RustDesk - Follow Up on Security in RustDesk - The stuff I should have said in Video 1.
Вставка
- Опубліковано 17 жов 2024
- This isn't the video I originally planned for this week, but given all of the questions around the security aspects of RustDesk, I feel it is necessary to cover it. I apologize for not including it in video one. I just mentioned the docs in the video, and the usage of a key for encrypted communication.
Here I show you how to find the key, how to use it, and how to include it in a downloadable .exe for your Windows clients so they don't have to set the values manually.
This is a fairly short video, but covers some important security aspects of RustDesk.
=== Links ===
Show Notes for RustDesk Install and Setup
wiki.opensourc...
RustDesk Docs Covering Security
rustdesk.com/d...
Support my Channel and ongoing efforts through Patreon:
www.patreon.co...
=== Contact ===
Twitter: @mickintx
Telegram: @MickInTx
Mastodon: mastodon.partec... @MickInTX
Try out SSDNodes VPS Services! Amazing Specs for incredibly low costs. I'm running a 32 GB RAM / $ CPU Server for only $9 a month! Seriously. FOr long term server usage, this is the way to go!
www.ssdnodes.c...
Get a $50.00 credit for Digital Ocean by signing up with this link:
m.do.co/c/a6a6...
Use Hover as your Domain Name Registrar to get some great control over you domains / sub-domains:
hover.com/SHPa...
Support my Channel and ongoing efforts through Patreon:
www.patreon.co...
What does the money go to?
To Pay for Digital Ocean droplets, donations to open source projects I feature, any hardware I may need to purchase for future episodes (which I will then give to a subscriber in a drawing or contest).
=== Attributions ===
Intro and Outro music provided by www.bensound.com
id_ed25519 it is not a random numer, it is key algorithm like rsa or dsa like in ssh-keygen -t ed25519 which generates relatively short keys and offers better security than rsa or dsa
Well, there you go. I again learn something new. Glad to know it's not just a random file name. Thank you for the info.
For all practical purposes, the private key *is* a (nearly) 256bit random number. The file content is just base64 encoded. In terms of security, it is estimated to be comparable to RSA with 3k bits key length, but giving much better performance.
Great explanation, I have already implemented the procedure in my CentOS 7 and I already have encrypted connections. Thanks.
My pleasure.
Thank you for the follow up video, got stuck here and there but now I have an encrypted connection to my hosted servers!
Glad it helped!
@@AwesomeOpenSourceI just hope that Rustdesk is pretty secure.
great tip on the -k _ to require the key. I didn't see this documented anywhere.
It's there, but definitely not obvious. Glad it helped.
So, force encryption with -k _ and include server and key into windows exe file. Thank you! It works!
Awesome! so glad it's working for you.
Thanks for the follow-up. Since your previous video, I have been testing RustDesk in our SME and found it highly effective. This security update will help us in adoption, as we can lock down access once we take the next step and set up our own login server.
That's awesome! Glad it's working for you. If you use it for business, try to throw a few bucks their way and keep the project running! Best!
if you are running your relay on windows you need to use the commands
pm2 start hbbs -- -k _
pm2 start hbbr -- -k _
in order to force encrypted connections.
The good news is that if you do not add the key to the client then they will not be able to initiate a connection through the relay but can be controlled. I find this useful when using a generic password for all clients on my lan but do not want users connecting out to other desktops.
Thanks for the tip.
Thank you for posting these 2 videos on Rustdesk. After much pounding and frustration attempting to follow Rustdesk's instructions on installing the server in Docker on a Synology NAS. I finally got it to work. Seems the documentation covers an older version of Docker/Disk Station software so some things were not where they showed them to be and some things you had to assume, it wasn't clear. Maybe I should type up how to do it with Disk Station 7.1 and send it off to the Rustdesk people? But I find that a lot online these days. Even Microsoft's own online support can contain OLD info. Not sure if that is a search engine issue, Microsoft not updating things, or both.
I'm glad you got it working, ad definitely type up the instructions for others to find and use.
