x2go-commits March 2013

x2go-commits@lists.x2go.org

2 participants
1021 discussions

page changed: wiki:advanced:x2gobroker:howitworks
by wiki-admin＠x2go.org 28 Mar '13

28 Mar '13

A page in your DokuWiki was added or changed. Here are the details: Date : 2013/03/28 10:31 Browser : Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 IP-Address : 46.142.176.16 Hostname : 16-176-142-46.pool.kielnet.net Old Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks?rev=13644… New Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks Edit Summary: [Generic function: listSessions] User : sunweaver @@ -117,9 +117,9 @@ ==== Generic function: listSessions ==== - This is a generic example for the "selectSession" function in a Perl based X2Go Session Broker: + This is a generic example for the "listSessions" function in a Perl based X2Go Session Broker: <code perl> sub selectSession { -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:advanced:x2gobroker:howitworks
by wiki-admin＠x2go.org 28 Mar '13

28 Mar '13

1 0

page changed: wiki:advanced:x2gobroker:howitworks
by wiki-admin＠x2go.org 28 Mar '13

28 Mar '13

A page in your DokuWiki was added or changed. Here are the details: Date : 2013/03/28 10:30 Browser : Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 IP-Address : 46.142.186.224 Hostname : 224-186-142-46.pool.kielnet.net Old Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks?rev=13644… New Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks Edit Summary: [Session Profile Format] User : sunweaver @@ -76,16 +76,18 @@ The option keys and values are the same as in X2Go Client's configuration file (''~/.x2goclient/sessions''). The only difference occurs in the parameters ''host=<hostname>'' and ''key=<keyfile>''. - Furthermore, there are two parameters that are not supported in the ''sessions'' file, but are only functional when X2Go Client is in broker mode: ''status=<status>'' and ''usebrokerpass={true,false}''. + Furthermore, there are two extra parameters that are not supported in the ''sessions'' file, but have a special functionality when X2Go Client is run in broker mode: ''status={R,S}'' and ''usebrokerpass={true,false}''. === The session profile option: host === The ''host='' parameter is not necessarily a hostname of an X2Go Server. The actual address of the server will be provided after the session profile has been selected by the user. Delaying the provision of the X2Go Server name makes sense in a cases where X2Go Session Broker is used as a [[wiki:advanced:x2gobroker:loadbalancing|load balancer]]. In load balancing setups, the best server will be - chosen after selection of a session profile. Once the best server has been detected, it is sent to X2Go Client and X2Go Client use the best server's hostname for authentication and session startup. When resuming an X2Go session, the broker will know the server that runs the suspended session and return that one, so that the user can continue his/her earlier session. + chosen after selection of a session profile. Once the best server has been detected, it is sent to X2Go Client and X2Go Client uses this best server's hostname for authentication and session startup. + + When resuming an X2Go session, the broker will know the server that runs the suspended session and return that one, so that the user can continue his/her earlier session. === The session profile option: key === The ''key='' parameter is simply ignored when returned via an X2Go Session Broker. @@ -96,13 +98,13 @@ tried, for example: ''key=will-be-provided-later''. === The session profile option: usebrokerpass === - The parameter ''usebrokerpass={true,false}'' is used to denote that requesting the user password for this session is not necessary, but that the X2Go Client should rather use the broker password instead. + The parameter ''usebrokerpass={true,false}'' is used to denote that requesting the user password for this session is not necessary, but that the X2Go Client should rather use the broker's //username and password// tuple instead. This can be useful if the X2Go Session Broker and the X2Go Server use the same authentication server (e.g. same LDAP db) and there is no need to ask the same password twice. - It is not recommended to use such authentication with an HTTP Broker without SSL encryption. + It is highly recommended to only use this feature on HTTPS brokers (i.e. with SSL encryption for the X2Go Client <-> X2Go Session Broker communication) or SSH brokers. === The session profile option: status === The parameter ''status={S,R}'' can be one of two values "S" or "R". It can be used to tell X2Go Client that an instance (or instances) of this session profile are already running or are suspended on the server. -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:advanced:x2gobroker:howitworks
by wiki-admin＠x2go.org 28 Mar '13

