Skip to content

Implement RDP signing functionality with configuration options for ce…#164

Closed
aschumann-virtualcable wants to merge 1 commit intomstsc-rdp-fixfrom
mstsc-fix-rdp-aschumann
Closed

Implement RDP signing functionality with configuration options for ce…#164
aschumann-virtualcable wants to merge 1 commit intomstsc-rdp-fixfrom
mstsc-fix-rdp-aschumann

Conversation

@aschumann-virtualcable
Copy link
Copy Markdown
Contributor

This pull request implements secure server-side signing of RDP files using a configured certificate, enabling Microsoft’s mstsc.exe to verify file authenticity and integrity. It introduces configuration options for RDP signing certificates and updates the RDP transport scripts to use this feature when available. The server now provides endpoints for clients to request signing information and to obtain signed RDP files, improving security and compatibility with Windows RDP clients.

RDP File Signing Feature:

  • Added a complete implementation for server-side RDP file signing with a function (_sign_rdp_content) that replicates Microsoft's rdpsign.exe behavior, including certificate chain support and correct message formatting for mstsc.exe verification.
  • Exposed configuration options in GlobalConfig for the signing certificate, private key, and optional certificate chain, allowing administrators to enable and manage RDP signing.

Client API and Workflow Changes:

  • Updated the /client REST API to provide the signing certificate and chain to clients on request, and to allow clients to POST RDP content for signing, returning the signed file or errors as appropriate. [1] [2]
  • Modified the ticket issuance process to always create a short-lived signing ticket for RDP transports, enabling secure, authenticated signing requests from transport scripts.

Transport Script Updates:

  • Updated Windows RDP transport scripts (direct.py, tunnel.py) to use the new signing workflow: if a signing ticket is present, the script requests a signed RDP file from the server, ensuring files are signed only when supported and configured. [1] [2]
  • Updated the corresponding signature files for the scripts to reflect the new signing logic and output. [1] [2]

Submodule Update:

  • Updated the client submodule to the latest commit, potentially to support new signing features or API changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants