rdp_pipe

Python desktop RDP client for Linux operators connecting to remote hosts over RDP with NLA (CredSSP) and NTLM password authentication. The UI is a native PyQt6 window with pointer-gated keyboard input and seamless resize via MS-RDPEDISP when the server supports it.

Prerequisites

• pyenv with the Python version named in .python-version installed locally (the file is required in every clone; install that interpreter with pyenv before pip)
• An X11 or Wayland desktop session for PyQt6
• Network reachability to the target host on TCP 3389 (or the port in the URL)

Install

From the repo root with pyenv active for .python-version:

pip install -e .

Optional wrapper: ./script/install.sh (runs the same command).

This project does not use a repo .venv. Console scripts (rdp, rdpr) land on your pyenv shim path after editable install.

If imports fail after moving the repo, remove any leftover .venv directory (it may still point at an old checkout path) and run pip install -e . again. The installable Python package is rdp_pipe, not rdp.

On KDE / Wayland, Qt registers Wayland app id rdp_pipe, which must match an installed asset/rdp_pipe.desktop entry (./script/install.sh runs the desktop install helper automatically). The portal and task switcher use that id; the human label RDP Pipe comes from the desktop file Name= field. Do not use spaces in the app id — that breaks xdg-desktop-portal registration.

Connect

rdp [-h] [--headless] [--pipe] [--no-autoresize] URL

GUI mode (default) opens a PyQt6 window. --headless runs without a display and requires --pipe for automation on the command socket under the system temp directory (rdp.sock).

Press Ctrl+C in the terminal where you launched rdp to disconnect and exit cleanly (this does not affect keyboard input forwarded inside the session window).

URL is an aardwolf-style connection string or bare host shorthand:

rdp rdp://DOMAIN\\[email protected]:3389
rdp rdp+ntlm-password://DOMAIN\\[email protected]:3389
rdp 10.0.0.5

Generic rdp:// URLs prefer NTLM password authentication; the server selects NLA (CredSSP), TLS-only, or legacy RDP during X.224 negotiation.

Server certificate trust

On NLA connect, the client stores the server TLS certificate under ~/.config/rdpipe/:

• clients/ — one-line file mapping the remote IP to a certificate fingerprint
• certificates// — certificate (PEM), ip, and metadata (JSON)

The first connection to an IP is accepted automatically. If the server later presents a different certificate for the same IP, the client refuses to connect and prints paths to remove, for example:

~/.config/rdpipe/clients/10.0.0.5
~/.config/rdpipe/certificates//