Is there any advantage for using docker in the installation? I am asking because the manual provides installation process without docker
For me, docker makes it much easier to install and update. But do whatever works best for your needs and comfort level.
What??? Really?
Curious, so I fired up wireshark and rustdesk in a VM and transferred some plain text over rustdesk's file transfer interface, and also the clipboard, and also held down the X key for a few seconds, and none of that was visible in wireshark. Just gibberish.
Also, at the top of my client side window, there's a green shield icon - when I hover mouse cursor over it it reads "relayed and encrypted connection"
I can't find anything official that says the public relay servers are unencrypted. From what I see, the advantage in using private keys is to prevent strangers from using your private relay server. I'm assuming private relay servers still use another set of keys it generates for each session to encrypt the data streams - otherwise anybody with your private relay server's key could decrypt data streams belonging to other sessions on that server.
Interesting findings. I'm just reporting what the RustDesk info said at the time. It's better to use the key, but if you find no data was leaking, that's great to know.
for some reason if i put the key into the rustdesk app it works but i can't get it to work by inserting it into the exe file. just says remote desktop is offline?
You might need to check with the Rustdesk team on that. Also, over on my discussion form (discuss.opensourceisawesome.com), Scott from Socttibyte may be able to help you. I think he uses it with Windows users a good bit.
@@AwesomeOpenSource hi mate thanks for the reply but I think I figured it out. So I'll put it here in case it helps someone else out. It turns out for me anyway that by trial and error what I did to make it work was after installing rustdesk I went into the install folder and renamed the exe in there with the host and key as per the instructions. Then you use that renamed exe file as the installer. It's a bit weird but it's how it worked for me. So I then uninstalled rustdesk and used the renamed exe to reinstall it then it worked. I'm not sure if that's how it supposed to work but that's how it worked for me. So I copied that renamed file onto other pcs and used it to install rustdesk then I deleted the renamed file. Sorry for the long winded response and hope it make sense.
Great tips, thank you for that.
Thank you for your video. I have a Question. Is it possible to generate a compact client version like Teamviewer Host version? that only allows income connections? It is possible to customize the client? It is possible with Teamviewer, you can generate a light custom client version with a key presetted
I don't know about only allowing incoming requests, but you can (on Windows) make the executable preset with url and key. You have to modify the filename itself in a specific way for this to work, so definitely go look at their documentation.
I have a question about rustdesk. When i prepared my server for rustdesk, is there a way for creating users for rustdesk? So i want to use that users for address book. Is there a way? Thank you.
I'm not sure how that functions, but I'll see what I can find out. IF you're looking for a way to have an RMM (Remote Machine Management) check out my videos on RPort, and MeshCentral, as those may work better for you from a machine and user management stand point.
@@AwesomeOpenSource thank you so much. I already checked that function but found nothing, interesting. Yes i'm looking your RPort and MeshCentral videos too. Thank you so much about that videos too.
Hi, Thank you for the video, great guide. I used the other guide to install rust desk and this to shore up security. So on this video you advise to put the - k _ in the two places in the docker compose file, which I did. But when I went to your webpage with the accompanying guide it shows use -k in the two places to lock down your relay server to just this key. Did it change or do both work? Also, when I run the client on a windows machine, and manually change the relay server to my server, it connects no problem. This is without installing. When I install, and add the server ID and the key it works as well. So I'm not sure if the key requirement is working on just running the client and not installing it. Any idea ?
The guide is giving you the more speicifc instruction, where I was being a bit more generic on the vivdeo. Sorry for the confusion, but you need to get the key from your server (generate the key) and then use it in your setup.So follow the guide.
My server runs on Ubuntu. When I try to run hbbs and hbbr with -k _ nothing happens. The client can still connect without the key. Any tips?
Make sure you get the key and use it. The key is important.
Why does applying the following command "docker-compose up -d" not generate the hhbr and hbbs files in the root folder?
when you say "root" I want to understand what you mean?
Is there a way to script Rustdesk to have ID Server, Relay Server, API Server and the key information so it can be deployed to clients/friends machine?
