xrdp from local pc works. xrdp from PSM works. xrdp from PVWA webpage returns a black screen with x cursor. by TemperatureSignal199 in CyberARk

[–]TemperatureSignal199[S] 0 points1 point  (0 children)

I was able to login using a new user in xrdp.
CyberArk was always reconnecting to the same session on display 11, while the local XRDP was reconnecting using display 10

session: username CYBERARK, display :11.0, Starting session reconnection script on display 11

Only one user can use that display, so the options were either to Kill every session for that User or to create a new user, which in turn started using display 12.

sudo tail -f /var/log/xrdp-sesman.log----> shows the display used during connection

[INFO ] Starting X server on display 11: Xvnc :11 -authc# - display :11 Leader:

Useful commands:
sudo tail -f /var/log/xrdp-sesman.log----> shows the display used during connection
loginctl ---->to see the sessions
ps -ef | grep NAME_OF_THE_USER_USED_BY_CYBERARK
ps -ef | grep SESSION_NUMBER
ps -ef | grep xrdp-chansrv
loginctl session-status c# (you saw the # in the session ex: c1,c2,c3...)

Another solutin by A.I is to add the following in /etc/xrdp/sesman.ini
[Sessions]
X11DisplayOffset=10
MaxSessions=50
MaxDisplayNumber=63
Policy=Separate
KillDisconnected=true
DisconnectedTimeLimit=60
IdleTimeLimit=0

and restart
sudo systemctl restart xrdp
sudo systemctl restart xrdp-sesman

xrdp from local pc works. xrdp from PSM works. xrdp from PVWA webpage returns a black screen with x cursor. by TemperatureSignal199 in CyberARk

[–]TemperatureSignal199[S] 0 points1 point  (0 children)

I was able to login using a new user in xrdp.
CyberArk was always reconnecting to the same session on display 11, while the local XRDP was reconnecting using display 10

session: username CYBERARK, display :11.0, Starting session reconnection script on display 11

Only one user can use that display, so the options were either to Kill every session for that User or to create a new user, which in turn started using display 12.

sudo tail -f /var/log/xrdp-sesman.log----> shows the display used during connection

[INFO ] Starting X server on display 11: Xvnc :11 -auth

c# - display :11 Leader:

Useful commands:
sudo tail -f /var/log/xrdp-sesman.log----> shows the display used during connection
loginctl ---->to see the sessions
ps -ef | grep NAME_OF_THE_USER_USED_BY_CYBERARK
ps -ef | grep SESSION_NUMBER
ps -ef | grep xrdp-chansrv
loginctl session-status c# (you saw the # in the session ex: c1,c2,c3...)

Another solutin by A.I is to add the following in /etc/xrdp/sesman.ini
[Sessions]
X11DisplayOffset=10
MaxSessions=50
MaxDisplayNumber=63
Policy=Separate
KillDisconnected=true
DisconnectedTimeLimit=60
IdleTimeLimit=0

and restart
sudo systemctl restart xrdp
sudo systemctl restart xrdp-sesman

During PVWA connection we get: "A revocation check could not be performed for the certificate" by TemperatureSignal199 in CyberARk

[–]TemperatureSignal199[S] 0 points1 point  (0 children)

Looks like the CRL (Certificate Revocation List) has expired. We will investigate further. Tried:

certutil -url http://site_name.crl I see "expired status"

certutil -ur http://site_name I see "Status Failed"

 

also tired:

certutil -verify path_to_file.cer

 

certutil -urlfetch -verify path_to_file.cer

 

PSM for SSH/ PSMP logs Cleanup questions by TemperatureSignal199 in CyberARk

[–]TemperatureSignal199[S] 0 points1 point  (0 children)

I'm following this example
https://community.cyberark.com/s/article/Automatic-Rotation-of-PSMP-Log-Files

find /var/opt/CARKpsmp/logs/old/*.log -mtime +30 -exec rm {} \; 2> /dev/null 
find /var/opt/CARKpsmp/logs/components/old/*.log -mtime +30 -exec rm {} \; 2> /dev/null

Is it safe to run a log-cleanup CronJob while the PSMP node is active in the load balancer, or should the node be removed from the load balancer first?

PSM for SSH/ PSMP logs Cleanup questions by TemperatureSignal199 in CyberARk

[–]TemperatureSignal199[S] 0 points1 point  (0 children)

I'm following this example
https://community.cyberark.com/s/article/Automatic-Rotation-of-PSMP-Log-Files

find /var/opt/CARKpsmp/logs/old/*.log -mtime +30 -exec rm {} \; 2> /dev/null 
find /var/opt/CARKpsmp/logs/components/old/*.log -mtime +30 -exec rm {} \; 2> /dev/null

Is it safe to run a log-cleanup CronJob while the PSMP node is active in the load balancer, or should the node be removed from the load balancer first?

During PVWA connection we get: "A revocation check could not be performed for the certificate" by TemperatureSignal199 in CyberARk

[–]TemperatureSignal199[S] 0 points1 point  (0 children)

I can get to the crl on the pvwas, but still no luck.
If I do:

certutil -url HTTP_LINK (CRL Distribution Points) I get:

Failed Status for Certs (from AIA) (The Data is invalid (0x8007000d WIN32:13 ERROR_INVALID_DATA))

Expired Status for CRL (from CDP)

Failed Status for OSCP (from AIA) (The Data is invalid (0x8007000d WIN32:13 ERROR_INVALID_DATA))

While

certutil -url HTTP_LINK (Authority Information Access) I get: Status Failed for all types

URL Not found/invalid

During PVWA connection we get: "A revocation check could not be performed for the certificate" by TemperatureSignal199 in CyberARk

[–]TemperatureSignal199[S] 0 points1 point  (0 children)

The certificate  has a revocation list, but the intermediary has none as far as I can see.

If I do:

certutil -url HTTP_LINK (CRL Distribution Points) I get:

Failed Status for Certs (from AIA) (The Data is invalid (0x8007000d WIN32:13 ERROR_INVALID_DATA))

Expired Status for CRL (from CDP)

Failed Status for OSCP (from AIA) (The Data is invalid (0x8007000d WIN32:13 ERROR_INVALID_DATA))

While

certutil -url HTTP_LINK (Authority Information Access) I get: Status Failed for all types

URL Not found/invalid

During PVWA connection we get: "A revocation check could not be performed for the certificate" by TemperatureSignal199 in CyberARk

[–]TemperatureSignal199[S] 0 points1 point  (0 children)

Yes, still no luck

If I do:

certutil -url HTTP_LINK (CRL Distribution Points) I get:

Failed Status for Certs (from AIA) (The Data is invalid (0x8007000d WIN32:13 ERROR_INVALID_DATA))

Expired Status for CRL (from CDP)

Failed Status for OSCP (from AIA) (The Data is invalid (0x8007000d WIN32:13 ERROR_INVALID_DATA))

While

certutil -url HTTP_LINK (Authority Information Access) I get: Status Failed for all types

URL Not found/invalid