jadahl/headless-sessions

Project ID: 108232

Description

Proof of concept of how to run headless remote desktop sessions.

Installation Instructions

Configuration can be done e.g. via a VT or via ssh.

Step 1: Configure a headless gnome-remote-desktop.

# Run the following commands as USER

mkdir -p ~/.local/share/gnome-remote-desktop/
openssl req -new -newkey rsa:4096 -days 720 -nodes -x509 -subj /C=DE/ST=NONE/L=NONE/O=GNOME/CN=localhost -out ~/.local/share/gnome-remote-desktop/rdp.crt -keyout ~/.local/share/gnome-remote-desktop/rdp.key
grdctl --headless rdp set-tls-cert ~/.local/share/gnome-remote-desktop/rdp.crt
grdctl --headless rdp set-tls-key ~/.local/share/gnome-remote-desktop/rdp.key
grdctl --headless set-credentials USER PASSWORD # USER and PASSWORD doesn't need to match the username or password of the system
grdctl --headless rdp enable
systemctl --user enable gnome-remote-desktop-headless.service

It is also possible to enable VNC support.

grdctl --headless vnc set-password PASSWORD
grdctl --headless vnc enable

Step 2: Disable selinux (needs policy to allow the headless session helper to do setuid())

setenforce 0

Step 3: Launch a headless session

sudo systemctl start gnome-remote-session@USER.service

This will launch a whole session, by default GNOME Shell, as well as a RDP server.

The session lauched is retrieved from accountsservice. To change it without using GDM, run the following as USER:

gdbus call -y -d org.freedesktop.Accounts -m org.freedesktop.Accounts.User.SetSession -o /org/freedesktop/Accounts/User$UID gnome-classic

to change to gnome-classic. Available sessions can be seen in /usr/share/wayland-sessions. Only the ones with X-GDM-CanRunHeadless=true in the session desktop file can be run this way. That currently means gnome, gnome-classic and gnome-kiosk-script-wayland.

Related merge requests: