Re: Compiling rdesktop 1.8 on Solaris

Hi,

Finally I managed to get some time to experiment a bit more on this.
Your suggestion worked perfectly!
I can now connect without any problems.

In the end there are some Solaris tweaks that required a lot of googling.
To summarize a Solaris 10 compilation on x86.
First get a bunch of Sunfreeware that are required like the gcc and gnu utilities, automake, pkgconfig.
You most likely get alerted by configure for missing utilities.
I also had to install a bunch of Sunfreeware Kerberos stuff.
It might work with the Solaris 10 default ones but I never got around testing that.

My Very crude instructions:
sunws1 % export CC=gcc
sunws1 % export cc=gcc
sunws1 % export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
sunws1 % export LIBS="-lkrb5 -lkrb5support -lgssapi_krb5"
sunws1 % unset LD_LIBRARY_PATH
sunws1 % which gcc
/usr/local/bin/gcc
# check for /usr/local/lib libpath.
sunws1 % crle

Configuration file [version 4]: /var/ld/ld.config
  Platform:     32-bit LSB 80386
  Default Library Path (ELF):   /lib:/usr/lib:/usr/local/lib
  Trusted Directories (ELF):    /lib/secure:/usr/lib/secure  (system default)
sunws1 % cd libgssglue-0.4
sunws1 % vi src/Makefile
CFLAGS = -O2 -DUSE_SOLARIS_SHARED_LIBRARIES
sunws1 % ./configure
sunws1 % /usr/local/bin/make
# /usr/local/bin/make install

sunws1 % cd ../rdesktop-1.8.0
sunws1 % ./configure -disable-smartcard
sunws1 % /usr/local/bin/make
# /usr/local/bin/make install


On the Windows system (in AD), create a user account for the Solaris system that will be authenticating. In this example we are creating a user account named sunws1 for the host sunws1. (Note: this is a user account, not a computer account)


Run this on the windows RDP server to create the kerberos keytab file (as Administrator):
You might want to change -crypto all to -crypto < your crypto type>
windows % ktpass -princ host/[email protected] -mapuser company\rolands -crypto all -pass supersecret -ptype KRB5_NT_PRINCIPAL -out krb5.keytab

# cp krb5.keytab /etc
sunws1 % /usr/local/bin/kinit host/[email protected]
sunws1 % /usr/local/bin/klist
Ticket cache: FILE:/tmp/krb5cc_6010
Default principal: host/[email protected]

Valid starting     Expires            Service principal
09/05/13 13:41:41  09/06/13 13:41:41  krbtgt/[email protected]
sunws1 % /usr/local/bin/rdesktop -g 1920x1046 -u rolands -T Windows8 -p - windowsserver

- Roland

-----Original Message-----
From: Douglas E. Engert [mailto:[email protected]] 
Sent: Tuesday, 27 August 2013 2:27 AM
To: [email protected]
Subject: Re: [rdesktop-users] Compiling rdesktop 1.8 on Solaris



On 8/25/2013 5:25 PM, Roland Soderstrom wrote:
> Hi Henrik,
>
> I'm sort of out on thin ice here..
>
> I managed to convince the Windows guy to fix so that I could get Kerberos tickets.
> He didn't really know how this works, so it is sort of a trial and error.
> I've run ktpass and got a krb5.keytab which I copied to /etc
> root@sunws1: # /usr/local/bin/klist -e -k Keytab name: 
> WRFILE:/etc/krb5.keytab KVNO Principal

This may not be your problem, but the principal names below don't look correct.
They should have a forward slash,
and normally Kerberos host principals have lower case host/ not uppercase, and the hoist name id the FQDN of the host. Realm names are upper case.

So in your case, a normal Kerberos host principal would look more like:
host/[email protected]

(Kerberos is case sensitive, AD is case insensitive, which can cause confusion.)

Samba or msktutil can be used in place of ktpass for registering hosts too.


