RDPShift

Shift from mstsc without shifting your security expectations.

Current release: 0.5.0

RDPShift is a profile-free KDE launcher for XFreeRDP 3, built for Windows administrators moving their daily work to Debian. It keeps the familiar “enter a computer and connect” workflow without building a recoverable list of your infrastructure or retaining credentials.

RDPShift supports Debian 13 with KDE Plasma and Wayland.

The Shift suite

Tool	Familiar starting point	Debian engine
RDPShift	An mstsc-style “enter a computer and connect” workflow	FreeRDP
SSHShift	Windows key → PuTTY → Enter → host → Enter, made native to KDE	OpenSSH + Konsole
MapShift	A familiar “map network drive” path into KDE applications	KDE KIO SMB + KIO-FUSE
ServiceShift	A services.msc-style overview with familiar service controls	systemd + PolicyKit
TaskShift	A Task Scheduler-style overview with safe schedule editing	systemd timers + PolicyKit

Why it exists

FreeRDP's normal trust-on-first-use store retains complete PEM certificates. Certificates can contain hostnames in their subject or Subject Alternative Name fields. RDPShift instead keeps an opaque host tag and an encrypted SHA-256 certificate fingerprint.

Updates stay with Debian

RDPShift does not bundle its own RDP implementation. It launches the XFreeRDP package maintained by Debian, so normal apt upgrades deliver FreeRDP security and bug fixes through the same trusted update path as the rest of the system. There is no separate full client, private protocol copy, or extra updater that can quietly fall behind.

The small wrapper may occasionally need a compatibility or interface update, but the security-sensitive RDP engine remains Debian's package—not frozen inside RDPShift.

Privacy and certificate behavior

• No connection profiles, recent-host list, saved usernames, or saved passwords.
• No hostname in FreeRDP's process arguments: connection settings are passed through an anonymous file descriptor.
• No persistent PEM certificate or plaintext certificate fingerprint.
• First use displays the certificate fingerprint for explicit approval.
• An unchanged certificate connects silently.
• A changed certificate displays both fingerprints and requires explicit replacement approval.
• The real FreeRDP session is pinned to the approved fingerprint and configured to deny any different certificate.
• Certificate checking and Windows session startup display clear progress messages instead of leaving an unexplained delay.
• A native Qt 6 credential dialog presents Username, Password, then optional Domain. Credentials are sent through the anonymous descriptor and discarded.
• Windowed sessions explicitly disable relative mouse input and mouse grabbing to avoid pointer drift.
• The session uses XFreeRDP's normal decorated X11 window under XWayland. Its close button disconnects the client while leaving the Windows session and its running applications intact.
• The connection window has a collapsed Advanced options section for initial resolution, full-screen mode, text clipboard sharing, and explicitly opted-in clipboard file transfer. These choices reset on every launch.
• FreeRDP configuration, cache, logs, and incidental state are isolated under /run/user/$UID, which is normally tmpfs, then deleted on exit.

The persistent database contains:

• HMAC-SHA-256(secret, normalized hostname + port) as its lookup key;
• an AES-256-GCM-encrypted certificate fingerprint as its value.

The random secret is stored in the user's local KDE Wallet under RDPShift/hostname-hmac-key. Trust records are stored in $XDG_DATA_HOME/rdp-shift/trust.json, defaulting to ~/.local/share/rdp-shift/trust.json.

Installation on Debian 13

Install the runtime dependencies:

sudo apt install freerdp3-x11 python3-dbus python3-cryptography python3-pyqt6

Then install RDPShift for the current user:

./install.sh

The application appears as RDPShift in Plasma's application menu. The installer defaults to ~/.local; set PREFIX to choose another user prefix.

To uninstall the launcher:

./uninstall.sh

Uninstalling deliberately preserves the encrypted trust database and KDE Wallet key so reinstalling does not silently discard certificate-change protection.

Default redirection policy

Text clipboard redirection is enabled, while clipboard file transfer is disabled. Advanced options can disable the clipboard entirely or explicitly enable clipboard file transfer for one connection. Drive, home-directory, printer, smart-card, USB, camera, and microphone redirection are not enabled by the launcher.

Testing

python3 -m unittest discover -s tests -v
python3 -m py_compile rdp-shift

The tests cover target parsing, credential-field ordering, safe FreeRDP arguments, opaque authenticated trust storage, file permissions, tamper detection, RDP protocol negotiation, and certificate fingerprint calculation.

Threat-model boundaries

RDPShift prevents this launcher from retaining recoverable destination names. It cannot hide a live connection from DNS, network equipment, the destination, the operating system, or an attacker able to inspect the user's process memory or unlocked KDE Wallet. See SECURITY.md for details.

RDP gateways, server redirection, and unusual load balancers are not yet in the tested compatibility set. Do not bypass a failure with /cert:ignore.

License

MIT. See LICENSE.