Update from today (after apt-update && apt full-upgrade):
Subject: Regression after 2026‑07 updates — xrdp runs but fails to read /etc/xrdp/xrdp.ini, dynamic channel drdynvc missing, GFX disabled, black screen and disconnect

Description
After the latest Kali Rolling updates, xrdp starts and accepts connections but immediately fails to provide a usable desktop. The service is active, but logs show that xrdp cannot read its configuration and that the dynamic channel module drdynvc is missing, which disables GFX and causes session aborts (black screen followed by disconnect). This is reproducible on my system and persists despite reinstalling XFCE and correcting /etc/xrdp/startwm.sh to call startxfce4.

Environment

Kali Rolling, fully updated.

xrdp package: 0.10.6.1-2+kali1 (installed and candidate).

Desktop: XFCE 4.20 (reinstalled).

Display manager: LightDM.

Host: STRATO KVM virtual server (no physical TTY).

I have reproduced the issue after purging and reinstalling xrdp and after renaming xrdp.ini.original → xrdp.ini.

Reproduction steps

sudo apt purge xrdp xorgxrdp

Remove /etc/xrdp/ completely.

sudo apt install xrdp (version 0.10.6.1-2+kali1)

Ensure /etc/xrdp/startwm.sh calls startxfce4 (I have already corrected this).

sudo systemctl start xrdp

Connect with an RDP client and log in.

Observed behavior

xrdp service is active and running, but after login the client sees a black screen and then a disconnect.

Relevant journalctl/systemd log excerpt:

Code
Jul 13 13:17:06 kali xrdp[89653]: [WARN ] Static channel 'drdynvc' not found.
Jul 13 13:17:06 kali xrdp[89653]: [WARN ] Dynamic channels will not be available
Jul 13 13:17:06 kali xrdp[89653]: [WARN ] Disabling GFX as 'drdynvc' isn't available
Jul 13 13:17:06 kali xrdp[89653]: [ERROR] load_config: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 13 13:17:06 kali xrdp[89653]: [INFO ] TConfig: Loading GFX config file /etc/xrdp/gfx.toml
Jul 13 13:17:06 kali xrdp[89653]: [WARN ] xrdp_wm_load_static_colors: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 13 13:17:06 kali xrdp[89653]: [WARN ] xrdp_wm_init: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 13 13:17:37 kali xrdp[89653]: [ERROR] xrdp_iso_send: trans_write_copy_s failed
Jul 13 13:17:37 kali xrdp[89653]: [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
Expected behavior

xrdp should read /etc/xrdp/xrdp.ini successfully, load dynamic channels (including drdynvc), enable GFX, and start the user session (XFCE) so the client receives the desktop frames instead of a black screen.

Additional facts and troubleshooting already performed

I renamed the shipped xrdp.ini.original to /etc/xrdp/xrdp.ini to ensure a valid INI is present; xrdp still logs that it cannot read the INI.

I verified /etc/xrdp/xrdp.ini contents — it matches the standard INI shipped with xrdp and is unchanged.

I corrected /etc/xrdp/startwm.sh so it contains:

Code
unset DBUS_SESSION_BUS_ADDRESS
unset XDG_RUNTIME_DIR
exec startxfce4
so XFCE is invoked by the session script.

Reinstalled XFCE (xfce4, xfce4-goodies) and restarted xrdp; behavior unchanged.

The drdynvc channel is reported missing by xrdp even though drdynvc=true is set in the INI; this indicates the channel module is not available or not loaded by the package.

Request

Please investigate the current xrdp packaging in Kali Rolling (0.10.6.1-2+kali1). The symptoms indicate multiple regressions: inability to read /etc/xrdp/xrdp.ini at runtime, missing dynamic channel module drdynvc (GFX disabled), and session aborts after login.

If this is a packaging regression, please either: (a) revert to the last known working package, or (b) apply a patch that ensures the postinst creates/installs the INI correctly and that the channel modules (including drdynvc) are present and loadable.

Please CC or forward this issue to the Debian xrdp maintainers and upstream xrdp if appropriate, as the problem appears to be a regression introduced in recent updates and may require upstream fixes.

Attachments available on request

Full journalctl -u xrdp output.

/etc/xrdp/xrdp.ini (current contents).

/etc/xrdp/startwm.sh (current contents).

Steps and exact commands used to reproduce.

