\fR
|
|
Global configuration
|
|
|
|
.TP
|
|
\fB[Logging]\fR
|
|
Logging subsystem
|
|
|
|
.TP
|
|
\fB[Sessions]\fR
|
|
Session management
|
|
|
|
.TP
|
|
\fB[Security]\fR
|
|
Access control
|
|
|
|
.TP
|
|
\fB[Chansrv]\fR
|
|
Settings for xrdp-chansrv(8)
|
|
|
|
.TP
|
|
\fB[ChansrvLogging]\fR
|
|
Logging settings for xrdp-chansrv(8)
|
|
|
|
.TP
|
|
\fB[SessionVariables]\fR
|
|
Environment variables for the session
|
|
|
|
.LP
|
|
All parameters and values (except for file names and paths) are case
|
|
insensitive, and are described in detail below. If any parameter is
|
|
specified more than once, the last entry will be used. Options specified
|
|
outside their proper section will be \fIignored\fR.
|
|
|
|
.SH "GLOBALS"
|
|
Following parameters can be used in the \fB[Globals]\fR section.
|
|
|
|
.TP
|
|
\fBListenPort\fR=\fIpath-to-socket\fR
|
|
UNIX domain socket for xrdp-sesman(8) to listen on.
|
|
.PP
|
|
.RS
|
|
The default value of this setting is 'sesman.socket'.
|
|
.PP
|
|
An absolute path can be specified by starting this parameter with a '/'.
|
|
In this instance, the system administrator is responsible for ensuring
|
|
the socket can only be created by a suitably privileged process.
|
|
.PP
|
|
If the parameter does not start with a '/', a name within
|
|
@socketdir@ is used.
|
|
.RE
|
|
|
|
.TP
|
|
\fBEnableUserWindowManager\fR=\fI[true|false]\fR
|
|
If set to \fB1\fR, \fBtrue\fR or \fByes\fR, this option enables user
|
|
specific startup script. That is, xrdp-sesman will execute the script
|
|
specified by \fBUserWindowManager\fR if it exists.
|
|
|
|
.TP
|
|
\fBUserWindowManager\fR=\fIfilename\fR
|
|
Path of the startup script relative to the user's home directory. If
|
|
present and enabled by \fBEnableUserWindowManager\fR, that script is
|
|
executed instead of \fBDefaultWindowManager\fR.
|
|
|
|
.TP
|
|
\fBDefaultWindowManager\fR=\fIfilename\fR
|
|
Full path or relative path of the default startup script used by xrdp-sesman
|
|
to start a session. If the path is not a full path, it will be resolved as
|
|
relative path to \fI@xrdpconfdir@\fR. If not specified, defaults to
|
|
\fI@xrdpconfdir@/startwm.sh\fR.
|
|
|
|
.TP
|
|
\fBReconnectScript\fR=\fIfilename\fR
|
|
Full path or relative path if the script which executed when users reconnects
|
|
to the existing session. If the path is not a full path, it will be resolved as
|
|
relative path to \fI@xrdpconfdir@\fR. If not specified, defaults to
|
|
\fI@xrdpconfdir@/reconnectwm.sh\fR.
|
|
|
|
.SH "LOGGING"
|
|
Following parameters can be used in the \fB[Logging]\fR and \fB[ChansrvLogging]\fR
|
|
sections.
|
|
|
|
.TP
|
|
\fBLogFile\fR=\fIfilename\fR
|
|
Log file path. It can be either absolute or relative. If not specified,
|
|
defaults to \fI./sesman.log\fR. If set to \fB<stdout>\fR, log will go to
|
|
stdout. Use for debugging only\fR
|
|
|
|
It is ignored in the [ChansrvLogging] section
|
|
since the channel server creates one log file per display and instead uses the
|
|
following log file naming convention \fIxrdp-chansrv.${DISPLAY}.log\fR
|
|
|
|
.TP
|
|
\fBLogLevel\fR=\fIlevel\fR
|
|
This option can have one of the following values:
|
|
|
|
\fBCORE\fR or \fB0\fR \- Log only core messages. Those messages are
|
|
logged \fIregardless\fR of the selected logging level.
|
|
|
|
\fBERROR\fR or \fB1\fR \- Log only error messages.
|
|
|
|
\fBWARNING\fR, \fBWARN\fR or \fB2\fR \- Logs warnings and error messages.
|
|
|
|
\fBINFO\fR or \fB3\fR \- Log errors, warnings and informational messages.
|
|
|
|
\fBDEBUG\fR or \fB4\fR \- Log everything. If xrdp-sesman is compiled in
|
|
debug mode, this options will output many more low\-level messages.
