From db395c9215803d307c40745cdcbc14e0f1f1d0e5 Mon Sep 17 00:00:00 2001
From: Alejandro Rosales <alejandro.rosales@lasalle.mx>
Date: Tue, 8 Sep 2026 08:46:41 -0600
Subject: [PATCH] Fix Linux RustDesk permanent password handling

---
 docs/rustdesk-operations.md               |  8 +++---
 scripts/Install-SguLinuxRustDeskClient.sh | 33 ++++++++++++++++++++---
 2 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/docs/rustdesk-operations.md b/docs/rustdesk-operations.md
index f8fc0d6..324c27a 100644
--- a/docs/rustdesk-operations.md
+++ b/docs/rustdesk-operations.md
@@ -90,6 +90,8 @@ cuando la información del servidor sigue presente en su estado de enrolamiento.
 ## Límites operativos
 
 Este alcance automatiza el cliente Windows entregado por
-`Invoke-SguClientBootstrap.ps1`. Los clientes Linux conservan su bootstrap PAM/
-SSSD independiente; su integración con RustDesk requiere un flujo de inventario
-de credenciales propio y no reutiliza ni expone las contraseñas de Windows.
+`Invoke-SguClientBootstrap.ps1`. El bootstrap Linux conserva su inicio PAM/SSSD
+independiente y usa un flujo propio de inventario: autentica con la cuenta de
+equipo Kerberos, cifra la contraseña de RustDesk para el controlador y recibe
+su confirmación desde la cola protegida. No reutiliza ni expone contraseñas de
+Windows.
diff --git a/scripts/Install-SguLinuxRustDeskClient.sh b/scripts/Install-SguLinuxRustDeskClient.sh
index 49d6631..03a532f 100644
--- a/scripts/Install-SguLinuxRustDeskClient.sh
+++ b/scripts/Install-SguLinuxRustDeskClient.sh
@@ -177,16 +177,23 @@ serial = 0
 custom-rendezvous-server = '${RUSTDESK_SERVER_ADDRESS}:21116'
 relay-server = '${RUSTDESK_SERVER_ADDRESS}:21117'
 key = '${RUSTDESK_SERVER_PUBLIC_KEY}'
+verification-method = 'use-permanent-password'
 EOF
 )
 
-    # The Linux service runs as root.  Keep the system copy as a diagnostic and
-    # the root profile copy as the configuration consumed by the service.
+    # The service starts as root but RustDesk hands its graphical server to the
+    # LightDM session account.  Configure both profiles; writing only root's
+    # profile leaves the greeter-side server using a temporary password.
     install -d -o root -g root -m 700 /root/.config/rustdesk /etc/rustdesk
     printf '%s\n' "$configuration" | install -o root -g root -m 600 /dev/stdin \
         /root/.config/rustdesk/RustDesk2.toml
     printf '%s\n' "$configuration" | install -o root -g root -m 644 /dev/stdin \
         /etc/rustdesk/RustDesk2.toml
+    if id lightdm >/dev/null 2>&1; then
+        install -d -o lightdm -g lightdm -m 700 /var/lib/lightdm/.config/rustdesk
+        printf '%s\n' "$configuration" | install -o lightdm -g lightdm -m 600 /dev/stdin \
+            /var/lib/lightdm/.config/rustdesk/RustDesk2.toml
+    fi
 
     systemctl restart rustdesk
     systemctl is-active --quiet rustdesk || fail 'The RustDesk service did not start.'
@@ -194,16 +201,34 @@ EOF
 
 set_access_password() {
     local secret_path="${STATE_ROOT}/access.secret"
-    if [[ -r $secret_path ]]; then
+    if [[ -r $secret_path ]] && [[ $(wc -c <"$secret_path") -le 32 ]]; then
         ACCESS_PASSWORD=$(<"$secret_path")
     else
-        ACCESS_PASSWORD=$(openssl rand -hex 24)
+        # RustDesk's permanent-password UI is reliable with a short, printable
+        # credential.  Earlier Linux enrollment generated 48 hexadecimal
+        # characters; rotate that legacy value to a 24-character password.
+        ACCESS_PASSWORD="Sgu-$(openssl rand -hex 10)"
         umask 077
         printf '%s' "$ACCESS_PASSWORD" >"$secret_path"
         chmod 600 "$secret_path"
     fi
 
     rustdesk --password "$ACCESS_PASSWORD" >/dev/null
+    rustdesk --option verification-method use-permanent-password >/dev/null
+    if id lightdm >/dev/null 2>&1; then
+        local lightdm_uid
+        lightdm_uid=$(id -u lightdm)
+        runuser -u lightdm -- env HOME=/var/lib/lightdm \
+            XDG_CONFIG_HOME=/var/lib/lightdm/.config \
+            XDG_RUNTIME_DIR="/run/user/${lightdm_uid}" \
+            /usr/share/rustdesk/rustdesk --password "$ACCESS_PASSWORD" >/dev/null
+        runuser -u lightdm -- env HOME=/var/lib/lightdm \
+            XDG_CONFIG_HOME=/var/lib/lightdm/.config \
+            XDG_RUNTIME_DIR="/run/user/${lightdm_uid}" \
+            /usr/share/rustdesk/rustdesk --option verification-method use-permanent-password >/dev/null
+    fi
+    systemctl restart rustdesk
+    systemctl is-active --quiet rustdesk || fail 'The RustDesk service did not restart after setting its permanent password.'
     RUSTDESK_ID=$(rustdesk --get-id 2>/dev/null | tail -n 1 | tr -d '[:space:]')
     [[ $RUSTDESK_ID =~ ^[0-9]+$ ]] || fail "RustDesk returned an invalid device ID: $RUSTDESK_ID"
 }