┌──(cohst@kali)-[~]
└─$ sudo systemctl status xrdp xrdp-sesman
● xrdp.service - xrdp daemon
Loaded: loaded (/usr/lib/systemd/system/xrdp.service; enabled; preset: enabled)
Active: active (running) since Mon 2026-07-13 13:16:36 CEST; 27min ago
Invocation: 259590b96a934e5b9ec9e35c32b28403
Docs: man:xrdp(8)
man:xrdp.ini(5)
Main PID: 89644 (xrdp)
Tasks: 1 (limit: 9386)
Memory: 1.3M (peak: 11.1M)
CPU: 39ms
CGroup: /system.slice/xrdp.service
└─89644 /usr/sbin/xrdp --nodaemon

Jul 13 13:17:06 kali xrdp[89653]: [WARN ] Static channel 'drdynvc' not found.
Jul 13 13:17:06 kali xrdp[89653]: [WARN ] Dynamic channels will not be available
Jul 13 13:17:06 kali xrdp[89653]: [WARN ] Disabling GFX as 'drdynvc' isn't available
Jul 13 13:17:06 kali xrdp[89653]: [ERROR] load_config: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 13 13:17:06 kali xrdp[89653]: [INFO ] TConfig: Loading GFX config file /etc/xrdp/gfx.toml
Jul 13 13:17:06 kali xrdp[89653]: [INFO ] Login screen monitor height is 800 pixels over 1000 mm (20 DPI)
Jul 13 13:17:06 kali xrdp[89653]: [WARN ] xrdp_wm_load_static_colors: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 13 13:17:06 kali xrdp[89653]: [WARN ] xrdp_wm_init: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 13 13:17:37 kali xrdp[89653]: [ERROR] xrdp_iso_send: trans_write_copy_s failed
Jul 13 13:17:37 kali xrdp[89653]: [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed

● xrdp-sesman.service - xrdp session manager
Loaded: loaded (/usr/lib/systemd/system/xrdp-sesman.service; disabled; preset: disabled)
Active: active (running) since Mon 2026-07-13 13:16:36 CEST; 27min ago
Invocation: 0988214892fa4af794dfc8548fd7c9f6
Docs: man:xrdp-sesman(8)
man:sesman.ini(5)
Main PID: 89642 (xrdp-sesman)
Tasks: 1 (limit: 9386)
Memory: 924K (peak: 2.2M)
CPU: 9ms
CGroup: /system.slice/xrdp-sesman.service
└─89642 /usr/sbin/xrdp-sesman --nodaemon

Jul 13 13:16:36 kali systemd[1]: Starting xrdp-sesman.service - xrdp session manager...
Jul 13 13:16:36 kali systemd[1]: Started xrdp-sesman.service - xrdp session manager.
Jul 13 13:16:36 kali xrdp-sesman[89642]: [INFO ] starting xrdp-sesman with pid 89642
Jul 13 13:16:36 kali xrdp-sesman[89642]: [INFO ] Sesman now listening on /run/xrdp/sockdir/sesman.socket

┌──(cohst@kali)-[~]
└─$

Maybe the issue is caused by purging the xrdp package.

The file /etc/xrdp/xrdp.ini is in fact installed by the package kali-defaults, so you could try apt install --reinstall kali-defaults to see if that brings back the xrdp.ini file

Unfortunately this does not really help. After reinstalling kali-defaults and restart xrdp service, everything looks fine from ssh view (see systemctl status xrdp), but after try to connect via xRDP the screen remains black but there is another error message when doing systemctl status xrdp:

┌──(cohst@kali-linux)-[~]
└─$ sudo apt install --reinstall kali-defaults
[sudo] password for cohst:
Summary:
Upgrading: 0, Installing: 0, Reinstalling: 1, Removing: 0, Not Upgrading: 2
Download size: 88.4 kB
Space needed: 0 B / 194 GB available

Get:1 https://eu.mirror.ionos.com/linux/distributions/kali/kali kali-rolling/main amd64 kali-defaults all 2026.3.1 [88.4 kB]
Fetched 88.4 kB in 1s (172 kB/s)
(Reading database ... 560356 files and directories currently installed.)
Preparing to unpack .../kali-defaults_2026.3.1_all.deb ...
Unpacking kali-defaults (2026.3.1) over (2026.3.1) ...
Setting up kali-defaults (2026.3.1) ...
Configuring /etc/environment
Processing triggers for kali-menu (2026.3.2) ...
Processing triggers for systemd (261.1-2) ...
Processing triggers for procps (2:4.0.6-2) ...
Scanning processes...
Scanning linux images...

Running kernel seems to be up-to-date.

No services need to be restarted.

No containers need to be restarted.

No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.

