<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" id="owaParaStyle"></style>
<style type="text/css">.style1 {font-family: "Times New Roman";}</style></head><body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">I forgot to check - is there a "lossless update" button anywhere, like turbovnc?<br>
<div><br>
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="margin:0"><font size="3" face="Times New Roman,serif"><span style="font-size:12pt"><font size="2" face="Calibri,sans-serif" color="#1F497D"><span style="font-size:11pt"></span></font></span></font></div>
<div>
<div style="margin:0"><font size="3" face="Times New Roman,serif"><span style="font-size:12pt"><font size="2" face="Arial,sans-serif" color="blue"><span style="font-size:10pt"><b>Richard Beare</b></span></font><font size="2" face="Arial,sans-serif" color="blue"><span style="font-size:10pt"><b><br>
</b></span></font><font size="2" face="Arial,sans-serif" color="#989898"><span style="font-size:10pt"><br>
</span></font><font size="2" face="Arial,sans-serif" color="#989898"><span style="font-size:10pt">Team Leader (Computational Methods Group)</span></font></span></font></div>
<div style="margin:0"><font size="3" face="Times New Roman,serif"><span style="font-size:12pt"><font size="2" face="Arial,sans-serif" color="#989898"><span style="font-size:10pt">Developmental Imaging</span></font></span></font></div>
<div style="margin:0"><font size="3" face="Times New Roman,serif"><span style="font-size:12pt"><font size="2" face="Arial,sans-serif" color="#989898"><span style="font-size:10pt"><br>
</span></font><font size="2" face="Arial,sans-serif" color="#00007F"><span style="font-size:10pt"><b>Murdoch Children's Research Institute</b></span></font><font size="2" face="Arial,sans-serif" color="#00007F"><span style="font-size:10pt"><b><br>
</b></span></font><font size="2" face="Arial,sans-serif" color="#0070C0"><span style="font-size:10pt">The Royal Children's Hospital</span></font><font size="2" face="Arial,sans-serif" color="#0070C0"><span style="font-size:10pt"><br>
Flemington Road Parkville Victoria 3052 Australia</span></font><font size="2" face="Arial,sans-serif" color="#0070C0"><span style="font-size:10pt"><br>
</span></font><font size="2" face="Arial,sans-serif" color="#1F497D"><span style="font-size:10pt"><b>T</b></span></font><font size="2" face="Arial,sans-serif" color="#1F497D"><span style="font-size:10pt">
</span></font><font size="2" face="Arial,sans-serif" color="#002060"><span style="font-size:10pt"><b>8341 6403</b></span></font><font size="2" face="Arial,sans-serif"><span style="font-size:10pt"><b><br>
<font color="#1f497d">E</font><font color="#525252"> <a href="mailto:richard.beare@mcri.edu.au">Richard.Beare@mcri.edu.au</a></font></b></span></font><font size="2" face="Arial,sans-serif" color="#1F497D"><span style="font-size:10pt"><u><br>
</u></span></font><font size="2" face="Arial,sans-serif" color="#0070C0"><span style="font-size:10pt">www.mcri.edu.au<br>
<a href="http://developmentalimagingmcri.github.io/">Developmental Imaging Software</a><br>
</span></font><br>
</span></font></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF850110" style="direction: ltr;"><font size="2" face="Tahoma" color="#000000"><b>From:</b> x2go-user [x2go-user-bounces@lists.x2go.org] on behalf of Stefan Baur [X2Go-ML-1@baur-itcs.de]<br>
<b>Sent:</b> Thursday, April 02, 2020 5:54 PM<br>
<b>To:</b> x2go-user@lists.x2go.org<br>
<b>Subject:</b> Re: [X2Go-User] configure x2go for servers inside a network with PaloAltoNetworking firewalls<br>
</font><br>
</div>
<div></div>
<div>Am 02.04.20 um 01:56 schrieb Richard Beare:<br>
> Apologies - accidentally sent before completing<br>
> Hi,<br>
> I have a working installation of x2go, but there is some ugliness about the setup that I'd like to reduce. Any advice welcome.<br>
> <br>
> Here's how it looks at the moment.<br>
> <br>
> 1) vpn connection to the institute.<br>
> 2) ssh tunnel to the workstation from the laptop<br>
