[X2Go-Dev] X2Go Client - new features and bugfix

[Michael DePaulo]

On Thu, Dec 12, 2013 at 8:20 AM, Oleksandr Shneyder
<o.shneyder at phoca-gmbh.de> wrote:
> 1. Support for GSSApi (Kerberos 5) authentication.
>
> http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=a77d761dbb16d28206e7c2446654539935746e4e
>
> It works on Linux, Windows (MIT Kerberos) and Mac. Unfortunately stable
> version of libssh not supporting gssapi yet. X2Go Client using OpenSSH
> client (ssh, scp) on Mac and Linux for GSSApi authentication. On Windows
> X2Go Client using CLI tools "plink" and "pscp", which are the part of
> free and OS project PUTTY
> (http://www.chiark.greenend.org.uk/~sgtatham/putty/)
>
> @Windows developers: please note that X2Go Client Windows build should
> include plink and pscp binaries, this binaries can be found here:
> http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
>
> As soon as gssapi support will be enabled in stable version of libssh,
> 3d-party ssh clients will be not used by X2Go Client any more.

Oleksandr,

1st of all, thank you very much for implementing this! As someone with
a windows AD domain at home and at work, this feature is extremely
useful when it does work.

2nd, as the new windows package maintainer, I uploaded
x2goclient-4.0.1.2-pre03 (and x2goclient-4.0.1.2.interims-pre03) with
the current plink.exe and pscp.exe (versions 0.63) to the x2go server.
Mike Gabriel will most likely make this pre03 version available to
publicly download tomorrow (he just went to bed.)

3rd, it appears as if whenever plink has any sort of error, having
GSSAPI auth enabled for the session crashes the Windows x2goclient. It
took me a bunch of effort to make plink's GSSAPI authentication work,
I intend to document this work on the wiki. Note that my setup is a
Windows Server 2012 AD domain controller, x2goserver 4.0.1.9 from EPEL
running on centos 6.4 64-bit with Samba 3.6's winbind for domain
membership, and a Windows 8.1 64-bit domain member client (I also
tested the x2goclient on my Windows Server 2012 DC also). But the
bottom line is that I expect LOTS of Windows users to run into
x2goclient crashes whenever they enable GSSAPI. They can avoid these
crashes by disabling GSSAPI for the session (so it's not as severe a
problem as bug #109), but I would strongly prefer if you could fix the
crashes before we launch 4.0.1.2. If you can't make Windows x2goclient
easily fall back to password auth when GSSAPI auth fails, at least
give the user a message to disable GSSAPI auth.

-Mike