Configuring a Remote Desktop Server on SUSE Linux Enterprise Server 16.0

Create a directory for the TLS encryption key and certificate:

> sudo -u gnome-remote-desktop mkdir -p ~/.local/share/gnome-remote-desktop/

The gnome-remote-desktop user is created automatically when the gnome-remote-desktop package is installed. Its home directory is /var/lib/gnome-remote-desktop.

Generate a TLS key and certificate for encryption. There are different ways to do this:

• With openssl. To generate a 4096 bit RSA key with a validity of 365 days, run:

  > sudo -u gnome-remote-desktop openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 -subj \
    /C=COUNTRY_CODE/ST=STATE/L=LOCALITY/O=ORGANIZATION/CN=example.net \
    -out ~/.local/share/gnome-remote-desktop/tls.crt \
    -keyout ~/.local/share/gnome-remote-desktop/tls.key

  Replace the country code, state, locality, organization, and common name or omit parameters you do not need. For the country code, use a two-letter ISO 3166-1 alpha-2 code from https://www.iso.org/obp/ui/#search/code/.

• If you prefer an interactive command to guide you through the certificate generation, use certtool from the gnutls package:

  > sudo zypper in gnutls
  > sudo -u gnome-remote-desktop certtool --generate-privkey --outfile ~/.local/share/gnome-remote-desktop/tls.key
  > sudo -u gnome-remote-desktop certtool --generate-self-signed --load-privkey  ~/.local/share/gnome-remote-desktop/tls.key

Configure GNOME Remote Desktop with grdctl.

1. Configure encryption for GNOME Remote Desktop:

   > sudo grdctl --system rdp set-tls-key ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.key
   > sudo grdctl --system rdp set-tls-cert ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.crt

2. Set the system credentials for accessing the login manager via RDP:

   > sudo grdctl --system rdp set-credentials

   This combination of user name and password is not to be confused with the individual user credentials. The RDP system credentials are used by all users to access the GNOME Display Manager, where they can log in with their user credentials.

3. Enable the RDP protocol:

   > sudo grdctl --system rdp enable

Enable and start the GNOME Remote Desktop service:

> sudo systemctl enable --now gnome-remote-desktop.service

Open the firewall for connections on the default RDP port:

> sudo firewall-cmd --permanent --add-service=rdp
> sudo firewall-cmd --reload

If you can connect to the GNOME Display Manager but have problems logging in as a user, try connecting with ssh to verify your user password.

If you can connect to the remote desktop server but GNOME Remote Desktop does not accept the system credentials for the RDP connection, you may have configured them while the service was already running. Restart it to pick up the changes:

> sudo systemctl restart gnome-remote-desktop.service

If the RDP system credentials are still not accepted, reset them:

> sudo grdctl --system rdp clear-credentials
> sudo grdctl --system rdp set-credentials
> sudo systemctl restart gnome-remote-desktop.service

If you cannot reach the remote desktop server with your RDP viewer, check if the gnome-remote-desktop service is running:

> sudo systemctl status gnome-remote-desktop

• If the service is not running, start it:

  > sudo systemctl start gnome-remote-desktop.service

• If systemd warns you that the configuration of gnome-remote-desktop.service was changed, make systemd reload its configuration and restart the service:

  > sudo systemctl daemon-reload
  > sudo systemctl restart gnome-remote-desktop.service

Check if the GNOME Display Manager is running:

> sudo systemctl status display-manager.service

If you see any warnings, restart the display manager:

> sudo systemctl restart display-manager.service

Check that gnome-remote-desktop is listening on the default RDP port 3389:

> sudo ss -tulnp | grep :3389

Check that the firewall ports are open:

> sudo firewall-cmd --query-service=rdp

Check that the client can reach the remote desktop server.

1. If you are connecting to the server by host name, check if it is resolved correctly from the client:

   > host SERVER_HOST_NAME

   If the name of the server is not resolved, try connecting to the IP address instead.

2. If the RDP viewer cannot reach the remote desktop server by IP, try pinging the server:

   > ping -c 5 SERVER_IP

   If you can ping the IP address, try connecting to the remote desktop server by IP. If you cannot ping the IP address, check your network setup.