┌──(cohst@kali-linux)-[~]
└─$ sudo systemctl restart xrdp

┌──(cohst@kali-linux)-[~]
└─$ sudo systemctl status xrdp
● xrdp.service - xrdp daemon
Loaded: loaded (/usr/lib/systemd/system/xrdp.service; enabled; preset: enabled)
Active: active (running) since Tue 2026-07-14 09:53:25 CEST; 5s ago
Invocation: 21908464952a41b08c361da9dae3cd44
Docs: man:xrdp(8)
man:xrdp.ini(5)
Main PID: 182141 (xrdp)
Tasks: 1 (limit: 9386)
Memory: 1.5M (peak: 2.5M)
CPU: 15ms
CGroup: /system.slice/xrdp.service
└─182141 /usr/sbin/xrdp --nodaemon

Jul 14 09:53:25 kali-linux systemd[1]: Starting xrdp.service - xrdp daemon...
Jul 14 09:53:25 kali-linux systemd[1]: Started xrdp.service - xrdp daemon.
Jul 14 09:53:25 kali-linux xrdp[182141]: [INFO ] address [0.0.0.0] port [3389] mode 1
Jul 14 09:53:25 kali-linux xrdp[182141]: [INFO ] listening to port 3389 on 0.0.0.0
Jul 14 09:53:25 kali-linux xrdp[182141]: [INFO ] xrdp_listen_pp done
Jul 14 09:53:25 kali-linux xrdp[182141]: [INFO ] Switched user:group to xrdp:xrdp
Jul 14 09:53:25 kali-linux xrdp[182141]: [INFO ] starting xrdp with pid 182141

┌──(cohst@kali-linux)-[~]
└─$ sudo systemctl status xrdp
● xrdp.service - xrdp daemon
Loaded: loaded (/usr/lib/systemd/system/xrdp.service; enabled; preset: enabled)
Active: active (running) since Tue 2026-07-14 09:53:25 CEST; 57s ago
Invocation: 21908464952a41b08c361da9dae3cd44
Docs: man:xrdp(8)
man:xrdp.ini(5)
Main PID: 182141 (xrdp)
Tasks: 2 (limit: 9386)
Memory: 8.3M (peak: 8.6M)
CPU: 30ms
CGroup: /system.slice/xrdp.service
├─182141 /usr/sbin/xrdp --nodaemon
└─182150 /usr/sbin/xrdp --nodaemon

Jul 14 09:54:08 kali-linux xrdp[182150]: [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] local keymap file for 0x0000007f found and doesn't match built in keymap, usin>
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] Static channel 'drdynvc' not found.
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] Dynamic channels will not be available
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] Disabling GFX as 'drdynvc' isn't available
Jul 14 09:54:08 kali-linux xrdp[182150]: [ERROR] load_config: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 14 09:54:08 kali-linux xrdp[182150]: [INFO ] TConfig: Loading GFX config file /etc/xrdp/gfx.toml
Jul 14 09:54:08 kali-linux xrdp[182150]: [INFO ] Login screen monitor height is 800 pixels over 1000 mm (20 DPI)
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] xrdp_wm_load_static_colors: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] xrdp_wm_init: Could not read xrdp.ini file /etc/xrdp/xrdp.ini

┌──(cohst@kali-linux)-[~]
└─$

the screen remains black but there is another error message when doing systemctl status xrdp:

I see that you still get [ERROR] load_config: Could not read xrdp.ini file /etc/xrdp/xrdp.ini. Are you sure that the file is present and has the right permissions? Also, did you check that xrdp-sesman is running?

Here's what I get:

$ ps fax | grep xrdp
  20473 ?        Ss     0:00  \_ /usr/sbin/xrdp-sesman --nodaemon
  20474 ?        Ss     0:00  \_ /usr/sbin/xrdp --nodaemon
  31260 pts/0    S+     0:00          \_ grep --color=auto xrdp

$ ls -l /etc/xrdp/[rsx]*.ini
-rw-r----- 1 root xrdp  2939 Jul 14 02:16 /etc/xrdp/rsakeys.ini
-rw-r--r-- 1 root root  8289 Jul  9 02:08 /etc/xrdp/sesman.ini
-rw-r--r-- 1 root root 11653 Jul 14 02:11 /etc/xrdp/xrdp.ini
-rw-r--r-- 1 root root  4059 Jul  9 02:08 /etc/xrdp/xrdp_keyboard.ini

With that said, I tried a connection, and it failed for me. Here are my logs:

$ journalctl -u xrdp   
Jul 15 04:24:22 kali systemd[1]: Starting xrdp.service - xrdp daemon...
Jul 15 04:24:22 kali systemd[1]: Started xrdp.service - xrdp daemon.
Jul 15 04:24:22 kali xrdp[20474]: [INFO ] address [0.0.0.0] port [3389] mode 1
Jul 15 04:24:22 kali xrdp[20474]: [INFO ] listening to port 3389 on 0.0.0.0
Jul 15 04:24:22 kali xrdp[20474]: [INFO ] xrdp_listen_pp done
Jul 15 04:24:22 kali xrdp[20474]: [INFO ] Switched user:group to xrdp:xrdp
Jul 15 04:24:22 kali xrdp[20474]: [INFO ] starting xrdp with pid 20474
Jul 15 04:24:35 kali xrdp[20474]: [INFO ] Socket 14: connection accepted from [::ffff:10.0.2.2]:48072
Jul 15 04:24:35 kali xrdp[20850]: [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
Jul 15 04:24:35 kali xrdp[20850]: [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
Jul 15 04:24:35 kali xrdp[20850]: [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
Jul 15 04:24:35 kali xrdp[20850]: [INFO ] Client requested security types (RDP assumed) : SSL|HYBRID
Jul 15 04:24:35 kali xrdp[20850]: [WARN ] Cannot accept TLS connections because certificate or private key file is not read>
Jul 15 04:24:35 kali xrdp[20850]: [INFO ] Selected classic RDP security
Jul 15 04:24:38 kali xrdp[20850]: [INFO ] Connected client computer name: t14
Jul 15 04:24:38 kali xrdp[20850]: [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_>
Jul 15 04:24:38 kali xrdp[20850]: [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
Jul 15 04:24:38 kali xrdp[20850]: [INFO ] client supports gfx protocol
Jul 15 04:24:38 kali xrdp[20850]: [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
Jul 15 04:24:38 kali xrdp[20850]: [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
Jul 15 04:24:38 kali xrdp[20850]: [INFO ] Non-TLS connection established from [::ffff:10.0.2.2]:48072 with security level :>
Jul 15 04:24:38 kali xrdp[20850]: [ERROR] MAC checksum error for non-FIPS PDU
Jul 15 04:24:38 kali xrdp[20850]: [ERROR] xrdp_rdp_recv: xrdp_sec_recv failed
Jul 15 04:24:38 kali xrdp[20850]: [ERROR] libxrdp_process_data: xrdp_rdp_recv failed
Jul 15 04:24:38 kali xrdp[20850]: [ERROR] xrdp_process_data_in: xrdp_process_loop failed

The error about key.pem is harmless (it's a known issue, cf. https://bugs.debian.org/1138658 for example), leading to the warning about TLS connections. You can ignore these two.

However the real errors are the last 4 lines of logs. Never seen before. Maybe it was caused by the recent security update (that was uploaded to Kali last week IIRC).

The issue was reported and discussed upsteam at https://github.com/neutrinolabs/xrdp/issues/3808.

I'm not sure to understand the root cause, either:

1. regression in xrdp, caused by security fix for CVE-2026-32105: https://github.com/neutrinolabs/xrdp/commit/759104912c64b33b2442ed788c1806e36d028db0 (that was shipped in package 0.10.6-1 in Debian and Kali), or
2. a change in latest version of freerdp (so client-side)

The workaround for now is to enable TLS, like this:

sudo adduser xrdp ssl-cert
sudo systemctl restart xrdp

Check that all looks good (everything should be in the green):

$ sudo /usr/share/xrdp/xrdp-chkpriv
Settings
 - [xrdp.ini]   runtime_user        : xrdp
 - [xrdp.ini]   runtime_group       : xrdp
 - [xrdp.ini]   certificate         : /etc/xrdp/cert.pem
 - [xrdp.ini]   key_file            : /etc/xrdp/key.pem
 - [sesman.ini] SessionSockdirGroup : xrdp

[  OK  ] runtime_user 'xrdp' appears to exist
[  OK  ] runtime_group 'xrdp' appears to exist
[  OK  ] xrdp.ini and sesman.ini agree on group ownership
[  OK  ] /etc/xrdp/rsakeys.ini has correct permissions
[  OK  ] /etc/xrdp/cert.pem is read-only for xrdp:xrdp
[  OK  ] /etc/xrdp/key.pem is read-only for xrdp:xrdp

[  OK  ] -Summary- Permissions appear to be correct to run xrdp unprivileged

Also, double-check that, in /etc/xrdp/xrdp.ini, security_layer is set to negotiate (or forced to tls).

After those changes, it works for me

Unfortunately for me this workaround does not work - I don't know why not.

Ich have set set the same permissions as you suggest and restartet all sessions. Here is my configuration:

login as: cohst
Pre-authentication banner message from server:
| Kali GNU/Linux Rolling \n \l
| WARNING: This system is for authorized use only.
| Unauthorized access is prohibited and may be subject to criminal prosecution.
| All connections are monitored and logged.
| By accessing this system, you consent to such monitoring.
End of banner message from server
[email protected]'s password:
Linux kali-linux 7.0.12+kali-amd64 0000001 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1 (20 26-06-18) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Jul 15 10:02:37 2026 from 85.215.215.191
┏━(Message from Kali developers)
┃
┃ This is a minimal installation of Kali Linux, you likely
┃ want to install supplementary tools. Learn how:
┃ ⇒ https://www.kali.org/docs/troubleshooting/common-minimum-setup/
┃
┗━(Run: “touch ~/.hushlogin” to hide this message)
┌──(cohst@kali-linux)-[~]
└─$ ps fax | grep xrdp
277587 pts/0 S+ 0:00 | _ grep --color=auto xrdp
275183 ? Ss 0:00 _ /usr/sbin/xrdp-sesman --nodaemon
275184 ? Ss 0:00 _ /usr/sbin/xrdp --nodaemon

