FreeRDP: A remote desktop protocol implementation
freerdp.com
freerdp.com
It works by converting screen or windows's content to video. It's low latency by design, bandwidth is up to you, and sound also works by default.
To me these seem like more modern, simpler alternatives to older remote desktop protocols as they are designed around modern hardware and one of the most demanding use cases, gaming. Seems like an easy win to me. RDP does have more features, but they seem mostly for niche/side things.
Being able to copy/paste (including files!) between the host and client is pretty useful though.
my understanding is that it's done via shared memory, and if that's right, it's very close to, if not actually, an air gap.
Also setting up a good SSH server on Windows is a pain in the ass
The SunRay ALP protocol and NoMachine are actually the two best I’ve ever seen but have pretty much fallen by the wayside in modern times sadly.
I have seen people whose entire jobs live inside an RDP connection
Most consultants in regulated industries live in RDP sessions, instead of getting a customer provided laptop.
Later, I tried it while traveling and was shocked at how well it worked over a pretty bad link and a VPN (Wireguard).
Still use RDP for work though its better suited to lower bandwidth higher latency text editing IMO plus copy paste etc.
I had a quick glance through the FreeRDP site but didn't spot any immediate clues as to whether this is a true Windows-style optimised/streamed RDP implementation or a "we'll send you a constanst stream of compressed bitmap screenshots" VNC-style...
RDP on Windows is one of the few things I really miss from the Windows ecosystem. There is nothing on Mac or Linux that I've seen to date which comes even close to the near-instantanous experience of using a Windows machine over RDP.
Indeed, comparing it to Xserver, its much better. I use quite a lot Xserver on windows too, to render for example remote Firefox. It works pretty well, but not that good compared to RDP.
And your excellent blog is already in my RSS reader so I have even less excuse for missing this detail… :)
The promise behind this sounds like the holy grail of Remote Access.
Is it Linux-only for the clients? Or can you use Mac and/or Windows to reach a Remmina server?
Edit: looks like it is RDP protocol compatible? If so, WOW, that's cool!
From https://remmina.org/authors/:
> I've been using Remmina now for several years. I love how it's integrated into Ubuntu by default and how I can access the multiple platforms I have to support in one application. I mostly use RDP and VNC (Ultra VNC).
I use it for both RDP and VNC to my Windows desktop. The flatpak currently has a bug with audio over RDP so I've gone back to the version in my distro's packages.
It used to have some weird bugs on Ubuntu though, making it crash after clicking the wrong buttons for some reason. That seems to have been corrected and now it just works. Make sure to use an up to date version, especially if you're on an older LTS machine.
I have i3wm configured to always launch my work rdp session in virtual desktop 10. Switching between work and personal desktops is instantaneous. 10x more convenient than the kvm and thunderbolt dock setups I’ve used before.
It eats your CPU for breakfast, but before VS Code Remote SSH I used to use X forwarding to get a get a Linux VS Code window on my Windows box.
Much improved RDP support is coming with Plasma 6 in early 2024: https://planet.kde.org/arjen-hiemstra-2023-08-08-remote-desk...
It's integrated into the Plasma display server, so no more fiddling with xrdp.
With how Windows 11 is shaping up the future was looking rather depressing.
So this news sounds great, crossing my fingers!
Does that mean I'll need to start a session locally before I can connect via RDP or will it be like Windows RDP where it starts a session on-demand?
IIRC Gnome recently launched something the opposite, where you can only share the screen of an already logged-in session (but it does work with Wayland, but only on Gnome).
A built-in KDE Plasma RDP implementation would be a game-changer, especially if it worked with Wayland (I assume it will) and even more so if it could connect to both existing logged-in sessions and start a new session on demand, like Windows does out of the box.
I can't speak for KDE, but modern versions of gnome+wayland have a built-in RDP server that "just works" (Settings, select Sharing, and enable Remote Desktop). It doesn't perform quite as well as windows RDP (a bit more lag) but is vastly superior to other options I've tried (VNC, NoMachine).