|
|
|
|
.TP
|
|
\fBEnableSyslog\fR=\fI[true|false]\fR
|
|
If set to \fB1\fR, \fBtrue\fR or \fByes\fR, this option enables logging to
|
|
syslog.
|
|
|
|
.TP
|
|
\fBSyslogLevel\fR=\fIlevel\fR
|
|
Logging level for syslog. It can have the same values as \fBLogLevel\fR.
|
|
Defaults to \fBDEBUG\fR.
|
|
|
|
.TP
|
|
\fBEnableConsole\fR=\fI[true|false]\fR
|
|
If set to \fB1\fR, \fBtrue\fR or \fByes\fR, this option enables logging to
|
|
the console (ie. stdout).
|
|
|
|
.TP
|
|
\fBConsoleLevel\fR=\fIlevel\fR
|
|
Logging level for the console. It can have the same values as \fBLogLevel\fR.
|
|
Defaults to \fBDEBUG\fR.
|
|
|
|
.TP
|
|
\fBEnableProcessId\fR=\fI[true|false]\fR
|
|
If set to \fB1\fR, \fBtrue\fR or \fByes\fR, this option enables logging the
|
|
process id in all log messages. Defaults to \fBfalse\fR.
|
|
|
|
.SH "SESSIONS"
|
|
Following parameters can be used in the \fB[Sessions]\fR section.
|
|
|
|
.TP
|
|
\fBX11DisplayOffset\fR=\fInumber\fR
|
|
The first X display number available for xrdp-sesman. This prevents
|
|
xrdp-sesman from interfering with real X11 servers. If not specified,
|
|
defaults to \fI10\fR.
|
|
|
|
.TP
|
|
\fBMaxSessions\fR=\fInumber\fR
|
|
Sets the maximum number of simultaneous sessions. If not set or set to
|
|
\fI0\fR, unlimited session are allowed.
|
|
|
|
.TP
|
|
\fBMaxDisplayNumber\fR=\fInumber\fR
|
|
Sets the maximum number which can be assigned to an X11 $DISPLAY. The
|
|
default is compatible with IANA TCP port allocations. If you are not
|
|
allowing TCP connections to your X servers you may safely increase this
|
|
number.
|
|
|
|
.TP
|
|
\fBKillDisconnected\fR=\fI[true|false]\fR
|
|
If set to \fB1\fR, \fBtrue\fR or \fByes\fR, every session will be killed
|
|
within \fBDisconnectedTimeLimit\fR seconds after the user disconnects.
|
|
This setting currently only works with xorgxrdp sessions.
|
|
|
|
.TP
|
|
\fBDisconnectedTimeLimit\fR=\fInumber\fR
|
|
Sets the time limit for \fBKillDisconnected\fR to a value greater than 60.
|
|
Values less than 60 are to be overridden with 60.
|
|
This setting currently only works with xorgxrdp sessions.
|
|
|
|
.TP
|
|
\fBIdleTimeLimit\fR=\fInumber\fR
|
|
Sets the time limit (in seconds) before an idle session is disconnected.
|
|
Idle means no keyboard inputs and no mouse moves/clicks here.
|
|
If set to \fI0\fR, idle sessions will never be disconnected by timeout.
|
|
This works only with xorgxrdp sessions. Moreover, xorgxrdp must be v0.2.9 or later.
|
|
|
|
.TP
|
|
\fBPolicy\fR=\fI[Default|Separate|{UBDI}]\fR
|
|
Session allocation policy. Used to decide when to allocate a
|
|
new session. Set to one of the following values:
|
|
.br
|
|
|
|
.RS
|
|
.HP 12
|
|
\fBDefault\fR - Currently the same as "UB" for all session types
|
|
.HP 12
|
|
\fBSeparate\fR - All sessions are separate. Sessions can never be rejoined,
|
|
and will need to be cleaned up manually, or automatically by setting other
|
|
sesman options.
|
|
.P
|
|
Alternatively combine one-or-more of the following options
|
|
.HP 4
|
|
\fBU\fR - Sessions are separated per user
|
|
.HP 4
|
|
\fBB\fR - Sessions are separated by bits-per-pixel
|
|
.HP 4
|
|
\fBD\fR - Sessions are separated by initial display size
|
|
.HP 4
|
|
\fBI\fR - Sessions are separated by IP address
|
|
.RE
|
|
|
|
.IP
|
|
Note that the \fBU\fR and \fBB\fR criteria cannot be turned
|
|
off. \fBDisplaySize\fR refers to the initial geometry of a connection,
|
|
as actual display sizes can change dynamically.
|
|
|
|
.SH "SECURITY"
|
|
Following parameters can be used in the \fB[Security]\fR section.
|
|
|
|
.TP
|
|
\fBAllowRootLogin\fR=\fI[true|false]\fR
|
|
If set to \fB1\fR, \fBtrue\fR or \fByes\fR, enables root login on the
|
|
terminal server.
