freerdp-proxy(1)

📦
version 3.32.1 · 8 versions
, in fedora 43, fedora 44, ubuntu resolute, ubuntu stonking

💖 freerdp-proxy(1) — the FreeRDP girlies' guide 💖

okay bestie, so this is a page from the FreeRDP manual, and it's literally about freerdp-proxy 🫶 — a server binary that lets you MITM-proxy RDP connections. yes, that kind of proxy. sit down, hydrate, and let's get into it ✨

🌸 NAME 🌸

freerdp-proxy — a server binary allowing MITM proxying of RDP connections. no cap, that's the whole job description 💅

🎀 SYNOPSIS 🎀

freerdp-proxy [-h] [--help] [--buildconfig] [--dump-config <config file>] [-v] [--version] [<config file>]

🦋 DESCRIPTION 🦋

freerdp-proxy can be used to proxy a RDP connection between a target server and connecting clients. that's it, that's the vibe. but like, why would you even do that? so glad you asked, bestie, because there are three iconic usage scenarios:

  • Proxying — Connect outdated/insecure RDP servers from behind a (more secure) proxy. yes, it's giving "glow-up for your crusty old server" ✨
  • Analysis — Allow detailed protocol analysis of (many) unknown protocol features (channels). you're literally a scientist now 🔬
  • Inspection — MITM proxy for session inspection and recording. main character surveillance energy, honestly 👑

✨ OPTIONS ✨

  • -h, --help — Display a help text explaining usage. when in doubt, ask for help, it's not a weakness it's a lifestyle 💁‍♀️
  • --buildconfig — Print the build configuration of the proxy and exit. receipts, but make them build-related 🧾
  • -v, --version — Print the version of the proxy and exit. know your era, know your version 💖
  • --dump-config — Dump a template configuration to <config-ini-file> or to stdout or stderr. free starter pack, no signup required 🎁
  • <config-ini-file> — Start the proxy with settings read from <config-ini-file>. your settings, your rules, your ~era~ 📝

⚠️ WARNING ⚠️

bestie. listen. this is the part where we get serious for a sec, because it's genuinely important 😭

The proxy does not support authentication out of the box but acts simply as intermediary. Only RDP and TLS security modes are supported for pass through connections. User and password are transmitted in plain text from client to the proxy in these modes. With NLA the credentials never leave the connecting client and only the NTLM hashes are compared.

🚨 so like, plain text user + password going from client to proxy in RDP/TLS mode. that's not a vibe, that's a liability. protect your credentials, bestie.

To implement proper authentication a proxy-module can be implemented that may authenticate against some backend and map connecting users and credentials to target server users and credentials.

🧪 TEST SETUP 🧪

A simple test setup of freerdp-proxy might look like this:

SAM

User/Domain/Password

Alternatively

This setup is designed for testing purposes only and does not do any authentication mapping of connecting users to target machine users, so any allowed connecting user will use the same credentials on the target.

lowkey everyone sharing the same credentials on the target is giving "one group chat login for the whole friend group" 💀 testing only, bestie. testing. only. 🙈

🌈 EXAMPLES 🌈

freerdp-proxy /some/config/file
freerdp-proxy --dump-config /some/config/file

🧚 PREPARATIONS 🧚

  1. generate certificates for proxy
winpr-makecert -rdp -path . proxy
  1. generate proxy configuration
freerdp-proxy --dump-config proxy.ini
  1. edit configurartion and:
    • provide (preferably absolute) paths for CertificateFile and PrivateKeyFile generated previously
    • remove the CertificateContents and PrivateKeyContents
    • Adjust the [Server] settings Host and Port to bind a specific port on a network interface
    • Adjust the [Target] Host and Port settings to the RDP target server
    • Adjust (or remove if unuse) the Plugins settings
  2. start proxy server
freerdp-proxy proxy.ini
👀 yes bestie, there are two step 3s. we don't ask questions, we just follow the steps. the manpage said what it said and we respect the manpage. 💅

👑 EXIT STATUS 👑

  • 0 — Successful program execution. slay, it worked ✨
  • 1 — Otherwise. it's giving "not it" 😭

🔥 SEE ALSO 🔥

freerdp(7) wlog(7)

go read those too, they're the extended universe iykyk 📚

💜 AUTHOR 💜

FreeRDP <team@freerdp.com>

okay that's the whole page, you ate it, you understood it, you're a proxy girlie now 🫶 and just so you have the lore: this was FreeRDP version 3.32.1, dated 2023-12-14, for freerdp-proxy(1). periodt. 🎀✨

📦 where this page comes from