For Windows machines, the rustdesk team has a way to include those values in the .exe file name. Check their documentation for the proper order of things. For Linux and MacOS, not that I know of.
RuskDesk has feature of "User ID and Password" login. How to set that up? The documentation doesn't have any guidance regarding it.
I'm not sure, but I'll see what I can find out.
When renaming the RustDesk.exe file, WHERE is the file located? Is it the one in C:\Program Files\RustDesk\RustDesk.exe???? If I rename this, then the Windows Service will not start, as it is pointing to a file that has been renamed.
I believe you do this to the installer exe, not the actual installed exe. The installer will then set the keys and url for the person installing it. It would be best to check their documentation, as this video is over a year old now, adn they just did a new release, so things may have changed.
you should become a trillionare!! thanks MY Guy for doing this I love !
Glad you like it, and thanks for watching.
Commandline Parameters are too complicated for some End-Users. I like this approach for the Windows Executable to put the config values inside the executable name. *thumbs up*
Public Keys are no secrets the ment to be shared why you put this into Bitwarden? You need to put the Private Key into Bitwarden because this is the key to be secured
A lot of people can definitely benefit from that executable name configuration. I put both into bitwarden. I do it because bitwarden syncs, so i can access it easily from a browser on another machine where I"m setting up RustDesk, and I don't have to email myself the key.
Worked perfectly! Thanks a lot! Great solution to replace paid software
Glad you like it!
Hey guys ive been using Rustdesk for a while ( followed this video a while back ) and its been flawless with encryption. Today I setup a Linux client ( copied the ID Server / Key ) but it still shows unencrypted.. Any idea what im doing wrong? It only does this on the linux client, Windows machines I can connect encrypted without issue.. Any help would be greatly appreciated.
I'd definitely post this question on their github discussion page github.com/rustdesk/rustdesk/discussions. This could be a simple bug showing the wrong information.
@@AwesomeOpenSource Will do thanks!! and thanks for the great content ( always enjoy watching & learning ).. Other than this minor mishap rustdesk has been flawless, Even on linux desktops it works it just doesnt show as secured.
What if someone gets access to the exe. They will have the server IP and public key. Can't they also use the server then and distribute the exe?
I mean, if you are using this to support others, you want them to have the IP and key. If you mean run their own service off of your server, you can rotate the keys occasionally. It would, however, be nice to have a login for your server so the user can connect through without it.
I know this is an old video, but is unattended access an option? Thanks 🙏
Yes, it is. You can essentially set a 'Saved' password on the host, then access it by saving it on the client.
Key question: at 3:08 in the video you show a key that reads xfdsfsd=32. Then at 10:03 you show a key in the pub file that is much longer. Did I miss something? In my About Rustdesk I am showing the entire key.
I think in the first part I was just giving an example, then in the second part I was giving the actual Key on my test server at the time. Sorry for the confusion.
I thought, if you did specify a KEY, it would use an internal one, so the data was still encrypted, but used a common key. Are you saying its raw data not encrypted at all if the key os left blank. Thats crazy. It must be still encrypted so keystrokes were not going over the line unencrypted.
No, and sorry for the confusion. The data is encrypted when you connect, regardless of the key being setup / used. The key is setup to keep others from connecting to machines you've setup with that same key. Does that help?
How to connect to remote PC like in RealVNC? Without showing user lock screen. Various users connected same time.
It's not meant for multiple users at once I don't believe, and if the screen is locked, you'll have to provide the user password for that system to access it. This isn't intended to be a workaround to built in system security measures.
When you use the -k _ what about if you already have Rustdesk installed? Do you need to stop it and uninstall it?
Well according to Stackoverflow : "If you just run docker-compose up -d again, it will notice the new container and the changed configuration and apply them." ... Edit: Just tested it, it does work.
The above answer is correct. Just change the command in the docker-compose file, then re-run "docker-compose up -d" and you'll be up to date.
@@AwesomeOpenSource I wish the key was shorter because the name of the exe file is stupidly long.