|
|
|
|
.TP
|
|
\fBMaxLoginRetry\fR=\fInumber\fR
|
|
The number of login attempts that are allowed on terminal server. If set
|
|
to \fI0\fR, unlimited attempts are allowed. If not specified, defaults to
|
|
\fI3\fR.
|
|
|
|
.TP
|
|
\fBTerminalServerUsers\fR=\fIgroup\fR
|
|
Only the users belonging to the specified group are allowed to login on
|
|
terminal server. If unset or set to an invalid or non\-existent group,
|
|
login for all users is enabled.
|
|
|
|
.TP
|
|
\fBTerminalServerAdmins\fR=\fIgroup\fR
|
|
\fIThis option is currently ignored!\fR Only members of this group can
|
|
have session management rights.
|
|
|
|
.TP
|
|
\fBRestrictOutboundClipboard\fR=\fI[all|none|text|file|image]\fR
|
|
If set to \fBall\fR, will restrict the clipboard
|
|
outbound from the server, to prevent data copied inside the xrdp session
|
|
to be pasted in the client. Default value is \fBnone\fR.
|
|
In addition, you can control text/file/image transfer restrictions
|
|
respectively. It also accepts comma separated list such as text,file,image.
|
|
.br
|
|
|
|
.br
|
|
\fBnone\fR - No restriction about copying inbound clipboard data.
|
|
.br
|
|
\fBall\fR - Restrict to copy inbound clipboard data.
|
|
.br
|
|
\fBtext\fR - Restrict to copy only inbound text clipboard data.
|
|
.br
|
|
\fBfile\fR - Restrict to copy only inbound file clipboard data.
|
|
.br
|
|
\fBimage\fR - Restrict to copy only inbound image clipboard data.
|
|
.br
|
|
|
|
To keep compatibility, the following aliases are also available.
|
|
.br
|
|
\fBtrue\fR - an alias of \fBall\fR.
|
|
.br
|
|
\fBfalse\fR - an alias of \fBnone\fR.
|
|
.br
|
|
\fByes\fR - an alias of \fBall\fR.
|
|
|
|
.TP
|
|
\fBRestrictInboundClipboard\fR=\fI[none|all|text|file|image]\fR
|
|
If set to \fBall\fR, will restrict the clipboard
|
|
inbound from the client, to prevent data copied inside the client
|
|
to be pasted in the xrdp session. Default value is \fBnone\fR.
|
|
In addition, you can control text/file/image transfer restrictions
|
|
respectively. It also accepts comma separated list such as text,file,image.
|
|
.br
|
|
|
|
.br
|
|
\fBnone\fR - No restriction about copying inbound clipboard data.
|
|
.br
|
|
\fBall\fR - Restrict to copy inbound clipboard data.
|
|
.br
|
|
\fBtext\fR - Restrict to copy only inbound text clipboard data.
|
|
.br
|
|
\fBfile\fR - Restrict to copy only inbound file clipboard data.
|
|
.br
|
|
\fBimage\fR - Restrict to copy only inbound image clipboard data.
|
|
.br
|
|
|
|
To keep compatibility, the following aliases are also available.
|
|
.br
|
|
\fBtrue\fR - an alias of \fBall\fR.
|
|
.br
|
|
\fBfalse\fR - an alias of \fBnone\fR.
|
|
.br
|
|
\fByes\fR - an alias of \fBall\fR.
|
|
|
|
.TP
|
|
\fBAlwaysGroupCheck\fR=\fI[true|false]\fR
|
|
If set to \fB1\fR, \fBtrue\fR or \fByes\fR, require group membership even
|
|
if the group specified in \fBTerminalServerUsers\fR doesn't exist.
|
|
|
|
.TP
|
|
\fBAllowAlternateShell\fR=\fI[true|false]\fR
|
|
If set to \fB0\fR, \fBfalse\fR or \fBno\fR, prevent usage of alternate shells by users.
|
|
|
|
.TP
|
|
\fBXorgNoNewPrivileges\fR=\fI[true|false]\fR
|
|
Only applicable on Linux. If set to \fB0\fR, \fBfalse\fR or \fBno\fR, do
|
|
not use the kernel's \fIno_new_privs\fR restriction when invoking the Xorg
|
|
X11 server. The use of \fIno_new_privs\fR is intended to prevent issues due
|
|
to a setuid Xorg executable. However, if a kernel security module (such as
|
|
AppArmor) is used to confine xrdp, \fIno_new_privs\fR may interfere with
|
|
transitions between confinement domains.
