<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>
<div>Hi Mihai,</div>
<div> </div>
<div>I tested the following things: login via normal SSH, login via x2goclient gui and cli while I was monitoring the messages on the RSA SecurID authentication server. What I found is, that while I login via normal SSH there is a message in the RSA console showing the user sucessfully authenticated itself. However, if I login via x2goclient gui or cli, there is no message at all in the RSA console (not even a false authentication or so). It seems that x2go doesn't even get to the RSA authentication as if it would force the SSH client to authenticate via normal password and not via PAM.</div>
<div>I get the same results: no messages at the RSA console, if I make a normal SSH connection forcing password authentication:</div>
<div>"<span style="font-family: courier new , courier , monospace;">ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@server</span>".</div>
<div>Can it be that x2goclient forces the password authentication explicitely if there is no publickey?</div>
<div> </div>
<div>Regards</div>
<div>Swizzly</div>
<div style="margin: 10px 5px 5px 10px; padding: 10px 0px 10px 10px; border-left-color: rgb(195, 217, 229); border-left-width: 2px; border-left-style: solid;">
<div style="margin: 0px 0px 10px;"><b>Gesendet:</b> Freitag, 13. März 2015 um 17:12 Uhr<br/>
<b>Von:</b> "Mihai Moldovan" <ionic@ionic.de><br/>
<b>An:</b> "swizz ly" <swizz.ly@gmx.ch>, x2go-user@lists.x2go.org<br/>
<b>Betreff:</b> Re: [X2Go-User] X2Go Two-factor-authentication with SecurID</div>
<div>Hi,<br/>
<br/>
<br/>
On 13.03.2015 02:48 PM, swizz ly wrote:<br/>
> [...]<br/>
> In case of the x2goclient-cli Perl script, that comes with the<br/>
> x2goclient source, I found, that for a single x2go connection several<br/>
> (3-4x?) SSH connections are made in the background. In case of SecurID<br/>
> RSA, only the first SSH connection can work with a given PASSCODE, it<br/>
> is accepted only at the first SSH connection.<br/>
> Perhaps the normal x2goclient behaves the same way: it tries to<br/>
> connect using the same PASSCODE several times, and this could be the<br/>
> cause of the problem.<br/>
<br/>
Well, the answer is a little bit complicated.<br/>
<br/>
Yes, it behaves exactly the same way. Several programs are started<br/>
server side.<br/>
<br/>
This includes session discovery and of course starting a new session or<br/>
resuming it.<br/>
<br/>
For that, a new connection is established via libssh. This connection is<br/>
authenticated by any means provided: password, key, or<br/>
keyboard-interactive (i.e., SecurID.)<br/>
<br/>
This said, libssh uses channels for spawning new commands/shells. These<br/>
channels do NO authentication but use the established main connection.<br/>
<br/>
X2Go Client should only open up one connection and then use multiple<br/>
channels over the already authenticated connection for doing its work.<br/>
<br/>
Is it really not and instead opening up multiple connections?<br/>
<br/>
<br/>
<br/>
Mihai<br/>
</div>
</div>
</div>
</div></div></body></html>