So key and encryption works, however when trying to add forced encryption (-k _) it stops working... it gives me a "Connection Error, Reset by the peer " error message. If I remove that command, it works again.
Did you add the key into the relay server section in the client?
@@awaddell yes... that's why I commented that key and encryption works.
I would definitely head over the RustDesk github or Reddit and see if they can help with it.
Thank you for this content. Regards.
now it says reset by peer (only from external connection). but the key is being detected. what to do now?
Make sure you are forwarding all necessary ports through the firewall. Other than that, not sure what that could mean. Might be worth an issue post on the Rustdesk github page.
@@AwesomeOpenSource all ports are correctly forwarded and access rules are good. Only when using -k _ it says reset by peer.
Still one problem remains for me. The embedding of the host name and key is NOT working in Windows. I end up with blank fields. Like it is completely ignoring me.
Sorry to hear that. I think Scott @Scottibyte was able to get this working, but don't recall the secret. You might ping him over on my forum discuss.opensourceisawesome.com
How did you get the graph in the bottom panel?
It's just a built in KDE panel widget that I added. I can't recall which one it was now, but there are quite a few as I recall.
Rustdesk or Remotely? I know it is little bit not grateful question. I know all OpS solutions are good and at this moment I'm testing Remotely for my organization
I use RustDesk more, but the convenience of remotely, when I’m not at one of my own machines is really good. Knowing I can get on a browser and access remotely really helps.
Hello, thank you for the great work. Do you know if we can use the free Cloudflare tunnel to setup a subdomain to access the rustdesk server? I am a home user and do not have a static IP, AND if a CF tunnel will work, that would be a simple solution for me... instead of worrying about a more traditional reverse proxy setup. TIA
I'm sure it can be done, though I'm not familiar enough with cloudflare tunnels to provide any insight in how to do it.
@@AwesomeOpenSource , Thanks for the reply.
Is it possible to do just USB redirector with this app?
I don't know what 'usb redirector' means.
Do you have a video actually doing it? I want to install it on my Windows Server 2022
Doing what? Setting up the key values? That's what I'm showing here.
Thanks for this! Their docs aren't totally clear on the public key stuff
You bet.
where or how i can create a preconfigure portable rustdesk.exe for client ?
If you take a look at their documentation they tell you how to adjust the filename of the .exe to include your server path, and the key for your server. So when the client runs your custom named .exe file, they will have those values already set.
@@AwesomeOpenSource Yes, i did it and works, but i thinks for some .ini or config file, nothing did you know?
Hi in the no show how to create a file for send a other usees for connect to the defined server how too?
I have posted in the video how to name the windows file so that the other user doesn't have to enter the server and key information manually. If you still need to send it, then you'll want to send detailed instructions along with your server url and key for the user to enter through a secure communication method like encrypted chat.
Thank you so much. Now it's safe. Thanks a lot.
Glad it helped
I know this is an older video, but after yesterday's RustDesk public relay outage, I've decided to (finally) set up self-hosting. As I'm not a Docker fan, and don't use Linux at our company, I did install the Windows-based package. It works, however when I try to rename the rustdesk.exe file (after a full install to a workstation) to include the server and key information, the rustdesk application acts like it has never been installed and goes through the motions again (and fails). I'm not sure if this is a new thing in the newer versions (1.1.9 and 1.2.1) or not, and I am sorry to say, that the poor wording and lack of information (lots of missing pieces) in the Rustdesk "documenation" on-line does not clarify very well.
Hmmmm. I haven't seen that, but I just deploy it directly on Windows, then manually setup server and keys on each machine. Only aobut 5, so no biggie to do manually for me. I was looking at their docs on the modification of the filename, and it looks like they still support doing it, and have a couple of hints about using the commas in the name, and potentially issues with special characters in the key causing issues. So you may need to evaluate your key, and regenerate a new one.
Is this really safe, I installed but realise that we not know the people behind it. I think to go back to AnyDesk
Do you know the people behind AnyDesk? I don't. Do you trust that they have your best interests in mind? I don't. At the very least, you can feel confident that others are looking at the code that the RustDesk team is putting out since it's open source.
