JelmerJ

Since this is a modified version of Keepass which connects to a backend server I cannot easily make an empty vault and provide you with an exmplae XML. However, as I wrote the import is working great for everything other than the TOTP codes. Supporting this import should be a simple case of mapping the TOTPDigits / TOTPPeriod / TOTPSecret keys in the XML to the correct RDM fields.

However, since I plan on migrating this weekend I have now solved this problem with a powershell script. So thanks for the reply, but I will not actually be needing it anymore.

Hi,

We are in the progress of migrating from Pleasant Password Server. PPS comes with a custom build of KeePass which connects to their server and they have added TOTP support to their product. I have been doing trial migrations using the KeePass XML export, and thats working great except for the TOTP codes. The exported XML does contain the necessary fields though!

						<Entry>
							<UUID>abcdefgh==</UUID>
							<IconID>1</IconID>
							<ForegroundColor></ForegroundColor>
							<BackgroundColor></BackgroundColor>
							<OverrideURL></OverrideURL>
							<Tags></Tags>
							<Times>
								<CreationTime>2018-11-09T12:40:50Z</CreationTime>
								<LastModificationTime>2022-07-14T12:39:22Z</LastModificationTime>
								<LastAccessTime>2025-09-30T14:07:31Z</LastAccessTime>
								<ExpiryTime>2025-09-30T14:03:38Z</ExpiryTime>
								<Expires>False</Expires>
								<UsageCount>0</UsageCount>
								<LocationChanged>2025-09-30T14:07:31Z</LocationChanged>
							</Times>
							<String>
								<Key>ModifyTOTPSettings</Key>
								<Value>True</Value>
							</String>
							<String>
								<Key>Notes</Key>
								<Value>Notes removed</Value>
							</String>
							<String>
								<Key>Password</Key>
								<Value ProtectInMemory="True">obfuscated</Value>
							</String>
							<String>
								<Key>Title</Key>
								<Value>SomeWebsite</Value>
							</String>
							<String>
								<Key>TOTPDigits</Key>
								<Value>6</Value>
							</String>
							<String>
								<Key>TOTPIssuer</Key>
								<Value></Value>
							</String>
							<String>
								<Key>TOTPPeriod</Key>
								<Value>30</Value>
							</String>
							<String>
								<Key>TOTPSecret</Key>
								<Value>6ABCDEFGHIJKUFSB</Value>
							</String>
							<String>
								<Key>URL</Key>
								<Value>https://www.somewebsite.nl/</Value>
							</String>
							<String>
								<Key>UserName</Key>
								<Value>someuser</Value>
							</String>
							<String>
								<Key>ViewTOTPSettings</Key>
								<Value>True</Value>
							</String>
							<AutoType>
								<Enabled>True</Enabled>
								<DataTransferObfuscation>0</DataTransferObfuscation>
							</AutoType>
							<CustomData>
								<Item>
									<Key>HasViewEntryPasswordAccess</Key>
									<Value>True</Value>
								</Item>
							</CustomData>
							<History />
						</Entry>

Is there any way we can get this imported? I tried to set the OTP key using Powershell but it appears that Set-RDMEntryOTP doesn't work on username/password entries.

Hello Torben,

There's currently no way to set a website entry's OTP key from the DS cmdlets.

However, within the RDM cmdlets, Set-RDMEntryOTP will receive an update in the next major release permitting this.

Best regards,

Christian

@Christian Robert

Sorry for intruding in this thread, but is this also the reason why I can't get the OTP key to update on a username/password credential with Set-RDMEntryOTP? It appears to only work on OTP entries.

Thanks for the response, the suggestion to add the service to the ignore list of needrestart is a sound one. I'll do this for 1 of our gateways to see if this problem ever occurs again on the other one.

Shortly after starting this thread I have updated my gateways to the latest version. I had missed the new releases. I enabled notifications for the announcement section of the gateway forum, but the latest releases were not announced there. I've set up anouncements for releases on github now.