If you just need an RDP _client_ on Linux, Remmina is really solid.
NoMachine is still snappy enough for my needs: primarily browser usage.
It does need the remote machine to be logged in, however, which can be annoying and is a differentiator from how Windows RDP works.
NoMachine seems the only one (that worked well?) I've tried a few years back that could be used to access remotely a local session and viceversa. Which is my use case. Sadly the local session must be logged in, as you said. The black screen feature sometime would fail and any passer by would then be able to use the machine locally. Also if there was a problem with the connection or you forgot to disconnect remotely there was no way to take over the session locally. Complete dealbreaker for me
Sarah from NoMachine here. Would you be able to reach out to us so we can investigate the blank screen not working properly? I understand that you are not using NoMachine anymore, but it would be useful for us to know more details about your setup at the time. You can use the contact us link in the footer of our website. Thank you!
Sarah from NoMachine here. Your comment is truly appreciated :-) We would be interested in hearing from you to learn how we can make it even better. Would you be willing to reach out to us so we can ask you some further questions? You can contact us via the Contact Us link in the footer of the website https://www.nomachine.com/contact-request. Thanks once again and keep nomachining!
https://github.com/nixvital/vital-modules/blob/main/modules/...
I can reasonably drive firefox over that link whereas anything bitmap based tends to just die.
I haven't really used xrdp, but I have used xpra and have been able to attach to running instances of applications that I left open on the host machine remotely (much like I can reattach to a screen or tmux session remotely).
i dont get why there isnt SPICE implementation outside of libvirt. because, thats even better. i mean - usb redirection, sound, (possibly even 3d accel)...
and suggesting doubt-ware like anydesk or even worse - teamviewer... okay, these last ones make sense in some situations.
> WARNING: YOU MAY BE BEING SCAMMED!
> If you are on the phone with someone you DON'T know AND TRUST who has asked you to install RustDesk, do not install and hang up immediately.
> They are likely a scammer trying to steal your money or other private information.
I haven't tried it yet, but I'm hopeful the experience is better than last time I tried Hyper-V enhanced linux experience. I imagine this use case is getting FreeRDP way more attention.
For years I've developed in a Linux VM on a Windows host via VirtualBox. The typing lag on this, particularly in IDEs like VSCode and Rider, finally got to me. So, I moved over to WSL and have to say; the experience is amazing.
Edit: I should say that I haven't used the WSL GUI functionality yet. Been using VSCode's WSL support and it's been amazingly seamless so far. I get native Windows VSCode performance while my project and all its plugins are actually running in the Hyper-V backed WSL linux VM.
- I don't need to enable Hyper-V, which hijacks virtualization and disables other softwares (like VirtualBox) from using it. In fact, when you enable WSL/Hyper-V, your windows itself boots as a kind-of-VM from a Hyper-V root, so WSL is just an additional VM inside that cage.
- Services run normally, since it's a normal linux box. No need to "service docker start" on every WSL boot.
- Easier to image/snapshot/transfer to another box or even another operating system, as VirtualBox runs in other OSes.
And you get the same native VSCode experience. Try it out (VSCode+Remote SSH to Vbox), you'll enjoy just the same as VSCode+WSL
One tip that I have is: Set a secondary NIC in your VirtualBox VM to a 'host only network' and use 'virtio-net' instead of the default emulated Intel Pro1000 cards. Much better performance since it's essentially a virtual device with unbounded speed. With the virtio-net device, even remote X11 becomes a real possibility with windows apps like VcXsrv. I'm a Pycharm user (and Pycharm unfortunately has meager support for remote, where VSCode shines) and I use it graphically like this -- there's still some input lag tho, but it's quick enough for me.
VirtualBox still works if I need to access something off my old VMs, it's just dog slow for some reason using Hyper-V on my system.
I haven't needed to restart docker after booting WSL. Maybe I will, but hasn't happened yet.
