# RDP FIDO 1.24 for Linux Both halves of RDP FIDO run on Linux (Ubuntu 22.04/24.04, Debian, Astra Linux, RED OS 7.3, ALT Linux p10+ and other x86-64 distributions with glibc 2.18+): - **gate `rdpfido-gate`** on the target machine keeps the RDP port (xrdp) closed and opens it only to the address that presented an enrolled FIDO2 key - or, since 1.23, a one-time code from an authenticator app; - **client `rdpfido` / `rdpfido-gui`** connects to Windows or Linux gates with a FIDO2 USB/NFC key (or the one-time code) and starts FreeRDP - or, since 1.24, ssh and the SSH console behind the same key; - **FIDO Stream** (low-latency video, games) works both ways: a Linux machine can stream its X11 desktop (`rdpfido-stream-host`, in the gate package) and watch a stream from Windows or Linux (`rdpfido-viewer`, in the client package); files travel through the stream in both directions, and several participants can share one session (one of them in control). The Windows and Linux editions speak the same protocol: a Windows client connects to a Linux gate and the other way round. ## Install ```sh # Ubuntu / Debian / Astra Linux sudo apt install ./rdpfido-gate_1.24.0_amd64.deb # target machine sudo apt install ./rdpfido-client_1.24.0_amd64.deb # your workstation # RED OS / RHEL-like sudo dnf install ./rdpfido-gate-1.24.0-1.x86_64.rpm sudo dnf install ./rdpfido-client-1.24.0-1.x86_64.rpm # ALT Linux (apt-rpm) sudo apt-get install ./rdpfido-gate-1.24.0-alt1.x86_64.rpm sudo apt-get install ./rdpfido-client-1.24.0-alt1.x86_64.rpm # anything else tar xzf rdpfido-1.24.0-linux-x86_64.tar.gz && cd rdpfido-1.24.0-linux-x86_64 sudo ./install.sh gate # or: client, all ``` Checksums: `SHA256SUMS` in this folder. ## Set up the gate ```sh sudo rdpfido-gate setup # add --install-xrdp if xrdp is missing ``` It creates the gate certificate, installs the service and a boot guard that closes the RDP port before the network comes up, and prints a one-time enrollment code and the gate's certificate thumbprint. The RDP port closes the moment the first key (or account) is enrolled. ## Use the client ```sh rdpfido add --name office --host 10.0.0.5 --user ivan --password rdpfido enroll office CODE --fingerprint THUMBPRINT # code and thumbprint from the gate rdpfido connect office # key -> port opens -> FreeRDP rdpfido stream office # FIDO Stream instead of RDP ``` Or the window: `rdpfido-gui` ("RDP FIDO" in the applications menu). FIDO Stream on a Linux host captures X11 sessions (log in with an "Xorg" session; Wayland is not captured yet). ## A key or a one-time code (1.23) A gate signs people in one way: with a FIDO key (the default) or, for teams without keys, with a 6-digit code from any authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, 1Password...). ```sh sudo rdpfido-gate setup --auth totp # at setup sudo rdpfido-gate auth # which way now sudo rdpfido-gate auth totp # switch (restarts the gate); auth fido to go back sudo rdpfido-gate totp add "Anna" # an account made on the gate, QR code in the terminal sudo rdpfido-gate totp test 3 123456 # check a code from the app ``` Enrollment works as with a key: `rdpfido-gate code`, then `rdpfido enroll` shows a QR code in the terminal (`rdpfido-gui` in a window) and the first code from the app confirms it. When connecting, the client asks for the code; a code is accepted once only. A code opens RDP only - xrdp or Windows still ask for their password; FIDO Stream is off in this mode (it reaches the desktop without a password). Clients 1.23 and newer ask for codes. ## SSH and other ports behind the same key (1.24) The gate can guard more TCP ports of the machine - SSH, a web console - the way it guards RDP: closed to everyone until a key (or code) confirms, then open for the confirming address only, together with the RDP port. ```sh sudo rdpfido-gate ports add 22 # guard SSH; several ports separated by spaces sudo rdpfido-gate ports # what is guarded now sudo rdpfido-gate ports remove 22 # back to normal rdpfido open office # client: key -> ports open, nothing is started rdpfido ssh office # key -> ssh to the session's host rdpfido console office # key -> the SSH console window ``` Connections already established are not cut, so `ports add 22` is safe to run over SSH - check from a second terminal that the key lets you in before closing the first. Only RDP goes through the cloud; the Windows gate does not use the list yet. The SSH console (`rdpfido-console`, in the client package) is a terminal with a side panel: saved passwords typed by a click or by themselves at their prompt (sudo), saved commands, and an AI assistant (Claude or an OpenAI-compatible server) with per-session prompts and conversation history; it sees the console only when allowed. Its window needs a Chromium-family browser (otherwise the page opens in the default browser); saved passwords need the desktop keyring. The session's SSH port, key file and options: `rdpfido add|edit --ssh-port N --ssh-key FILE --ssh-opt ARG`. ## The cloud as an option A gate without a public address can be linked to an RDP FIDO Cloud hub: `sudo rdpfido-gate cloud link HUB:443 CODE` (the code comes from `rdpfido-cloud code` on the hub), `cloud status`, `cloud unlink`. Clients then reach the gate at `.g.:443` without any port forwarding; RDP goes through a tunnel ticket (port 3389 stays closed from outside), FIDO Stream directly or through the hub's relay. A gate that is not linked makes no outgoing connection at all. The hub `rdpfido-cloud` runs on your own VPS: `rdpfido-cloud-1.22.0-linux-x86_64.tar.gz` in this folder (binary, relay, `install.sh`, systemd units, web cabinet; unchanged since 1.22), described in [README-cloud.ru.md](README-cloud.ru.md) (Russian). The Imobile cloud is a private service: Imobile links a gate to it by arrangement, and demo access for connecting is available to get acquainted. ## Updates Every version works for one year from its release date (1.24.0: until 4 October 2027) and then requires an update: upgrade the packages with `apt` / `dnf` / `apt-get`. The gate warns 30 days ahead (`rdpfido-gate status`). Full guide (Russian): [README.ru.md](README.ru.md). Third-party components and licences: [THIRD-PARTY.txt](THIRD-PARTY.txt).