Thanks for the continuous improvement on the product!

I would not say the impact is limited to a short service unavailability. The service ended in a stopped state and did not recover automatically. I had to log in and manually start the service.

I have had 2 gateways go down overnight during update installation. The servers are running Devolutions Gateway 2025.2.3-1 on Ubuntu 24.04. We have unattended upgrades enabled with needrestart, and needrestart deemed it necessary to restart the devolutions gateway service. The restart failed because the listening port was still in use. This morning I could immediately start the service again without having to kill any lingering process. It appears as if the gateway reported a stopped state too soon, so the start command was giving before it actually finished shutting down?

Sep 24 06:04:09 devolutionsgw02 systemd[1]: Stopping devolutions-gateway.service...
Sep 24 06:04:09 devolutionsgw02 devolutions-gateway[911]: 2025-09-24T04:04:09.008971Z  INFO devolutions_gateway::service: Stopping gateway service
Sep 24 06:04:19 devolutionsgw02 devolutions-gateway[911]: 2025-09-24T04:04:19.010468Z  WARN devolutions_gateway::service: Termination of certain tasks is experiencing significant delays
Sep 24 06:04:29 devolutionsgw02 devolutions-gateway[911]: 2025-09-24T04:04:29.011451Z  WARN devolutions_gateway::service: Termination of certain tasks is experiencing significant delays
Sep 24 06:04:39 devolutionsgw02 devolutions-gateway[911]: 2025-09-24T04:04:39.012837Z  WARN devolutions_gateway::service: Terminate forcefully the lingering tasks
Sep 24 06:04:39 devolutionsgw02 devolutions-gateway[911]: 2025-09-24T04:04:39.013276Z  INFO devolutions_gateway: devolutions-gateway service stopping
Sep 24 06:04:39 devolutionsgw02 systemd[1]: devolutions-gateway.service: Deactivated successfully.
Sep 24 06:04:39 devolutionsgw02 systemd[1]: Stopped devolutions-gateway.service.
Sep 24 06:04:39 devolutionsgw02 systemd[1]: devolutions-gateway.service: Consumed 58.644s CPU time, 79.4M memory peak, 0B memory swap peak.
Sep 24 06:04:39 devolutionsgw02 systemd[1]: Started devolutions-gateway.service.
Sep 24 06:04:39 devolutionsgw02 devolutions-gateway[48534]: 2025-09-24T04:04:39.046607Z  INFO devolutions_gateway::service: version="2025.2.3"
Sep 24 06:04:39 devolutionsgw02 devolutions-gateway[48534]: 2025-09-24T04:04:39.048196Z  INFO devolutions_gateway::service: XMF native library loaded and installed path=/usr/lib/devolutions-gateway/libxmf.so
Sep 24 06:04:39 devolutionsgw02 devolutions-gateway[48534]: 2025-09-24T04:04:39.048672Z  INFO devolutions_gateway::service: Reading JRL file from disk (path: /etc/devolutions-gateway/jrl.json)
Sep 24 06:04:39 devolutionsgw02 devolutions-gateway[48534]: 2025-09-24T04:04:39.049560Z  INFO devolutions_gateway::listener: Initiating listener... url=tcp://0.0.0.0:8181
Sep 24 06:04:39 devolutionsgw02 devolutions-gateway[48534]: 2025-09-24T04:04:39.049611Z  INFO devolutions_gateway::listener: Listener started successfully kind=Tcp addr=0.0.0.0:8181
Sep 24 06:04:39 devolutionsgw02 devolutions-gateway[48534]: 2025-09-24T04:04:39.049622Z  INFO devolutions_gateway::listener: Initiating listener... url=https://0.0.0.0:7171/
Sep 24 06:04:39 devolutionsgw02 devolutions-gateway[48534]: 2025-09-24T04:04:39.050019Z ERROR devolutions_gateway: Failed to start error="failed to bind listener: failed to initialize https://0.0.0.0:7171/: failed to bind TCP socke>
Sep 24 06:04:39 devolutionsgw02 systemd[1]: devolutions-gateway.service: Deactivated successfully.

