DEV Community

Big Mazzy
Big Mazzy

Posted on

Fix Only Console Users Are Allowed to Run the X Server

#linux #ubuntu #tutorial #devops

TL;DR: If the failing xrdp session uses the wrapper launcher, change the [Xorg] executable parameter in /etc/xrdp/sesman.ini to /usr/lib/xorg/Xorg, then restart xrdp-sesman.

The problem

An xrdp connection may fail with this message:

/usr/lib/xorg/Xorg.wrap: Only console users are allowed to run the X server
Enter fullscreen mode Exit fullscreen mode

This denial can appear when a remote desktop session tries to start X through Xorg.wrap. Before changing anything, confirm that the failing session actually uses that wrapper launcher. An SSH test can reproduce the denial, but by itself it does not prove which executable your remote desktop backend invokes.

The steps below are for Ubuntu 22.04 and a legacy xrdp backend configured to use the wrapper. If your session does not use that launcher, stop here; this fix does not apply.

Why it happens

Xorg.wrap is a wrapper that restricts which users can start the X server. A remote desktop session may run under a user who is not considered a console user, so invoking the wrapper can produce the denial.

The xrdp session manager’s [Xorg] section specifies the executable used to start the graphical session. In the example configuration, that section has two param lines. The first points to /usr/bin/Xorg, which can be the wrapper launcher. Replacing only that executable parameter with the direct Xorg executable avoids the wrapper check for this backend. Preserve the remaining parameters in your actual configuration.

Step-by-step fix

  1. Inspect the session manager configuration and find the [Xorg] section. Confirm the failing session’s backend is configured to invoke the wrapper before proceeding. 
   sudo less /etc/xrdp/sesman.ini
Enter fullscreen mode Exit fullscreen mode

Example configuration:

   [Xorg]
   param=/usr/bin/Xorg
   param=/usr/lib/xorg/Xorg
Enter fullscreen mode Exit fullscreen mode

Verify the executable in your own configuration; do not assume it matches the example.

  1. Inspect the launcher to see whether it points to Xorg.wrap. 
   grep Xorg.wrap /usr/bin/Xorg
Enter fullscreen mode Exit fullscreen mode
  1. Test as the affected user over SSH, without sudo. This example reproduces the denial: 
   /usr/bin/Xorg -version
Enter fullscreen mode Exit fullscreen mode

An SSH denial alone does not prove that the failing remote desktop backend uses the wrapper. If the session configuration does not use this launcher, stop rather than applying the change.

  1. Confirm that xorgxrdp is installed. 
   dpkg -s xorgxrdp
Enter fullscreen mode Exit fullscreen mode

The expected sample status is:

   Status: install ok installed
Enter fullscreen mode Exit fullscreen mode
  1. Edit the session manager configuration. 
   sudoedit /etc/xrdp/sesman.ini
Enter fullscreen mode Exit fullscreen mode

In the [Xorg] section, replace only the executable parameter that points to the wrapper with:

   param=/usr/lib/xorg/Xorg
Enter fullscreen mode Exit fullscreen mode

Keep all other parameters in place. The example’s remaining line is param=/usr/lib/xorg/Xorg; avoid adding or removing parameters based only on the example, since your actual configuration may differ.

  1. Restart the session manager to apply the configuration change. 
   sudo systemctl restart xrdp-sesman
Enter fullscreen mode Exit fullscreen mode

This can interrupt remote sessions, so reconnect after the restart completes.

How to verify

Reconnect to the remote desktop and select Xorg as the session type. Confirm that the graphical desktop opens and that you can use it normally. Check the actual remote desktop after login; a successful SSH test is not a substitute for verifying the graphical session.

Any IP addresses, process IDs, or session numbers shown in examples are placeholders. Use the connection and session details that apply to your server.

Common mistakes

  • Applying this change because an SSH test showed the denial, without first confirming that the failing xrdp backend uses the wrapper.
  • Replacing or deleting more than the executable parameter in [Xorg]. Preserve all other parameters in the section.
  • Forgetting to restart xrdp-sesman after editing the configuration.
  • Treating the package status as proof that the graphical session works; reconnect and verify the desktop.
  • Restarting without accounting for the possibility of interrupting remote sessions.

If you want a clean Ubuntu box to practice on, PowerVPS is a reasonable choice: https://powervps.net/?from=32

Watch more fixes on Server Lab: https://www.youtube.com/channel/UCov7rfWAnS4c2wF5E9V1Yag

Top comments (0)