Hardening consulting

Ogon opensourcing

Better late than never. Four years ago I was giving a talk on FreeRDS at the XDC 2014 and I was announcing that we would opensource the project at the end of the year. The opensourcing is finally here but in April 2018, you can observe a kind of delay !


About

We were late

So obviously lots of things have occured since 2014. First the project's name has changed: it was initially FreeRDS but the name was owned by one of the project's member. And our fork has diverged a lot, so there was the necessity for a new name. We thought at fireRDS, but we had some legal bothering with a giant company exploiting the name fire. So we've finally decided to take the name ogon (fire in russian).

During that time...

Of course the project has gained some new features since 2014:

  • sound support with a pulseaudio module;
  • support for multi-touch on all backends;
  • support for the egfx channel and h264 encoding (using openH264);
  • some implementations for clipboard and disk redirection;
  • for the Qt backend: hardware acceleration using DRI rendernodes, so that allows to have Qt applications done with QML;
  • and lots of other improvements...

License

The initial planned license was Apache 2.0 and finally we've choosen GNU Affero. So that server-side contribution have to be public too. When contributing, you have to sign a CLA (Contributor Licence Agreement).

Hey but what is ogon ?

TLDR; ogon is an RDP server for linux just like xrdp.

More precisely it's a framework to work with RDP under linux, that means that you have the RDP server and of components to publish application throught RDP, writing channels and interacting with RDP clients. Compared to Xrdp, ogon aims to implement all the new shiny RDP standards, leaving the old vector operations. It works on linux only for now, but it is designed to work on windows too.

Technical design

Components


In the ogon framework, we have the following components:

  • the RDP server (ogon-rdp-server) that will do all the RDP stuffs;
  • the sessionManager (ogon-session-manager) which will handle authorisations, authentications and session management. The server and the sessionManager communicate with each other to handle the user session. It also have a thrift listener to administrate channels, users and sessions from external programs;
  • the backend generates the visual content that the server will encode and send to the client. The backend talks with the server using local socket and a shared memory;
  • finally we have channel implementations as independant programs (like the pulseaudio module for instance), they will communicate with the sessionManager to open the channel, and then the program will talk directly with the RDP server.

backends

Today we have 3 backends:

  • a Qt backend that allows to generate the visual content with from a Qt application, the greeter is implemented this way: a fullscreen application showing a login form that communicates with the sessionManager to authenticate the user. This backend is a QPA, so you can virtually take any Qt application and use it as a content provider for ogon;
  • the xogon backend allows to have a X11 environment exported throught ogon. You can have your usual X session with associated programs exported via RDP;
  • and finally we have the same with weston (the reference compositor for wayland);

RDP server

By design the ogon RDP server doesn't handle any vector operation, everything is done using encoded bitmaps. This has simplified the backend implementations that just have to share framebuffer with the RDP server. In worst case the server uses raw bitmap updates, but with most RDP clients it can use remoteFx or H264 codec which use a lot less bandwidth (but at the cost of more CPU).

Logon sequence


Let's see what happens during a logon sequence to see how components interact:

  1. the incoming connection is accepted and the negociation is done up to the activation sequence;
  2. the RDP server contacts the sessionManager with the optionnal credentials retrieved during the negociation;
  3. if the credentials are correct, goto step 5. Otherwise the sessionManager instanciates a greeter process and asks the RDP server to connect on this content provider. The user sees a login form;
  4. user gives login and password, and throught the RDP server, the greeter contacts the sessionManager to authenticate the user. If the credentials are wrong the greeter shows the correponding message, otherwise goto next step;
  5. the sessionManager instaciates a session application, xogon most of the time and asks the RDP server to connect on it.

I've simplified the launching of the X server, in practice it's more complicated as you have to impersonnate to the user and interact with systemd to get a correct environment, but you get the idea.

To conclude

So this is just an appetizer. the ogon project is a framework to do some RDP under linux with lots of stuffs, I've shown only the basics. But now that the project is public, feel free to test and report.