We have 2 vaults, and I want to delete 1 of them, but the trash button is greyed out. The vault I'm trying to delete is the original vault that was created during the first install. Can I somehow remove it?

Just saw the release notes of the latest version! <3

Syslog is more the Linux way of handling stuff, and the deb package could drop a config file in /etc/rsyslog/conf.d directory to configure the logfile.

Good to know that the logfile can be moved to a different location, because tbh the default location of /etc/devolutions-gateway was bothering me :)

oh, silly, when running without the --service parameter it properly outputs an error message which mentions MISSING_SERVER_AUTH_EXTENDED_KEY_USAGE.

It would be even better if the message had ended up in the logs as well, but I should've tried this :)

The certs are self-signed so I can just recreate them with the proper extensions. Thanks!

I saw a new release so I thought I'd update my gateways, but unfortunately the service doesn't come online. I'm not getting any entries in the logfiles.

Starting "/usr/bin/devolutions-gateway --service" manually gives no output.

strace output stops right after reading the ssl certificate and key

I'm running on Ubuntu 24.04

A downgrade to 2025.2.1 fixes the problem

Thanks for the elaborate answer, this gives a lot of insight!

Hmm okay, I'm going to chew a bit on that. I could either distribute the certificates to our clients or replace the certificate with a proper certificate from a trusted CA.

I followed the instruction on Devolutions Gateway configuration on Linux - Devolutions Documentation . The instructions there tell you to create a selfsigned certificate and trust it on the devolutions server, which I did. I was under the impression that the certificate was just used to secure the connection between the server and the gateway.

If I were to use a public certificate, should I still use the subjectAltname with the IP field? And do I still need to explicitly import the cert on the devolutions server or is it good enough if the chain can be verified?

Ah, the error in the logs is as follows:

2025-06-05T13:45:20.959548Z  INFO jetsocat: version="2025.1.0"
2025-06-05T13:45:20.960131Z  INFO jmux: jetsocat: Start JMUX proxy
2025-06-05T13:45:20.960187Z  INFO jmux:open_jumx_pipe: jetsocat::pipe: Connecting WebSocket at wss://10.29.90.98:7171/jet/jmux
2025-06-05T13:45:20.962619Z  INFO socks5_listener_task{bind_addr="127.0.0.1:65398"}: jetsocat::listener: Start listener
2025-06-05T13:45:21.654938Z ERROR jetsocat: couldn't open pipe: WebSocket connect failed: WebSocket handshake failed: TLS error: native-tls error: Er is een certificaatketen verwerkt, maar de keten is geëindigd bij een basiscertificaat dat niet door de vertrouwenslijstprovider wordt vertrouwd. (os error -2146762487): native-tls error: Er is een certificaatketen verwerkt, maar de keten is geëindigd bij een basiscertificaat dat niet door de vertrouwenslijstprovider wordt vertrouwd. (os error -2146762487): Er is een certificaatketen verwerkt, maar de keten is geëindigd bij een basiscertificaat dat niet door de vertrouwenslijstprovider wordt vertrouwd. (os error -2146762487)
 

The error is in Dutch and claims that certificate chain validation stranded at a root certificate which is not trusted. Is this about the self signed certiticate of the gateway? Should this be distributed to all clients?

Hi,

When I try to access a website from RDM through the gateway, I get a proxy error.

The gateway logs the following error when trying to access the website: HTTP server: peer closed connection without sending TLS close_notify: https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eof"

I'm running my gateways on Linux. The Devolution servers says the gateways are healthy. When I browse to my gateways on https://ip:7171/ I get the gateway certificate presented. RDP connections work just fine.

Any idea where to begin troubleshooting?