┌──(cohst@kali-linux)-[~]
└─$ ls -l /etc/xrdp/[rsx]*.ini
-rw-r----- 1 root xrdp 2939 Jul 14 08:28 /etc/xrdp/rsakeys.ini
-rw-r--r-- 1 root root 8289 Jul 9 08:08 /etc/xrdp/sesman.ini
-rw-r----- 1 root root 11862 Jul 14 09:43 /etc/xrdp/xrdp.ini
-rw-r--r-- 1 root root 4059 Apr 13 12:11 /etc/xrdp/xrdp_keyboard.ini

┌──(cohst@kali-linux)-[~]
└─$ journalctl -u xrdp
Hint: You are currently not seeing messages from other users and the system.
Users in groups 'adm', 'systemd-journal' can see all messages.
Pass -q to turn off this notice.
-- No entries --

┌──(cohst@kali-linux)-[~]
└─$ sudo journalctl -u xrdp
[sudo] password for cohst:
Feb 05 21:14:55 kali-linux systemd[1]: Starting xrdp.service - xrdp daemon...
Feb 05 21:14:55 kali-linux xrdp[74222]: [INFO ] address [0.0.0.0] port [3389] mode 1
Feb 05 21:14:55 kali-linux xrdp[74222]: [INFO ] listening to port 3389 on 0.0.0.0
Feb 05 21:14:55 kali-linux xrdp[74222]: [INFO ] xrdp_listen_pp done
Feb 05 21:14:55 kali-linux systemd[1]: xrdp.service: Can't open PID file '/run/xrdp/xrdp.pid' (yet?) after start: No such>
Feb 05 21:14:56 kali-linux systemd[1]: Started xrdp.service - xrdp daemon.
Feb 05 21:14:57 kali-linux xrdp[74224]: [INFO ] starting xrdp with pid 74224
Feb 05 21:14:57 kali-linux xrdp[74224]: [INFO ] address [0.0.0.0] port [3389] mode 1
Feb 05 21:14:57 kali-linux xrdp[74224]: [INFO ] listening to port 3389 on 0.0.0.0
Feb 05 21:14:57 kali-linux xrdp[74224]: [INFO ] xrdp_listen_pp done
-- Boot ae231ac9f44a439db93331d1c7946983 --
Feb 05 21:16:41 kali systemd[1]: Starting xrdp.service - xrdp daemon...
Feb 05 21:16:41 kali xrdp[842]: [INFO ] address [0.0.0.0] port [3389] mode 1
Feb 05 21:16:41 kali xrdp[842]: [INFO ] listening to port 3389 on 0.0.0.0
Feb 05 21:16:41 kali xrdp[842]: [INFO ] xrdp_listen_pp done
Feb 05 21:16:41 kali systemd[1]: xrdp.service: Can't open PID file '/run/xrdp/xrdp.pid' (yet?) after start: No such file >
Feb 05 21:16:42 kali systemd[1]: Started xrdp.service - xrdp daemon.
Feb 05 21:16:43 kali xrdp[845]: [INFO ] starting xrdp with pid 845
Feb 05 21:16:43 kali xrdp[845]: [INFO ] address [0.0.0.0] port [3389] mode 1
Feb 05 21:16:43 kali xrdp[845]: [INFO ] listening to port 3389 on 0.0.0.0
Feb 05 21:16:43 kali xrdp[845]: [INFO ] xrdp_listen_pp done
Feb 05 21:32:03 kali xrdp[845]: [INFO ] Socket 12: AF_INET6 connection received from ::ffff:85.215.215.191 port 51586
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
Feb 05 21:32:03 kali xrdp[1087]: [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
Feb 05 21:32:03 kali xrdp[1087]: [WARN ] Cannot accept TLS connections because certificate or private key file is not rea>
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] Connected client computer name: WINSRV-CO172025
Feb 05 21:32:03 kali xrdp[1087]: [WARN ] Client and server do not both support the same encryption.
Feb 05 21:32:03 kali xrdp[1087]: [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
Feb 05 21:32:03 kali xrdp[1087]: [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard>
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [de] options []
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] Non-TLS connection established from ::ffff:85.215.215.191 port 51586: with secur>
Feb 05 21:32:03 kali xrdp[1087]: [ERROR] xrdp_sec_recv: xrdp_mcs_recv failed
Feb 05 21:32:03 kali xrdp[1087]: [ERROR] xrdp_rdp_recv: xrdp_sec_recv failed
Feb 05 21:32:03 kali xrdp[1087]: [ERROR] libxrdp_process_data: xrdp_rdp_recv failed

