Set up xrdp remote desktop access on RHEL

A graphical RHEL server is awkward to administer over a text-only link, particularly when a package tool or browser needs a GUI. This guide shows how to set up a remote desktop with xrdp on RHEL 8 or 9, using GNOME while keeping a controlled network path.

xrdp suits temporary support, training, and GUI-only administration. SSH should remain the primary automation and recovery route, with a local console, serial console, or cloud out-of-band facility still available during changes.

Australian administrators often reach Perth-hosted infrastructure from Sydney or Melbourne, where WAN latency can make full-screen work slower than terminal work. Clock settings also matter because Sydney, Melbourne, and Adelaide observe daylight saving, while Brisbane remains on AEST.

The Australian server market includes Red Hat subscriptions alongside Rocky Linux, AlmaLinux, and Oracle Linux, so repositories must match the organisation’s platform. Access and logging should also support the Privacy Act 1988 and the Australian Signals Directorate’s Essential Eight.

Compare remote access options

Choose the protocol before opening a firewall port; a graphical session is not automatically the safest remote-access method.

Option	Typical use	Security	Main trade-off
xrdp	Full GNOME desktop	RDP with TLS and xrdp authentication	Requires patching and restricted access
SSH with X11 forwarding	Selected applications	Strong SSH encryption	Poor performance for a full desktop
VNC	Legacy console access	Depends on the implementation	Encryption and authentication need auditing
GNOME Remote Desktop	GNOME-native sessions	RDP-based	Availability differs between RHEL releases

Use xrdp for an occasional full desktop with ordinary client support. Keep SSH for administration, and avoid VNC implementations whose encryption and authentication do not meet local policy.

Prepare repositories and install xrdp

RHEL 8 and 9 normally obtain xrdp from EPEL, a community repository. Enable the matching CodeReady Studio repository and install the release package through your approved repository process. RHEL 9 uses CRB; on RHEL 8, replace crb with powertools.

sudo dnf install -y dnf-plugins-core
sudo dnf config-manager --set-enabled crb
sudo dnf install -y epel-release

Install both the broker and Xorg backend, then start the service at boot. Verify package provenance under change control, especially on internet-facing hosts.

sudo dnf install -y xrdp xorgxrdp
sudo systemctl enable --now xrdp

The service should report active (running) and listen on TCP 3389. If the host is minimal, install GNOME or the RHEL Server with GUI group through the normal software approval process before testing.

sudo systemctl status xrdp --no-pager

Configure the graphical session

Back up the session launcher before changing it. Its final command must start a desktop installed on the host, usually GNOME through xinit or /usr/bin/gnome-session; retain the distribution default when it already works.

sudo cp /etc/xrdp/startwm.sh /etc/xrdp/startwm.sh.bak
sudo nano /etc/xrdp/startwm.sh

The [Xorg] profile in /etc/xrdp/xrdp.ini should use libxrdp.so and request both a username and password. Avoid creating a passwordless profile for convenience.

Restart xrdp after making changes. If SELinux blocks startup, inspect the denial and restore expected labels rather than disabling enforcement.

sudo systemctl restart xrdp
sudo restorecon -Rv /etc/xrdp

Restrict RDP network access

Do not expose TCP 3389 to the internet. Connect through an organisation-managed VPN, and mirror the source restriction in the cloud security group, data-centre firewall, and host firewall.

Remove any earlier broad 3389/tcp allowance. On firewalld, allow only the administrator’s current public address, replacing this documentation-only address and the active zone with the correct values.

sudo firewall-cmd --permanent --zone=public \
  --add-rich-rule='rule family="ipv4" source address="203.0.113.24/32" port port="3389" protocol="tcp" accept'
sudo firewall-cmd --reload

An SSH tunnel avoids a publicly reachable RDP port. Keep external 3389 closed, then point the RDP client at the local tunnel port.

ssh -L 13389:127.0.0.1:3389 sam@server.example.com

Create and test a local account

Use named, non-root accounts with unique passphrases. Grant wheel access only where the role requires it, and create the account at the console or through an approved identity process.

sudo useradd -m -G wheel sam
sudo passwd sam

Set the host’s actual Australian time zone, then test with Windows Remote Desktop Connection, Remmina, or FreeRDP. Avoid simultaneous local and remote sessions under one account because GNOME can reuse the first session and show a black screen.

sudo timedatectl set-timezone Australia/Sydney
timedatectl

Diagnose common failures

Check the service, session manager, listening socket, and current boot logs before changing configuration.

sudo systemctl status xrdp xrdp-sesman --no-pager
sudo journalctl -u xrdp -u xrdp-sesman -b --no-pager
sudo ss -lnt | grep ':3389'

For a black screen, confirm that GNOME is installed, inspect /etc/xrdp/startwm.sh, and ensure the account has a valid home directory. A local console session may also need to be logged out first.

Search the exact error before changing policy, and use community troubleshooting answers as a secondary reference. Review SELinux denials rather than putting the host into permissive mode.

sudo ausearch -m AVC -ts recent

Secure and maintain the service

Apply approved security updates regularly and coordinate xrdp restarts with active sessions during an appropriate maintenance window.

sudo dnf upgrade --security
sudo systemctl restart xrdp

Expire contractor access, rotate shared credentials, and retain audit records under the organisation’s Privacy Act obligations. Prefer VPN MFA because ordinary xrdp logins generally lack phishing-resistant authentication.

Keep general browsing away from privileged administration. Even a benign page such as a live casino game guide should stay outside that workflow, where it could expose credentials or management tokens.

The practical takeaway is to make xrdp reachable only through a VPN or approved source address, while updates, logs, named accounts, and a tested console recovery path remain one operational routine.