Simply does not work to setup an encrypted connection. IT alyws say "Unencryptedd and Relayed"
I don't see that issue. Mine never says that after setting up the encryption.
Thank you so much for this great explanation of the -k _ . I use rustdesk for remote support on Windows machines and when my customer downloads the rustdesk application from my server for a second time and a previous version is still in his download directory, the key is changing because Windows appends (2) or whatever version to the filename. So when i use -k _ the connection to the server is okay but the connection between the clients is not established.
So, unless you've updated the backend of rustdesk with a version that would require your end user to update their client, there is no need for them to download the client each time you connect.
@@AwesomeOpenSource Thanks for answering. My end users are downloading the client and do not install. They leave the downloaded client in their download folder and that is causing the (#) in the next download. Last week the problem has been solved by the Rustdesk team. From now on the key value is checked for a comma as a delimiter. So everything after the key value, including the comma delimiter, is neglected.
How do we create a key for windows version of the server?
The key is autogenerated on the server, and you just go get it.
@@AwesomeOpenSource nope, not on my deployment LOL.. i have to analyze this out as the files that are supposedly create during the run are not there. I am running hbbr and hbbs on a windows server.
Yeah, after I had rustdesk running I decided to look into that, wasn't hard to find or setup encryption. 🙂
Glad you got it done.
Really a highly rated work, sir.
Thank you kindly!
Does anyone knows how to create users so the users can have their own directory of rustdesk addresses? I am using my own server and it works perfect only thing I haven´t been able to do is to add users so they can have their own directories of rustdesk IDS
Regards
i believe users are slated for a future relase, but not yet available.
Excelent tutorial, how con i do this from Portainer
Just take the docker-compose I made, and create a stack from it in portainer. Basically, copy / paste.
afaik there is nothing preventing this from working on linux as well.
The first argument to an executable is, as far as I know, always the name it was invoked with.
Just play around with a script containing only
```
#!/bin/sh
echo $0
```
It will always print the program that you started.
If the script is called, let's be creative, "script", and you invoke it with `./script` it will print "./script". If you invoke it with `bash script` it will print "script".
Now to the fun part. If you create a symlink to the file and execute the symlink, it will print the name of the link.
So, `ln -s script some_other_name` and then `./some_other_name` prints "./some_other_name".
Drop the backticks where appropriate. I just keep the habit of using them for verbatim/code blocks even when they are not supported by the markdown flavor.
Love it, let me know if you get it to work.
nice tutorial.
Can you please make video on
1. Open Source Web Scrapper Tool in Docker
2. Aria2C +AriaNG with SECURED JSON rpc call to aria2c client
Let me see what I can find.
@@AwesomeOpenSource great thanks
Thanks for the information. From a software architecture view putting keys inside filenames seems like a bad idea... A lot of processes and possibly other users on the same system can access the key this way if they can access the file name...
Yep. It's a bit of an odd way to do things, but I hope they'll get past that method eventually (plus it doesn't work for Linux clients).
It's only the PUBLIC key that is being put into the filename. Public keys are by their very name supposed to be public and can be widely shared.
I'm interested. xrdp is old and vnc is a hog
RustDesk is really a great tool.
Can you make video about Snipe-it
Let me check it out.
Rustdesk can't connect behind firewalls. So its useless.
I don't understand what you mean. I use RustDesk to connect from systems behind all kinds of firewalls with no issue.
@@AwesomeOpenSource I pay 130 € a month for TeamViewer Corporate.
I could save my money if it worked. Rustdesk Windows Client cannot connect to Rustdesk Server behind a firewall.
It works fine at my house with my friends.
Ahhh Ok. Yes, you will have to open the ports to the server that are needed for communication. TeamViewer servers have ports open for their communication, you simply aren't in control of the servers.
you need to configure access rule and NAT
Has anybody ever told you, you sound like a young George Lucas?!
I cannot say they have.