(Also DES should not be used any more...)
> ---- --------------------------------------------------------------------------
>     6 HOST\\[email protected] (DES cbc mode with CRC-32)
>     6 HOST\\[email protected] (DES cbc mode with RSA-MD5)
>     6 HOST\\[email protected] (ArcFour with HMAC/md5)
>     6 HOST\\[email protected] (AES-256 CTS mode with 96-bit SHA-1 HMAC)
>     6 HOST\\[email protected] (AES-128 CTS mode with 96-bit SHA-1 
> HMAC)
> root@sunws1: # ls -la /etc/krb5.keytab
> -rw-r--r--   1 root     root         337 Aug 23 14:36 /etc/krb5.keytab
>
> I managed to get a Kerberos ticket
> sunws1 % /usr/local/bin/kinit [email protected] Password for 
> [email protected]:
> sunws1 % /usr/local/bin/klist
> Ticket cache: FILE:/tmp/krb5cc_6010
> Default principal: [email protected]
>
> Valid starting     Expires            Service principal
> 08/26/13 08:07:09  08/27/13 08:07:09  
> krbtgt/[email protected]
> sunws1 % ./rdesktop css0008
> Connection established using CredSSP.
> sunws1 %
> But nothing happens, no desktop appears? Connecting to windows 2003 
> works fine but not windows 2012
>
> Same with debug on.
> sunws1 % ./rdesktop-with-debug css0008 Out TSRequest 1354 bytes data 
> here...
> In TSRequest token 178 bytes
> data here...
> Out TSRequest 347 bytes
> data here...
> In TSRequest token 347 bytes
> data here...
> Out TSCredentials 39 bytes
> data here...
> Out TSRequest 110 bytes
> data here...
> Connection established using CredSSP.
> sunws1 %
>
> Any ideas?

A wireshark trace might show something too, especially if acquiring additional Kerberos tickets is involved.

>
> - Roland
>
> -----Original Message-----
> From: Henrik Andersson [mailto:[email protected]]
> Sent: Wednesday, 21 August 2013 11:12 PM
> To: Roland Soderstrom
> Cc: 'Henrik Andersson'; [email protected]
> Subject: RE: [rdesktop-users] Compiling rdesktop 1.8 on Solaris
>
>
>> I must say I don't know what "initialize a kerberos ticket for the AD 
>> realm" means.
>>
>
> You need to setup the kerberos klient so you can get auth and get tickets from the Windows Domain kerberos realm.
>
>> I asked the windows guy, (I'm not a windows guy) and he said that the 
>> server is installed with whatever Is the default, no added security 
>> or encryption, he believed but was not sure Kerberos was installed 
>> and enabled by default.
>>
>> I might need to do something with Kerberos on Solaris but on Linux?
>> Remmina is connecting without any problem.
>>
>
> Remmina do use freerdp which supports CredSSP+NTLM, rdesktop does only support CredSSP+Kerberos so you need to configure your solaris host to work with the Window Kerberos domain. See /etc/krb5.conf, when everything is in place you should be able to retreive a ticket by:
>
> # kinit [email protected]
> Password: ****
>
> You can verify that you have got a ticket using the klist command.
>
>> I get the same rdesktop error in Linux Mint 15 mate.
>>
>
> See above answer, you need to configure the kerberos client and initialize a ticket.
>
>
>
>
> ----------------------------------------------------------------------
> -------- Introducing Performance Central, a new site from SourceForge 
> and AppDynamics. Performance Central is your source for news, 
> insights, analysis and resources for efficient Application Performance 
> Management.
> Visit us today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.c
> lktrk _______________________________________________
> rdesktop-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/rdesktop-users
>

-- 

  Douglas E. Engert  <[email protected]>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444

------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and AppDynamics. Performance Central is your source for news, insights, analysis and resources for efficient Application Performance Management. 
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
rdesktop-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/rdesktop-users

------------------------------------------------------------------------------
Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more!
Discover the easy way to master current and previous Microsoft technologies
and advance your career. Get an incredible 1,500+ hours of step-by-step
tutorial videos with LearnDevNow. Subscribe today and save!
http://pubads.g.doubleclick.net/gampad/clk?id=58041391&iu=/4140/ostg.clktrk