Security
TLS
All RDP connections use TLS 1.3 by default. On first run, lamco-rdp-server automatically generates a self-signed certificate for immediate use.
Custom Certificate Configuration
cert_path = "/etc/lamco-rdp-server/cert.pem"
key_path = "/etc/lamco-rdp-server/key.pem"
require_tls_13 = false
Note: Self-signed certificates will cause RDP clients to show a certificate warning on the first connection. This is normal behavior. You can deploy a trusted certificate to avoid this prompt. TLS material self-heals: if the certificate or key is missing at startup, the server regenerates it in the configured directory rather than failing to start.
Authentication
Network Level Authentication (enable_nla) requires auth_method = "pam", which authenticates via PAM (Pluggable Authentication Modules) before the full RDP session is established. The two supported auth_method values are none (no authentication, trusted networks only) and pam (system accounts, native installs only). The generated config defaults to auth_method = "none", and the server prints a startup exposure warning if that is combined with a non-loopback listen_addr.
enable_nla = false # NLA requires auth_method = "pam"
auth_method = "none" # "none" or "pam"
Important: Flatpak and Snap distributions do not support PAM authentication due to sandboxing restrictions. PAM requires native installation (.deb, .rpm, or from source). On the hardened native systemd service, the unit joins the shadow group so pam_unix reads /etc/shadow directly, keeping the full seccomp hardening (NoNewPrivileges, SystemCallFilter, ProtectSystem=strict, RestrictRealtime) in place. This resolves an earlier case where PAM silently downgraded to unauthenticated under the sandbox.
No IP allowlist setting. There is no allowed_ips or CIDR filtering built into the server. Restrict access by source IP at the host firewall instead.
Systemd Hardening
The native systemd service unit ships with comprehensive hardening directives to limit the attack surface:
| Directive | Description |
|---|---|
| PrivateTmp=yes | Isolates /tmp and /var/tmp from other processes |
| ProtectSystem=strict | Mounts /usr, /boot, /efi as read-only |
| NoNewPrivileges=yes | Prevents privilege escalation via setuid/setgid |
| ProtectHome=yes | Makes /home, /root, /run/user inaccessible |
| ProtectKernelTunables=yes | Read-only access to /proc and /sys kernel variables |
| ProtectKernelModules=yes | Prevents loading kernel modules |
| RestrictNamespaces=yes | Restricts creation of new namespaces |
D-Bus Policy
The D-Bus configuration file io.lamco.RdpServer.System.conf restricts which users and processes can access the management interface over the system bus. Only authorized users can start, stop, or query the server status via D-Bus.
Polkit Authorization
Administrative operations (such as binding to privileged ports or modifying system-wide configuration) require Polkit authorization. Desktop environments will display an authentication dialog when elevated access is needed.