┌──(cohst@kali-linux)-[~]
└─$ sudo adduser xrdp ssl-cert

┌──(cohst@kali-linux)-[~]
└─$ sudo systemctl restart xrdp

┌──(cohst@kali-linux)-[~]
└─$ sudo /usr/share/xrdp/xrdp-chkpriv
Settings

• [xrdp.ini] runtime_user : xrdp
• [xrdp.ini] runtime_group : xrdp
• [xrdp.ini] certificate : /etc/xrdp/cert.pem
• [xrdp.ini] key_file : /etc/xrdp/key.pem
• [sesman.ini] SessionSockdirGroup : xrdp

[ OK ] runtime_user 'xrdp' appears to exist
[ OK ] runtime_group 'xrdp' appears to exist
[ OK ] xrdp.ini and sesman.ini agree on group ownership
[ OK ] /etc/xrdp/rsakeys.ini has correct permissions
[ OK ] /etc/xrdp/cert.pem is read-only for xrdp:xrdp
[ OK ] /etc/xrdp/key.pem is read-only for xrdp:xrdp

[ OK ] -Summary- Permissions appear to be correct to run xrdp unprivileged

┌──(cohst@kali-linux)-[~]
└─$ sudo nano /etc/xrdp/xrdp.ini

┌──(cohst@kali-linux)-[~]
└─$ sudo systemctl restart xrdp

┌──(cohst@kali-linux)-[~]
└─$ sudo systemctl status xrdp
● xrdp.service - xrdp daemon
Loaded: loaded (/usr/lib/systemd/system/xrdp.service; enabled; preset: enabled)
Active: active (running) since Wed 2026-07-15 16:58:49 CEST; 11s ago
Invocation: 938413b714ba43989e1ee21ffa318fe5
Docs: man:xrdp(8)
man:xrdp.ini(5)
Main PID: 277707 (xrdp)
Tasks: 1 (limit: 9386)
Memory: 1.6M (peak: 2.7M)
CPU: 17ms
CGroup: /system.slice/xrdp.service
└─277707 /usr/sbin/xrdp --nodaemon

Jul 15 16:58:49 kali-linux systemd[1]: Starting xrdp.service - xrdp daemon...
Jul 15 16:58:49 kali-linux systemd[1]: Started xrdp.service - xrdp daemon.
Jul 15 16:58:49 kali-linux xrdp[277707]: [INFO ] address [0.0.0.0] port [3389] mode 1
Jul 15 16:58:49 kali-linux xrdp[277707]: [INFO ] listening to port 3389 on 0.0.0.0
Jul 15 16:58:49 kali-linux xrdp[277707]: [INFO ] xrdp_listen_pp done
Jul 15 16:58:49 kali-linux xrdp[277707]: [INFO ] Switched user:group to xrdp:xrdp
Jul 15 16:58:49 kali-linux xrdp[277707]: [INFO ] starting xrdp with pid 277707

┌──(cohst@kali-linux)-[~]
└─$ sudo systemctl status xrdp
● xrdp.service - xrdp daemon
Loaded: loaded (/usr/lib/systemd/system/xrdp.service; enabled; preset: enabled)
Active: active (running) since Wed 2026-07-15 16:58:49 CEST; 1min 3s ago
Invocation: 938413b714ba43989e1ee21ffa318fe5
Docs: man:xrdp(8)
man:xrdp.ini(5)
Main PID: 277707 (xrdp)
Tasks: 2 (limit: 9386)
Memory: 7.7M (peak: 8.3M)
CPU: 36ms
CGroup: /system.slice/xrdp.service
├─277707 /usr/sbin/xrdp --nodaemon
└─277740 /usr/sbin/xrdp --nodaemon

Jul 15 16:59:30 kali-linux xrdp[277740]: [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
Jul 15 16:59:30 kali-linux xrdp[277740]: [WARN ] local keymap file for 0x0000007f found and doesn't match built in keymap>
Jul 15 16:59:30 kali-linux xrdp[277740]: [WARN ] Static channel 'drdynvc' not found.
Jul 15 16:59:30 kali-linux xrdp[277740]: [WARN ] Dynamic channels will not be available
Jul 15 16:59:30 kali-linux xrdp[277740]: [WARN ] Disabling GFX as 'drdynvc' isn't available
Jul 15 16:59:30 kali-linux xrdp[277740]: [ERROR] load_config: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 15 16:59:30 kali-linux xrdp[277740]: [INFO ] TConfig: Loading GFX config file /etc/xrdp/gfx.toml
Jul 15 16:59:30 kali-linux xrdp[277740]: [INFO ] Login screen monitor height is 800 pixels over 1000 mm (20 DPI)
Jul 15 16:59:30 kali-linux xrdp[277740]: [WARN ] xrdp_wm_load_static_colors: Could not read xrdp.ini file /etc/xrdp/xrdp.>
Jul 15 16:59:30 kali-linux xrdp[277740]: [WARN ] xrdp_wm_init: Could not read xrdp.ini file /etc/xrdp/xrdp.ini

