- Shiked
- 23 Eylül 2026 17:39 UTC
- Yazar
- Kamo
- Commit
- fca7ec4
Guacamole connected, authenticated, and was hung up on: guacd: Security mode: Negotiate (ANY) guacd: Loading keymap "en-us-qwerty" guacd: RDP server closed/refused connection: Manually logged off. Ubuntu ships /etc/X11/Xwrapper.config with allowed_users=console, which permits Xorg to be started only by somebody sitting at the physical console. xorgxrdp starts Xorg as the connecting user from a session that is by definition not the console, so X refuses, sesman's session dies the moment it is created, and xrdp closes the connection. The member sees "You have been disconnected." WHY THIS ONE IS HARD TO FIND. Authentication has already SUCCEEDED by the time it fails, so everything upstream checks out because it genuinely is correct — the username matches the account, the one-time credential was pushed, the route reaches the pod, the certificate is valid, xrdp is listening and answering. And the message names neither X nor permissions: "Manually logged off" reads like the guest chose to end the session. needs_root_rights=yes belongs with it. xorgxrdp's driver needs privileges the wrapper would otherwise drop, and without it X starts and then cannot open the video device — the same failure, one step later. TWO POLKIT RULES, which would have been the next thing to go wrong. An XFCE session with no seated user hits polkit for colord and NetworkManager and puts an authentication dialog in front of the member, who has no password to give it: the account's password is a one-time credential minted per launch and never shown to anybody. The rules grant exactly what those dialogs were asking for and nothing else. Verified against the golden image rather than assumed — the rest of it was already correct, which is what made the inspection worth doing: [Xorg] present with libxup.so, [Xvnc] disabled as intended, sesman running startwm.sh, and all three groups in /etc/group.