<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt"><div id="yiv3111771958"><div><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt;"><div id="yiv3111771958"><div id="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31287"><div id="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31286" class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31255" style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt;"><div id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_10"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16">Hi Mike, Stefan,<br></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31256" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue,
Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;" id="yiv3111771958yui_3_13_0_ym1_1_1386349633117_4153"><br><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31257" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_22" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16">Since I'm the one who brought this up, I'll try to be an advocate for why this change is a good thing for certain
users.<br></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31258" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_29" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><br><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31259" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_32" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16">We are evaluating X2Go for use in an existing corporate technical compute environment. There is a shortcoming in our current thin client solution (not NX) and we need to identify a replacement. This environment contains
hundreds of users, hundreds of
systems, dozens of applications, and an uncountable number of scripts. X2Go is being considered against several
alternatives.</span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31260" id="yiv3111771958yui_3_13_0_ym1_1_1386349633117_4457" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><br><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31261" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_45" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16">Whatever solution we choose has to work within the existing environment and support the existing workflow. Our current workflow uses a mixture of xhost and xauth to allow xclients to connect to xservers. While "ssh -Y" may
technically be an elegant
solution, requiring it would break our existing tools, processes, and scripts. Simply put, any thin client solution we deploy has to
support TCP connections if it is to meet our requirement of not disrupting how work is currently done.</span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31262" id="yiv3111771958yui_3_13_0_ym1_1_1386349633117_6380" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><br><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31263" id="yiv3111771958yui_3_13_0_ym1_1_1386349633117_6381" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16">I acknowledge that there is a security issue with TCP connections in X11, but that is an architectural issue with X11 itself and
not with X2Go per se. If the
developers of X2Go were to make TCP connections impossible then effectively the defined security model of X11 (as documented in
places like the XSecurity and Xauth man pages) would be broken. TCP is part of how X11 works.</span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31264" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_141" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><br><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31265" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_144" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16">Once it became apparent in our testing that exporting displays didn't work as expected, the system administrator who installed it went through
the configuration files
and documentation looking for a solution. He couldn't find one, so he escalated it to me to look into. If we hadn't been able to find a
fix it would have ruled out X2Go from further consideration, which would have been unfortunate as it is currently our leading choice for this particular need.</span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31266" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_174" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><br><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31267" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_177" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16">Hopefully the above helps persuade you that there is a need for some users to
be able to continue to
support the existing X11 security model (including TCP).</span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31268" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_192" style="color:rgb(0,
0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><br><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31269" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_195" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16">If you accept that point, then it seems there should be a more elegant way of enabling TCP than editing the x2gostartagent file. As someone brand new to looking at the project, files like x2goagent.options or x2goserver.conf are the obvious places I would expect to find an option to make this change.</span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31270"
id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_218" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><br><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31271" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_221" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16">Thanks,</span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31272" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_226" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande,
sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16">Nick</span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31273" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_230" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"><br></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31274" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_37" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><br><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"></span></div><div class="yiv3111771958yui_3_13_0_ym1_1_1386348031900_31275"
id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_40" style="color:rgb(0, 0, 0);font-size:16px;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;background-color:transparent;font-style:normal;"><span id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_16"></span></div><div style="display: block;" id="yiv3111771958yui_3_13_0_ym1_7_1386349633117_12" class="yiv3111771958yahoo_quoted"> <br> <br> <div class="yiv3111771958yui_3_13_0_ym1_1_1386349633117_3364 yiv3111771958yui_3_13_0_ym1_1_1386348031900_31277" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt;"> <div class="yiv3111771958yui_3_13_0_ym1_1_1386349633117_3365 yiv3111771958yui_3_13_0_ym1_1_1386348031900_31278" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt;"> <div dir="ltr"> <font face="Arial" size="2"> On Friday, December 6, 2013 5:16 AM, Stefan Baur
<newsgroups.mail2@stefanbaur.de> wrote:<br> </font> </div> <div class="yiv3111771958y_msg_container">Am 06.12.2013 13:06, schrieb Mike Gabriel:<br clear="none">> The default should be ,,disabled'', of course. However, I think that we<br clear="none">> should support people that want to use X2Go in their setup as a<br clear="none">> replacement for *NX*. Making something configurable and putting a big<br clear="none">> red warning sign above the configuration should be ok IMHO.<br clear="none"><br clear="none">> Feedback?<br clear="none"><br clear="none">Is there no way of assisting this user in migrating away from NX, other <br clear="none">than raping our codebase like that?<br clear="none"><br clear="none">What's wrong with using ssh
-X / ssh -Y, which was
previously suggested <br clear="none">to the user?<br clear="none"><br clear="none">Maybe some more information on what the user is trying to accomplish <br clear="none">would help us come up with a better solution.<div class="yiv3111771958yqt6271126499" id="yiv3111771958yqtfd92551"><br clear="none"><br clear="none">-Stefan<br clear="none"></div><br><br></div> </div> </div> </div> </div></div></div></div></div></div></div></body></html>