The WSL vm feels much more performant to me. It supports dynamic memory allocation and in the new 2.0 release I believe it can free memory. This is really nice in general but particularly on laptops with less RAM.
Resource sharing seems.. Just easier. I like the default drive and network sharing. Both seem to work fast and I don't have to do anything with them..
I can still run multiple VMs if I need to with Hyper-V.
There is a level of integration that is pretty nice. I like typing "code ." in the WSL term and having it just launch VSCode in Windows and be connected. The WSLg system seems really nice for any software I might run that doesn't support remote hosts.
For me, it's all upsides and no real downsides to just running WSL.
For Linux, FreeBSD and OpenBSD hosts, and Unix / MacOS clients, I use tigervnc (be sure to also use their client). It’s the fastest vnc implementation I have seen, and reasonably trouble-free.
My main complaint is that the MacOS client hasn’t been updated for hidpi mode, so MacOS applies a gaussian blur to the session window. (Screen Sharing is the built in MacOS VNC client. It supports HiDPI, but the session immediately hangs when I use it.)
- Real VM you can snapshot and transfer to another computer running VirtualBox, even on another OS, as VBox supports other operating systems.
- With VcXsrv or Xorg on Cygwin, you'll get graphical apps just the same, and with the virtio-net network card on the VM (instead of Virtualbox's default Intel Pro1000 - my protip :D) you'll get enough speed to watch youtube on google chrome -- e.g.: More than sufficient speed for using an IDE like PyCharm etc
- With VSCode, you don't even need a X server. Just use "Remote - SSH" and connect to your VM and keep your local lower input lag - Works just the same as "Remote - WSL" as both essentially use the same mechanism - a remote connection to a Linux server.
- Services run automatically, as it's just a normal Linux install. No need to 'service docker start' on every WSL run
- Doesn't hijacks your Virtualization extensions, like with WSL, which need Hyper-V which actually boots your computer with a Hyper-V hypervisor and blocks nested virtualization, meaning, you can't use other virtualization technologies properly outside of Hyper-V if you use WSL*
* Btw, you also get a (small, but non-zero) performance hit on your Windows box by using WSL, even when it is not running, since now Hyper-V is what boots your system as the ring-0 guy. Yes, your Windows install basically becomes a "VM" hosted by Hyper-V.
Unpopular opinion: WSL is okay for getting work done quick, but there are better solutions with better tradeoffs in how you handle control of your PC's hardware if you do a good VirtualBox set up imo.
There are some solutions (such as https://github.com/jamesstringerparsec/Easy-GPU-PV) that makes the process easy if you are using Hyper-V as the hypervisor, but it is not a straightforward task yet. Hopefully that will change in the future!
wsl2 is just a disk image also, you can just shutdown wsl and copy the disk image to another machine.
I just migrated my home setup to UnRAID. Among the things I was looking forward to was an improved VM experience; I had been happy with VirtualBox, but KVM in UnRAID is a "real Type 1 hypervisor" so had to be better, amirite fellas? Boy, was I shocked when I saw how poor the VM functionality is compared to VirtualBox.
(Yes, I know that UnRAID's GUI does not contain all the functionality `virsh` has (I've heard that the next major release will improve on this). None of that changes the fact that KVM snapshots don't survive beyond reboots, making it impossible to do what I took for granted from back in the VMware days: Rebooting the server and expecting that my VMs will gracefully and automatically save, restart, and continue on.)
I also don't mind that type 1 hypervisors have won, and if one is doing any kind of local Docker or Kubernetes development, the tiny impact of running Windows as a guest hardly matters in the grand scheme of things.
Even though WSL hardly brings anything new over VMWare, much more feature rich than Virtual Box, it saves me the headache of being yet another thing I would care to install, or pay for.
