Connect to Windows servers with xfreerdp

Configure xfreerdp to connect to Windows servers enrolled with Okta Privileged Access.

About this task

xfreerdp is an open-source RDP client for Linux. You can use xfreerdp to create RDP connections to Windows servers enrolled with Okta Privileged Access. If xfreerdp is installed, the Okta Privileged Access client automatically routes RDP connections through xfreerdp.

Before you begin

  • Install and enroll the Okta Privileged Access client (sft) on your Linux machine.
  • Confirm that you have an X11-compatible display, such as a desktop environment, X11 forwarding, or a virtual framebuffer like Xvfb.
  • Install xfreerdp for your Linux distribution:
    Distribution Install command
    Ubuntu or Debian sudo apt install freerdp2-x11
    RHEL, Fedora, or CentOS sudo dnf install freerdp
    Arch Linux sudo pacman -S freerdp
  • Verify the installation by running xfreerdp --version.
  • Confirm that the target Windows server allows inbound TCP traffic on port 3389 (standard RDP) and port 4421 (the sftd broker port used by Okta Privileged Access to broker the RDP connection). Confirm that both the OS firewall and any network security groups allow these ports. See Okta Privileged Access port requirements.

Procedure

  1. Open a terminal on your Linux machine.
  2. Run sft rdp <server-name>, replacing <server-name> with the name of the Windows server as it appears in your Okta Privileged Access team.

The sft client authenticates you, obtains RDP credentials from Okta Privileged Access, and starts a local proxy that tunnels the connection to the sftd broker on the target server. The client then launches xfreerdp, pointed at the local proxy, and the RDP session opens.

Troubleshooting

Issue Cause Solution
dial tcp <ip>:4421: i/o timeout Port 4421 is blocked, or sftd isn't running on the target server. Open port 4421 in the target server's firewall and network security groups. On the Windows server, confirm the sftd is running: Get-Service "ScaleFT Server Tools". Confirm it's listening: netstat -an | findstr 4421.
unable to open display, or xfreerdp fails to launch No X11 display is available. Set the DISPLAY environment variable and start Xvfb. See Connect from a headless Linux server.
No valid RDP client found The sft client can't find xfreerdp in PATH. Run which xfreerdp to confirm xfreerdp is installed and in PATH.

What to do next

Connect from a headless Linux server

If you run sft rdp on a headless Linux server with no physical display, install and start a virtual framebuffer before connecting: install Xvfb (sudo apt install xvfb), start a virtual display (Xvfb :99 -screen 0 1024x768x24 &), and set the DISPLAY environment variable (export DISPLAY=:99). Then run sft rdp <server-name>.