> 3) x2go connected to the local tunnel port<br>
> <br>
> This works, but we now have 3 layers of encyption.<br>
> <br>
> The reason for not pointing x2go directly at the w orkstation is the use of PaloAltoNetworking appliances within the institution. These do a man-in-the-middle break of ssh connections and lead to the following error from x2go:<br>
> <br>
> kex error : no match for method kex algos: server [diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1], client [curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1]<br>
> <br>
> A direct ssh login works, but always falls back to a password.<br>
> <br>
> <br>
> Is there any configuration option possible to have x2go/libssh handle the setup in the same way that regular ssh does?<br>
<br>
Yes. That's what the "Use Proxy Server for SSH Connection" checkbox in<br>
the session configuration is for.<br>
<br>
Though I'm not quite sure why you're getting the kex error one way, but<br>
not the other. That's the actual issue you should be trying to fix.<br>
You probably need a line "KexAlgorithms" in your server's<br>
/etc/ssh/sshd_config, where "KexAlgorithms" is followed by at least one<br>
of the algorithm names listed after "client" in your error message above.<br>
<br>
After changing that, you need to restart sshd - note that running<br>
sessions will not be killed by the usual restart methods, but, if you're<br>
trying to change this via a ssh connection, be sure to have several SSH<br>
sessions open, so you have a spare session to fix things if you make a<br>
typo or other mistake.<br>
<br>
Also, since your signature says:<br>
<br>
> Team Leader (Computational Methods Group)<br>
> Developmental Imaging<br>
<br>
I would like to add our usual disclaimer/warning:<br>
<br>
X2Go does have options for image compression, like using JPG and/or PNG.<br>
Not all image compression algorithms are lossless, and thus there may be<br>
artifacts in the images (i.e. the image displayed through X2Go may look<br>
slightly different than what it would look like on a regular X-Server<br>
screen), depending on which algorithm and which compression level you<br>
choose.<br>
<br>
If you're using fMRI/X-Ray/Mammography/… images or similar medical<br>
imaging displayed through X2Go for clinical purposes (deciding whether a<br>
certain patient requires a surgery etc.), you should absolutely make<br>
sure that you're using a lossless compression or no compression at all,<br>
or else you might be seeing things that aren't actually there, or<br>
missing things that are there.<br>
<br>
Kind Regards,<br>
Stefan Baur<br>
<br>
-- <br>
BAUR-ITCS UG (haftungsbeschränkt)<br>
Geschäftsführer: Stefan Baur<br>
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364<br>
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243<br>
_______________________________________________<br>
x2go-user mailing list<br>
x2go-user@lists.x2go.org<br>
<a href="https://lists.x2go.org/listinfo/x2go-user" target="_blank" rel="noopener noreferrer">https://lists.x2go.org/listinfo/x2go-user</a><br>
</div>
</div>
</div>
<br><br><p style="font-family: Verdana; font-size:7pt; color:#666666;">This e-mail and any attachments to it (the "Communication") are, unless otherwise stated, confidential, may contain copyright material and is for the use only of the intended recipient. If you receive the Communication in error, please notify the sender immediately by return e-mail, delete the Communication and the return e-mail, and do not read, copy, retransmit or otherwise deal with it. Any views expressed in the Communication are those of the individual sender only, unless expressly stated to be those of Murdoch Children’s Research Institute (MCRI) ABN 21 006 566 972 or any of its related entities. MCRI does not accept liability in connection with the integrity of or errors in the Communication, computer virus, data corruption, interference or delay arising from or in respect of the Communication.</p></body></html>