Dear Maintainer,

When logging into a graphical desktop session (such as XFCE4) over xrdp, a redundant ssh-agent process is spawned by xfce4-session (invoked via xrdp-sesexec). This process overrides any user-defined SSH_AUTH_SOCK environment variables set prior to session launch and ignores the global X11 session configuration.

Standard Debian X11 session initialization (/etc/X11/Xsession.d/90x11-common_ssh-agent) already handles ssh-agent invocation safely:

# /etc/X11/Xsession.d/90x11-common_ssh-agent
STARTSSH=
SSHAGENT=/usr/bin/ssh-agent
SSHAGENTARGS=

if has_option use-ssh-agent; then
  if [ -x "$SSHAGENT" ] && [ -z "$SSH_AUTH_SOCK" ]; then
    STARTUP="$SSHAGENT $SSHAGENTARGS ${TMPDIR:+env TMPDIR=$TMPDIR} $STARTUP"
  fi
fi

Because 90x11-common_ssh-agent checks has_option use-ssh-agent and verifies that [ -z "$SSH_AUTH_SOCK" ], it respects user configurations (such as setting no-use-ssh-agent in /etc/X11/Xsession.options or exporting a custom SSH_AUTH_SOCK via ~/.xsessionrc / systemd user services).

However, xrdp session execution bypasses or fails to propagate these guards down to xfce4-session, resulting in xfce4-session spawning an unrequested ssh-agent -s process directly.
--- Parent Process Tree ---
108137  107837 xfce4-session
107837  107831 xrdp-sesexec
107831       1 /usr/sbin/xrdp-sesman --nodaemon

Observed Behavior
/etc/X11/Xsession.options is explicitly set to no-use-ssh-agent.

SSH_AUTH_SOCK is already configured in the user environment (e.g., via ~/.xsessionrc or user systemd units).

xrdp-sesexec / xfce4-session still invokes /usr/bin/ssh-agent -s, spawning a duplicate daemon and overwriting SSH_AUTH_SOCK in the desktop session environment.

Expected Behavior
xrdp should delegate agent lifecycle management to standard X11 session handlers (Xsession.d) or inherit existing environment variables (such as SSH_AUTH_SOCK) prior to executing the window manager. It should not cause an extraneous ssh-agent to launch when no-use-ssh-agent is set or when SSH_AUTH_SOCK is already populated.

I don't think the ssh-agent that is spawned by xrdp should set its SSH_AUTH_SOCK in the user
systemd environment. I don't think the X11 scripts do this.