How can I run RDP over HTTPS using a Linux client?

Question

My employer switched from VPN and RDP to using what our admin calls "RDP over HTTPS". Since that switch I find myself unable to connect to the "new" RDP server.

I think the progress is as follows:

• A RDP gateway-server is connected via TLS
• the requested sever (different from the gateway-server) is then connected through the TLS connection.

In Windows mstsc-settings the server name is the "internal network name" of the machine I wish to connect to. And on the last tab (in German it is called "leistung" - could be "activity"), I go to the "connection from everywhere" settings and set the gateway-server under "gateway-server".

Now: Is there any way to use this scenario under Linux (apart from a virtual machine running Windows)?

I am interested in

• free ideas (e.g. is it possible to create a TLS tunnel and connect through that using freerdp/rdesktop?)
• non-free ideas. As long as they work I'll worry about the costs later.

EDIT (2013-09-27):
As of now the former accepted answer (iTap) is no longer available (see comments there) but by now FreeRDP is the correct answer (for now FreeRDP has TS Gateway Support in it's master/stable-1.1-branch) - so I switched the accepted answer.

Solution 1

FreeRDP is supposed to work in the TLS connection mode if you compile it with OpenSSL support.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.

Solution 2

Install FreeRDP

For the .deb distros (Ubuntu, Debian, etc.)

sudo apt-get install freerdp-x11

For the .rpm distros (RedHat, CentOS, Fedora, etc.)

sudo yum install freerdp

Try It

There doesn't appear to be a GUI that supports this yet, but the CLI does work (somewhat, occasional odd crashes). You can try it with a command like the following.

xfreerdp /g:tsg.domain.tld /gu:username@domain /gp:password /v:targeted-server

I found that not using your password at the command-line resulted in problems. It looks like there may be some solution to that, but it isn't trivial and I haven't yet bothered to dig into it. I just don't use an admin account to cross the gateway.

---

You may want to provide a different username to the target server or adjust resolution, etc. Details on the CLI arguments for such things are available: https://github.com/FreeRDP/FreeRDP/wiki/CommandLineInterface

Comments

[Ignacio Vazquez-Abrams]

I hope they implemented the client auth part of it and not just the server part...

[Nils]

I am not familiar with neither rdp, nor the the "windows-stuff", where is the difference between "client auth" and "server part"? (well, I do know the difference between client and server...)

[Nils]

You mean exposing a ssh-server to the internet so I could use that one as a "proxy"?

[Ignacio Vazquez-Abrams]

That is correct.

[Nils]

good solution, however not feasible for me as my employer would not allow it.

[Admin]

iTap do not work! (Taken from site link): Important release information: iTap mobile RDP does not yet fully support all available virtual channels and redirections available with Microsoft's own clients (it does support features Microsoft does not support on Mac or Linux though, e.g. TS Gateway). Please see the following list of currently unsupported features, we are working hard to include each and every of those features in future versions.

[Nils]

@warkum: iTap does work, I am using it daily now. The quote you gave is regarding iTap mobile RDP, whereas I wrote about iTap desktop RDP.

[flickerfly]

This is no longer an option: "We are sorry to announce that our Linux RDP client product has been discontinued. Additionally we will also only sell our Mac product in the Mac App Store in the future. Although we think several of our customers liked it, our own webshop has not found enough users. "

[flickerfly]

I would love to see this answer fleshed out with some information on how to actually make the connection. I'm excited that it may be possible, but I don't see how to get there from here.

[Nils]

@flickerfly: That's a shame. FreeRDP is the only option, then.

[Nils]

@flickerfly: When This answer was written TS-Gateway Connections were not implemented in FreeRDP. As of 2013-09-23 TS Gateway Support should be in the master/stable-1.1 branch. Commandline-Parameter /G should do the trick, although I have not testet it. You could try the mailing-list at lists.sourceforge.net/lists/listinfo/freerdp-devel - people are always helpful there.