I somewhat miss the kernel translation in favor of the new VM style for these like you mentioned since it's really a VM without some of the benefits like network management and clear cut performance boundaries
Problems I ran into:
- Black screen after login
- Permission issues / strange password prompts
- Login does not work if not logged in / having a HDMI connected
- Copy & Paste did not work
- Shift key led to caps lock /wrong keymapping on Remmina
I found the following fixes:
Script containing various fixes for different problems: https://www.c-nergy.be/products.html
KDE config, that worked for me: https://pilabor.com/blog/2021/05/remote-desktop-with-xrdp-an...
Remmina Shift-Key workaround: https://pilabor.com/blog/2023/09/fixing-remmina-typing-issue...
There are workarounds, but they are "not recommended" for reasons I forget. (I don't mean the workaround of creating a separate user; that is the recommended "solution" but it doesn't solve the problem of "I need to log into this user's active session" which is probably about half of the total use cases for remote desktop in general.)
The "Permission issues / strange password prompts" is generally polkit (formerly PolicyKit), which annihilates the user experience when coming in over RDP; the famous c-energy script referenced in the parent solves a few of those issues, but not nearly all of them. You should expect errors when you try to adjust display properties, try to use any app that looks at disks/partitions, any app that does anything wrt Wi-Fi or Ethernet settings, any app that deals with VMs in any way, and like 357 other things. Each one can be solved by googling for 1-2 hours and then writing some arcane PolKit config file, but it ends up taking about as much time as designing and building a bear-proof suit of armor from scratch, and then testing it against several live bears.
There's also plenty of extensions, some proprietary some not, which allow for more advanced compression/optimization: https://en.wikipedia.org/wiki/RFB_protocol#Encoding_types
But, yes your right if you have a "modern" application that is basically doing all the drawing on the CPU to a generic canvas with custom libraries none of that works, and RDP has to fall back to diffing and compressing. Which is really terrible on any number of fronts.
At that point you might as well just use VNC because the perf is going to be roughly the same.
Besides using a TLS style encryption (VNC at the time had none). RDP tries as hard as possible to not just send bitmaps. It first shares what fonts it wants to use, then a cache of bitmaps from the previous session (for the wallpaper for example). When Windows move it doesn't send bitmap updates, it sends window updates and tells the client to paint a rect, then draw fonts, etc..
That said, it's a bear of a protocol with countless versions and "speed mode" hacks that bypass the layered protocol setup, tons of weird features, etc..
On the graphics side, you can send over draw commands "draw the letter A here using this font", or you can send opengl calls, or you can send dumb bitmap updates. You can get the other end of the connection to do compositing ("blur this buffer and overlay it over that buffer with 50% transparency").
You can also get the remote end of the connection to decode videos - so when you hit play on an MP4 video inside an RDP connection, the actual video decoding gets done on the client not the server.
There was NoMachine / nx / freenx but it always seemed to be a weird animal to me, requiring installation as a separate unix user, at least at the time.
If you use RDP on a Windows server with a consumer GPU, you van hack the Nvidia driver to make more NVENC streams available (they're capped in software) to run more RDP heads without overhead.
RDP also does sound forwarding, local drive forwarding, printer forwarding, and USB device forwarding (up to a point). It also supports a wide range of security features and authentication as security requirements have increased over the years, and has built-in support for bastion hosts/gateways.
One very interesting feature is the ability to RDP only specific applications rather than the desktop. Cassowary will let you "use Windows applications" by using a Windows VM and using RDP to run the applications on Linux as if they were running locally (Cassowary also automatically suspends the VM which is what sets it apart). It's a bit like X11 forwarding, except your local files and drives available without extra commands to set up reverse SSHFS mounts.
VNC is to RDP what telnet is to HTTP/3. The underlying concepts are the same, but the implementations have very different feature sets and advancements. Does VNC even support passwords longer than right characters yet? Last time I checked, VNC servers still truncated your password.
Being proprietary, RDP support on Linux is very limited in comparison. RDP clients like Remmina support a surprising amount of features, but on the server side things aren't as compatible. For example, connecting to xrdp works great from desktop clients, but the Microsoft client on Android is slow as hell.
I've also experienced buggy behaviour on Gnome when FreeRDP tries to render window borders in app mode. Window borders don't get drawn right and clicks seem to be shifted by it for some reason.
I don't blame the FreeRDP/xrdp developers for any bugs or problems because RDP is a terribly complex protocol with tons of features, but sadly Linux doesn't seem to have an implementation or alternative that compares to Windows and RDP together.
I don't know a lot about http3. This comparison does not make a lot of sense to me with regards to http2. What changes have been made in http3 to make it conceptually close to telnet?
VNC and RDP both solve "log in to a remote computer", but RDP does a lot more than just sending images one way and sending HID input the other way.
However, the xpra client is somewhat strange and inconsistent when it comes to CLI/UI behaviour.
Video streams can be a real issue if you're working over a slow connection, especially when your application is using small text. RDP will handle remote GUIs much better, as low bitrates tend to make text unreadable.
Of course RDP also supports streaming individual applications.
Personally, I think RDP is undefeated at what it was designed for: controlling desktop GUI applications. On Linux, that's not the case, though, and xpra will provide a very good alternative.
However, I find very few good xpra clients outside of Linux distros. For example, when I look for xpra in Google Play, the first three options are Microsoft's RDP client, two X11 servers, and RealVNC. F-Droid lists nothing at all. I suppose u could try the HTML5 client but it's kind of a bummer. The situation seems to be the exact inverse of RDP: very good Linux server, difficult to use Windows clients on all other platforms.
Use a laptop as a 2nd display on Linux using FreeRDP - https://news.ycombinator.com/item?id=34010970 - Dec 2022 (137 comments)
FreeRDP 2.0 – A Remote Desktop Protocol implementation - https://news.ycombinator.com/item?id=22834286 - April 2020 (122 comments)
Recently found Mobixterm which allows you to setup RDP running through an SSH tunnel. This looks to be the winner for us.
I'll probably still use X2go while it still works for me as I'm running Linux at home, but as soon as it get's too tricky I'm going to replace it with a script that fires up the SSH tunnel and uses Freerdp.
Perhaps you are all using some frontend to it and that adds issues? Not sure. I ran it on the commandline.
My only serious complaint is lack of printer passthrough. That's it.
What the hell.
Anyway, that sent me on a search for a replacement.
what level of client-side risk are you taking connecting a freeRDP client to that host ? (i'm not worried about the case of the client infecting the host)
what is the most secure similar application ? i prefer a linux client, though would be willing to consider windows if there was a client that was significantly more secure
On the other hand, there are browser-based clients such as Apache Guacamole and noVNC, which are protected by the browser's security sandbox. They require a server component, but that can be run in a sandbox or on the untrusted server. There are some limitations to running in a browser (e.g. some keyboard shortcuts might not be forwarded).
The whole platform is built docker containers. You can skip the whole installation steps and just install their Remmina container from docker hub.
Windows Remote Desktop Services (RDS) gateway requires a lot of configuration across several services, but the overall experience is pretty good.
I used Kasm for a bit, but the integration with AzureAD authentication was flaky. It’s a pretty god platform overall though.
Guacamole is mature, but by Jove it’s a fickle thing to configure.
Now I just use a Remmina docker container, which is maintained by Kasm. I have a separate container to route a reverse proxy through to CloudFlare, which uses Azure AD for authentication. Now just go to rep.domain.com, login with AAD creds, and i’m presented with a basic remmina jump host where I can log into whatever VM or host.
It sounds janky, but it’s much more stable and much leas demanding from the administration side of things. It also works over HTTPS port 443, so it (usually) just works on guest wifi.
CloudFlare can also render VNC in the browser, but I didn’t find the experience great, and it just seemed wrong.
Why not publish a repo with what you have done ?
https://github.com/majkinetor/au-packages/tree/master/freerd...