|
|
|
|
.TP
|
|
\fBSessionSockdirGroup\fR=\fIgroup\fR
|
|
Sets the group owner of the directories containing session sockets. This
|
|
is normally the GID of the xrdp process so xrdp can connect to user sessions.
|
|
|
|
.SH "X11 SERVER"
|
|
Following parameters can be used in the \fB[Xvnc]\fR and
|
|
\fB[Xorg]\fR sections.
|
|
|
|
.TP
|
|
\fBparam\fR=\fIstring\fR
|
|
Multiple \fIparam\fR lines are supported. This first line specifies the
|
|
path to the X11 server executable. Following lines specify command line
|
|
arguments passed to the X11 server.
|
|
|
|
.SH "CHANSRV"
|
|
Following parameters can be used in the \fB[Chansrv]\fR section.
|
|
|
|
.TP
|
|
\fBFuseMountName\fR=\fIstring\fR
|
|
Directory for drive redirection.
|
|
Created if it doesn't exist. If not specified, defaults to \fIxrdp_client\fR.
|
|
If first character is not a '/', this is relative to $HOME.
|
|
.P
|
|
.RS
|
|
The following substitutions are made in this string:-
|
|
%U - Username
|
|
%u - Numeric UID
|
|
%d - Numeric display number (ex 10)
|
|
%D - Display environment variable (ex :10.0)
|
|
%% - Percent character
|
|
.HP 3
|
|
1) The directory path permissions MUST be configured correctly by
|
|
the system administrator or the system itself - xrdp-chansrv will not
|
|
do this for you (although it will create the final directories owned by
|
|
the user).
|
|
.HP 3
|
|
2) The desktop may not automatically display a link for the redirected
|
|
drive. To fix this, consult the docs for your chosen desktop.
|
|
.RE
|
|
|
|
.TP
|
|
\fBFileUmask\fR=\fImode\fR
|
|
Additional umask to apply to files in the \fBFuseMountName\fR directory.
|
|
The default value of 077 prevents other users on the system from reading
|
|
files on your redirected drives. This may not be appropriate for all
|
|
environments, and so you can change this value to allow other users to
|
|
access your remote files if required.
|
|
|
|
.TP
|
|
\fBEnableFuseMount\fR=\fI[true|false]\fR
|
|
Defaults to \fItrue\fR.
|
|
Set to \fIfalse\fR to disable xrdp-chansrv's use of the FUSE system
|
|
feature, even if it has been built with this feature enabled.
|
|
.P
|
|
.RS
|
|
Setting this value to \fIfalse\fR will disable the following application
|
|
features:-
|
|
.P
|
|
- drive redirection
|
|
.P
|
|
- copying-and-pasting of files
|
|
.RE
|
|
.TP
|
|
\fBUseNautilus3FlistFormat\fR=\fI[false|true]\fR
|
|
Defaults to \fIfalse\fR.
|
|
Set to \fItrue\fR to make file copy-paste compatible with Nautilus from
|
|
GNOME 3 versions later than 3.29.92. Do not use this for any other reason.
|
|
|
|
This setting will be removed in a later version of xrdp, when GNOME 3 is
|
|
no longer supported.
|
|
|
|
.TP
|
|
\fBSoundNumSilentFramesAAC\fR=\fInumber\fR
|
|
Sets the \fInumber\fR of silent frames which are sent to client before close
|
|
message is sent, when AAC is selected. If set to 0, no silent frame is sent.
|
|
If not specified, defaults to \fI4\fR.
|
|
|
|
.TP
|
|
\fBSoundNumSilentFramesMP3\fR=\fInumber\fR
|
|
Sets the \fInumber\fR of silent frames which are sent to client before close
|
|
message is sent, when MP3 is selected. If set to 0, no silent frame is sent.
|
|
If not specified, defaults to \fI2\fR.
|
|
|
|
.TP
|
|
\fBSoundMsecDoNotSend\fR=\fInumber\fR
|
|
Sets the duration(msec). Sound data is not send to client during \fInumber\fR
|
|
millisecond(s) after close message is sent, when AAC/MP3 is selected.
|
|
If set to 0, all the data is sent. If not specified, defaults to \fI1000\fR.
|
|
|
|
.SH "SESSIONS VARIABLES"
|
|
All entries in the \fB[SessionVariables]\fR section are set as
|
|
environment variables in the user's session.
|
|
|
|
.SH "FILES"
|
|
@sysconfdir@/xrdp/sesman.ini
|
|
|
|
.SH "SEE ALSO"
|
|
.BR xrdp-sesman (8),
|
|
.BR xrdp-sesrun (8),
|
|
.BR xrdp (8),
|
|
.BR xrdp.ini (5)
|
|
|
|
For more info on \fBxrdp\fR see
|
|
.UR @xrdphomeurl@
|
|
.UE
|