┌──(cohst@kali-linux)-[~]
└─$ sudo journalctl -u xrdp
Feb 05 21:14:55 kali-linux systemd[1]: Starting xrdp.service - xrdp daemon...
Feb 05 21:14:55 kali-linux xrdp[74222]: [INFO ] address [0.0.0.0] port [3389] mode 1
Feb 05 21:14:55 kali-linux xrdp[74222]: [INFO ] listening to port 3389 on 0.0.0.0
Feb 05 21:14:55 kali-linux xrdp[74222]: [INFO ] xrdp_listen_pp done
Feb 05 21:14:55 kali-linux systemd[1]: xrdp.service: Can't open PID file '/run/xrdp/xrdp.pid' (yet?) after start: No such>
Feb 05 21:14:56 kali-linux systemd[1]: Started xrdp.service - xrdp daemon.
Feb 05 21:14:57 kali-linux xrdp[74224]: [INFO ] starting xrdp with pid 74224
Feb 05 21:14:57 kali-linux xrdp[74224]: [INFO ] address [0.0.0.0] port [3389] mode 1
Feb 05 21:14:57 kali-linux xrdp[74224]: [INFO ] listening to port 3389 on 0.0.0.0
Feb 05 21:14:57 kali-linux xrdp[74224]: [INFO ] xrdp_listen_pp done
-- Boot ae231ac9f44a439db93331d1c7946983 --
Feb 05 21:16:41 kali systemd[1]: Starting xrdp.service - xrdp daemon...
Feb 05 21:16:41 kali xrdp[842]: [INFO ] address [0.0.0.0] port [3389] mode 1
Feb 05 21:16:41 kali xrdp[842]: [INFO ] listening to port 3389 on 0.0.0.0
Feb 05 21:16:41 kali xrdp[842]: [INFO ] xrdp_listen_pp done
Feb 05 21:16:41 kali systemd[1]: xrdp.service: Can't open PID file '/run/xrdp/xrdp.pid' (yet?) after start: No such file >
Feb 05 21:16:42 kali systemd[1]: Started xrdp.service - xrdp daemon.
Feb 05 21:16:43 kali xrdp[845]: [INFO ] starting xrdp with pid 845
Feb 05 21:16:43 kali xrdp[845]: [INFO ] address [0.0.0.0] port [3389] mode 1
Feb 05 21:16:43 kali xrdp[845]: [INFO ] listening to port 3389 on 0.0.0.0
Feb 05 21:16:43 kali xrdp[845]: [INFO ] xrdp_listen_pp done
Feb 05 21:32:03 kali xrdp[845]: [INFO ] Socket 12: AF_INET6 connection received from ::ffff:85.215.215.191 port 51586
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
Feb 05 21:32:03 kali xrdp[1087]: [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
Feb 05 21:32:03 kali xrdp[1087]: [WARN ] Cannot accept TLS connections because certificate or private key file is not rea>
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] Connected client computer name: WINSRV-CO172025
Feb 05 21:32:03 kali xrdp[1087]: [WARN ] Client and server do not both support the same encryption.
Feb 05 21:32:03 kali xrdp[1087]: [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
Feb 05 21:32:03 kali xrdp[1087]: [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard>
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [de] options []
Feb 05 21:32:03 kali xrdp[1087]: [INFO ] Non-TLS connection established from ::ffff:85.215.215.191 port 51586: with secur>
Feb 05 21:32:03 kali xrdp[1087]: [ERROR] xrdp_sec_recv: xrdp_mcs_recv failed
Feb 05 21:32:03 kali xrdp[1087]: [ERROR] xrdp_rdp_recv: xrdp_sec_recv failed
Feb 05 21:32:03 kali xrdp[1087]: [ERROR] libxrdp_process_data: xrdp_rdp_recv failed

┌──(cohst@kali-linux)-[~]
└─$ sudo systemctl status xrdp-sesman
● xrdp-sesman.service - xrdp session manager
Loaded: loaded (/usr/lib/systemd/system/xrdp-sesman.service; disabled; preset: disabled)
Active: active (running) since Wed 2026-07-15 16:58:49 CEST; 5min ago
Invocation: ea1bd7e447a0404190d81fc0d29dfcab
Docs: man:xrdp-sesman(8)
man:sesman.ini(5)
Main PID: 277705 (xrdp-sesman)
Tasks: 1 (limit: 9386)
Memory: 928K (peak: 2M)
CPU: 7ms
CGroup: /system.slice/xrdp-sesman.service
└─277705 /usr/sbin/xrdp-sesman --nodaemon

Jul 15 16:58:49 kali-linux systemd[1]: Starting xrdp-sesman.service - xrdp session manager...
Jul 15 16:58:49 kali-linux systemd[1]: Started xrdp-sesman.service - xrdp session manager.
Jul 15 16:58:49 kali-linux xrdp-sesman[277705]: [INFO ] starting xrdp-sesman with pid 277705
Jul 15 16:58:49 kali-linux xrdp-sesman[277705]: [INFO ] Sesman now listening on /run/xrdp/sockdir/sesman.socket

┌──(cohst@kali-linux)-[~]
└─$

My screen stays black, have no idea why. xfce4 ist correctly installed and runs normal from Hypervisor console, so it's definitely a xrdp problem. I upgraded system again today, so it's definititely the latest version.

