<font color='black' size='2' face='arial'><font class="Apple-style-span" size="2">Hi All - </font>
<div><font class="Apple-style-span" size="2"><br>
</font></div>
<div><font class="Apple-style-span" size="2">There is a post on the new site re printing security (see below). Does anyone have experience with Possible Solution 1? We're hoping to get a few more pointers, maybe some extra documentation, some "here's how you avoid these pitfalls". Thanks!</font></div>
<div><font class="Apple-style-span" size="2"><br>
</font></div>
<div><font class="Apple-style-span" size="2"><span class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: georgia, 'times new roman', serif; font-size: 13px; ">
<div class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 3px; "><ol style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0px; margin-right: 0px; margin-bottom: 1em; margin-left: 3.5em; line-height: 1.5em; list-style-image: none; color: rgb(0, 0, 0); font-weight: bold; list-style-type: decimal; "><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">X2goServer == CUPS Server, latest implementation (as of 20110909):</div>
<ol style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 1.5em; line-height: 1.5em; list-style-image: none; color: rgb(0, 0, 0); font-weight: bold; list-style-type: upper-roman; "><li class="level3" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">cups-x2go CUPS backend runs as root</div>
</li><li class="level3" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">as root the backend launches x2goprint (without sudo!!!)</div>
</li><li class="level3" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">x2goprint script changes owner ship of <acronym title="Portable Document Format" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; cursor: help; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(0, 0, 0); ">PDF</acronym> file and pushes it into SSHFS share towards the X2go client.</div>
<ul style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 1.5em; line-height: 1.5em; list-style-type: square; list-style-image: none; color: rgb(0, 0, 0); "><li class="level4" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">using X2go printing locally (X2go server == CUPS server) then security (sudo) is not an issue any more(?)</div>
<ul style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 1.5em; line-height: 1.5em; list-style-type: square; list-style-image: none; color: rgb(0, 0, 0); "><li class="level5" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">Nope still is (not a big one, though): Using CUPS the user can easily be faked, allowing to fill someone else's quota or print at their home printer.</div>
</li></ul></li></ul></li></ol></li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">X2goServer != CUPS Server:</div>
<ol style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 1.5em; line-height: 1.5em; list-style-image: none; color: rgb(0, 0, 0); font-weight: bold; list-style-type: upper-roman; "><li class="level2" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">The Cups-server connects the x2go-Server as x2goprint-user using ssh-key auth.</div>
</li><li class="level2" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">x2goprint-user executes sudo to change the ownership of the <acronym title="Portable Document Format" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; cursor: help; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(0, 0, 0); ">PDF</acronym> file and pushes it into SSHFS share towards the X2go client.</div>
<ul style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 1.5em; line-height: 1.5em; list-style-type: square; list-style-image: none; color: rgb(0, 0, 0); "><li class="level3" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">This script can currently be exploited.</div>
</li><li class="level3" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">If someone becomes x2goprint he might become root.</div>
</li></ul></li></ol></li></ol></div>
<h2 class="sectionedit5" style="padding-top: 0.5em; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 1em; margin-left: 20px; color: rgb(0, 0, 0); background-color: inherit; font-size: 20px; font-weight: normal; clear: left; "><a name="possible_solution_1" id="possible_solution_1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(36, 110, 216); text-decoration: none; ">Possible solution 1</a></h2>
<div class="level2" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 23px; "><ul style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0px; margin-right: 0px; margin-bottom: 1em; margin-left: 3.5em; line-height: 1.5em; list-style-type: square; list-style-image: none; color: rgb(0, 0, 0); "><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">Start a local cups-server for every user</div>
</li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">Server listens on a File-socket owned by the user</div>
</li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">Add a <acronym title="Portable Document Format" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; cursor: help; border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(0, 0, 0); ">PDF</acronym>-Printer to that server (as the cups-user runs as that user, there <strong style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">should</strong> be no issues with file permissions)</div>
</li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">Import printers from global server</div>
</li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">+ Secure solution, as no other user is involved</div>
</li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">- Every user needs an extra instance (The extra memory usage should not be too much)</div>
</li></ul></div>
<h2 class="sectionedit6" style="padding-top: 0.5em; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 1em; margin-left: 20px; color: rgb(0, 0, 0); background-color: inherit; font-size: 20px; font-weight: normal; clear: left; "><a name="possible_solution_2" id="possible_solution_2" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(36, 110, 216); text-decoration: none; ">Possible solution 2</a></h2>
<div class="level2" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 23px; "><ul style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0px; margin-right: 0px; margin-bottom: 1em; margin-left: 3.5em; line-height: 1.5em; list-style-type: square; list-style-image: none; color: rgb(0, 0, 0); "><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">Write a simple C-Program 'x2goprinter' that is run as the user who wants to print unsing the s-Bit</div>
</li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">The Program writes stdin to argv[1] in the printing-directory</div>
</li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">It also checks whether the user is x2goprint or root</div>
</li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">+ Can be easily adopted</div>
</li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">- x2goprint must be installed by the client</div>
</li><li class="level1" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; ">
<div class="li" style="padding-top: 0em; padding-right: 0em; padding-bottom: 0em; padding-left: 0em; margin-top: 0em; margin-right: 0em; margin-bottom: 0em; margin-left: 0em; color: rgb(0, 0, 0); font-weight: normal; ">- s-bit → Needs security checks</div>
</li></ul></div>
</span></font></div>
<div><font class="Apple-style-span" size="2"><br>
</font></div>
<div><font class="Apple-style-span" size="2"><br>
</font></div>
<div><font class="Apple-style-span" size="2"><br>
</font></div>
<div><font class="Apple-style-span" size="2"><br>
</font></div>
</font>