WESTON-RDP(7)

💖 WESTON-RDP 💖

okay so bestie, welcome to the WESTON-RDP(7) page of the Miscellaneous Information Manual — it's the RDP backend for Weston, and honestly? it's giving remote-desktop royalty. sit down, grab a strawberry 🍓, and let me tell you everything.

---

✨ NAME ✨

weston-rdp — the RDP backend for Weston 🦋

---

✨ SYNOPSIS ✨

weston --backend=rdp

that's it. that's the whole mood. 💅

---

✨ DESCRIPTION ✨

so the RDP backend lets you run a weston environment with zero need for specific graphic hardware or input devices. like, none. ngl that's kind of iconic. the only way users interact with weston here is by connecting over the RDP protocol. that's the whole vibe. 👑

under the hood, the RDP backend uses FreeRDP to do the RDP part, and it acts as an RDP server just listening for incoming connections like a little 🩵 waiting for its bestie to call. it supports different codecs for encoding the graphical content — depending on what the RDP client supports, the backend will encode images using the remoteFx codec, the NS codec, or it'll fallback to raw bitmapUpdate. no cap.

now the security part, bestie, listen up 🔐 — the backend supports RDP security or TLS, and keys and certificates must be provided to the backend depending on which kind of security is requested. the RDP backend will announce security options based on which files have been given. so like, no files, no options. it's literally reading the room.

and here's the fun part: the RDP backend is multi-seat aware ✨ — so if two clients connect on the backend, they will get their own seat. each. their own. seat. periodt.

---

✨ CONFIGURATION ✨

the RDP backend uses the following entries from weston.ini. 🎀

Section rdp

• refresh-rate=rate — specifies the desktop redraw rate in Hz. if you don't specify it, the default is 60Hz. changing this may be useful if you have a faster than 60Hz display, or if you want to reduce updates to reduce network traffic. (lowkey a bandwidth hack, iykyk.)
• tls-key=file — the file containing the key for doing TLS security. heads up bestie: to have TLS security you also need to ship a file containing a certificate. they're a package deal fr fr 💞
• tls-cert=file — the file containing the certificate for doing TLS security. and same deal — to have TLS security you also need to ship a key file.
• nla-ntlm-db=file — the file containing the NTLM credentials used by the NLA (Network Layer Authentication). the entries for this file can be generated using the winpr-hash tool, which is part of FreeRDP. it contains one credential per line. example for the credential generation: winpr-hash -u <user> -d <domain> -p <password> -f sam. 👑

---

✨ OPTIONS ✨

when the RDP backend is loaded, weston will understand the following additional command line options. bestie there are eight of them, let's go. 🦋

• --address=address — the IP address on which the RDP backend will listen for RDP connections. by default it listens on 0.0.0.0.
• --port=port — the TCP port to listen on for connections, it defaults to 3389.
• --no-resizeable — by default when a client connects on the RDP backend, it will instruct weston to resize to the dimensions of the client's announced resolution. when this option is set, weston will force the client to resize to its own resolution. so like, who's in charge here? weston. ✋
• --no-remotefx-codec — the RemoteFX compression codec is enabled by default, but it may be necessary to disable it to work around incompatibilities between implementations. this option may be removed in the future when all known issues are resolved. (so it's on thin ice, bestie 🧊)
• --rdp4-key=file — the file containing the RSA key for doing RDP security.

warning bestie 🚨 as RDP security is known to be insecure, this option should be avoided in production. like, fr fr, don't do it in prod.

• --rdp-tls-key=file — the file containing the key for doing TLS security. to have TLS security you also need to ship a file containing a certificate.
• --rdp-tls-cert=file — the file containing the certificate for doing TLS security. to have TLS security you also need to ship a key file.
• --external-listener-fd=fd — specifies a file descriptor inherited from the process that launched weston to be listened on for client connections.

major warning 💀 only local (such as AF_VSOCK) sockets should be used, as this will be considered to be a local connection by the RDP backend, and TLS and RDP security will be bypassed.

---

🔐 Generating cryptographic material for the RDP backend 🔐

to generate a key file to use for RDP security, you need the winpr-makecert utility shipped with FreeRDP:

$ winpr-makecert -rdp -silent -n rdp-security

this will create a rdp-security.key file. slay. ✨

you can generate a key and certificate file to use with TLS security using a typical openssl invocations:

$ openssl genrsa -out tls.key 2048
Generating RSA private key, 2048 bit long modulus
[...]
$ openssl req -new -key tls.key -out tls.csr
[...]
$ openssl x509 -req -days 365 -signkey tls.key -in tls.csr -out tls.crt
[...]

you will get the tls.key and tls.crt files to use with the RDP backend. look at you, generating cryptography like a whole main character. 🎀

---

✨ SEE ALSO ✨

• weston(1) 💜

---

and that's the page bestie!! this was Weston 16.0.0, dated 2017-12-14, and it's the WESTON-RDP(7) page — go forth and remote-desktop responsibly 🫶✨💅