I created a username/password combination of the form onetwo:bucklemyshoe, ie the password file contains the single line onetwo|bucklemyshoe

Whenever I try to connect the message appears on the logon page:

You were disconnected for the following reason:

invalid challenge response

The logs display the following message

 Authentication required by password file authenticator module
 sending challenge for username 'onetwo' using hmac+sha256 digest
 Warning: hmac+sha256 challenge for 'onetwo' does not match
 Warning: authentication failed
 invalid challenge response
 Disconnecting client Protocol(ws websocket: 111.111.111.111:14333 <- 222.222.222.222:35555):
 invalid challenge response

It makes no difference whether Insecure plain-text passwords is checked or not.

The contents of the password file is not what xpra expects. Is the actual format documented somewhere? Is there an utility or script to create them in the right format?

According to the xpra mailing list where this was also asked, the password file format is documented on the wiki:

Password File

"file" vs "multifile":

• "file" contains a single password, the whole file is the password


• "multifile" contains a list of authentication values, see proxy server file authentication - this module is deprecated in favour of "sqlite" which is easier to configure.

To make a regular password file, you just write the password in plaintext:

echo -n "bucklemyshoe" > yourpasswordfile.txt