What strikes me is that my error message differs from yours: the issue for me isn't primarily about encryption, but rather that certain channel modules apparently aren't being loaded in my xrdp:

┌──(cohst@kali-linux)-[~]
└─$ sudo systemctl status xrdp
● xrdp.service - xrdp daemon
Loaded: loaded (/usr/lib/systemd/system/xrdp.service; enabled; preset: enabled)
Active: active (running) since Tue 2026-07-14 09:53:25 CEST; 57s ago
Invocation: 21908464952a41b08c361da9dae3cd44
Docs: man:xrdp(8)
man:xrdp.ini(5)
Main PID: 182141 (xrdp)
Tasks: 2 (limit: 9386)
Memory: 8.3M (peak: 8.6M)
CPU: 30ms
CGroup: /system.slice/xrdp.service
├─182141 /usr/sbin/xrdp --nodaemon
└─182150 /usr/sbin/xrdp --nodaemon

Jul 14 09:54:08 kali-linux xrdp[182150]: [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] local keymap file for 0x0000007f found and doesn't match built in keymap, usin>
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] Static channel 'drdynvc' not found.
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] Dynamic channels will not be available
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] Disabling GFX as 'drdynvc' isn't available
Jul 14 09:54:08 kali-linux xrdp[182150]: [ERROR] load_config: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 14 09:54:08 kali-linux xrdp[182150]: [INFO ] TConfig: Loading GFX config file /etc/xrdp/gfx.toml
Jul 14 09:54:08 kali-linux xrdp[182150]: [INFO ] Login screen monitor height is 800 pixels over 1000 mm (20 DPI)
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] xrdp_wm_load_static_colors: Could not read xrdp.ini file /etc/xrdp/xrdp.ini
Jul 14 09:54:08 kali-linux xrdp[182150]: [WARN ] xrdp_wm_init: Could not read xrdp.ini file /etc/xrdp/xrdp.ini

┌──(cohst@kali-linux)-[~]

The permissions on the file /etc/xrdp/xrdp.ini don't look good for you:

-rw-r----- 1 root root 11862 Jul 14 09:43 /etc/xrdp/xrdp.ini

It should be readable by everyone, and that's probably why you have [ERROR] load_config: Could not read xrdp.ini file /etc/xrdp/xrdp.ini in your logs. Change the permissions: sudo chmod 0644 /etc/xrdp/xrdp.ini, and then after a restart xrdp should be happier.

Apparently xrdp-sesman isn't running for you? Maybe try sudo systemctl status xrdp-sesman.

xrdp appears twice in your ps command. EDIT: Ah ok, it's normal, when there's a connection, xrdp spawns a second process.

Also you pasted logs from February so it's getting confusing

What's your configuration client-side? What program do you use to initiate the connection, on what Operating System? Maybe you're hitting a different issue that the one I found, after all.

Ok, I did more tests. I think sudo chmod 0644 /etc/xrdp/xrdp.ini should fix it for you. The issue is not obvious, with a file that is 0640 like yours, the first xrdp process starts, but when I try to initiate a connection, xrdp starts a second xrdp process, and this one can't read xrdp.ini.

Opened https://github.com/neutrinolabs/xrdp/issues/3830 to confirm

That was the problem - and your fix solved ist completely! Thank you so much Arnaud! It was the missing permission of 0644.

To answer your questions: I uploaded everything I got from journalctl - so maybe the logs were old from February because in the last version xrdp did not write logs on my system?? I don't know.

My client for RDP Access ist Devolutions Remote Desktop Manager with FreeRDP.

You can close the ticket from my side, the fix worked!

Cool! Glad we could sort it out.

Recap for those who stumble over this thread, trying to fix their xrdp connection.

If the file /etc/xrdp/xrdp.ini is missing, reinstall the package kali-defaults:

sudo apt install --reinstall kali-defaults

If you see this error: [ERROR] load_config: Could not read xrdp.ini file /etc/xrdp/xrdp.ini

Make sure /etc/xrdp/xrdp.ini is word-readable:

sudo chmod 0644 /etc/xrdp/xrdp.ini
sudo systemctl restart xrdp

If you see this error [ERROR] MAC checksum error for non-FIPS PDU:

Add xrdp to the ssl-cert group (this is not ideal, it's a quick fix):

sudo adduser xrdp ssl-cert
sudo reboot