28 Mar '13

A page in your DokuWiki was added or changed. Here are the details: Date : 2013/03/28 10:22 Browser : Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 IP-Address : 46.142.186.224 Hostname : 224-186-142-46.pool.kielnet.net Old Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks?rev=13644… New Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks Edit Summary: [Don't Check User Data] User : sunweaver @@ -28,13 +28,15 @@ The usage of this feature is optional. ===== Don't Check User Data ===== - In some setups it can make sense to give access to the X2Go Session Broker without authentication. An example can be a broker on your internal LAN where the broker only serves as a load balancer for two or more X2Go Servers (multi-node setup). + In some setups it can make sense to give access to the X2Go Session Broker without authentication. This is one way of reducing the dual authentication steps to one (and thus increase usability of X2Go Client in broker mode). + + __Example:__ One possible example can be a session broker on your internal LAN where the broker only serves as a load balancer for two or more X2Go Servers (multi-node setup). For such a setup, it requires that all client machines on your LAN are trusted. When implementing your own session broker, you can configure the broker not to check the username (and password) at all. This is only possible with HTTP based brokers. - With SSH based X2Go Session Broker implementations, you can also ignore the username, but it is not possible to access the broker without some sort of login method. + With SSH based X2Go Session Broker implementations, you can also ignore the username, but it is not possible to access the broker without some sort of authentication method. ===== Granting Access to the Broker ===== Whatever mechanism is used for authentication, the first line printed to STDOUT (or returned via CGI script) has to be: ''Access granted''. -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:advanced:x2gobroker:howitworks
by wiki-admin＠x2go.org 28 Mar '13

28 Mar '13

A page in your DokuWiki was added or changed. Here are the details: Date : 2013/03/28 10:20 Browser : Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 IP-Address : 46.142.186.224 Hostname : 224-186-142-46.pool.kielnet.net Old Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks?rev=13644… New Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks Edit Summary: [Extra Security: Pre-shared Authentication ID] User : sunweaver @@ -23,8 +23,10 @@ With both session broker types (HTTP, SSH) you can use an additional parameter ''authid''. The authentication ID is used for verifying the trust state of an authenticating user/machine. The authentication ID is a user defined string (like a pre-shared key) which is stored in a file on the client-side. The file path to the authentication ID has to be specified as the X2Go Client command line option ''<nowiki>--auth-id</nowiki>''. + + The usage of this feature is optional. ===== Don't Check User Data ===== In some setups it can make sense to give access to the X2Go Session Broker without authentication. An example can be a broker on your internal LAN where the broker only serves as a load balancer for two or more X2Go Servers (multi-node setup). -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:advanced:x2gobroker:howitworks
by wiki-admin＠x2go.org 28 Mar '13

28 Mar '13

A page in your DokuWiki was added or changed. Here are the details: Date : 2013/03/28 10:19 Browser : Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 IP-Address : 46.142.186.224 Hostname : 224-186-142-46.pool.kielnet.net Old Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks?rev=13644… New Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks Edit Summary: [Extra Security: Pre-shared Authentication ID] User : sunweaver @@ -20,9 +20,9 @@ For authentication against X2Go Servers, SSH is used. With SSH you can use //username and password// authentication, SSH key authentication, GnuPG-Smartcard based authentication, etc. ===== Extra Security: Pre-shared Authentication ID ===== - With both types of broker (HTTP, SSH) you can use an additional parameter "authid" for verifying the trust state of an authenticating user. The authentication ID is a user defined string (like a pre-shared key) which is stored in file on the client-side. + With both session broker types (HTTP, SSH) you can use an additional parameter ''authid''. The authentication ID is used for verifying the trust state of an authenticating user/machine. The authentication ID is a user defined string (like a pre-shared key) which is stored in a file on the client-side. The file path to the authentication ID has to be specified as the X2Go Client command line option ''<nowiki>--auth-id</nowiki>''. ===== Don't Check User Data ===== -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:advanced:x2gobroker:howitworks
by wiki-admin＠x2go.org 28 Mar '13

28 Mar '13

A page in your DokuWiki was added or changed. Here are the details: Date : 2013/03/28 10:17 Browser : Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 IP-Address : 46.142.186.224 Hostname : 224-186-142-46.pool.kielnet.net Old Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks?rev=13644… New Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks Edit Summary: [Authentication methods against X2Go Session Broker] User : sunweaver @@ -15,8 +15,11 @@ In general, X2Go client can use different methods for authentication against an X2Go Session Broker. With an HTTP(S) broker it could be //username and password//. With an SSH broker a //SSH key based authentication// is also possible. + ==== Authentication methods against provided X2Go Servers ==== + + For authentication against X2Go Servers, SSH is used. With SSH you can use //username and password// authentication, SSH key authentication, GnuPG-Smartcard based authentication, etc. ===== Extra Security: Pre-shared Authentication ID ===== With both types of broker (HTTP, SSH) you can use an additional parameter "authid" for verifying the trust state of an authenticating user. The authentication ID is a user defined string (like a pre-shared key) which is stored in file on the client-side. -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:advanced:x2gobroker:howitworks
by wiki-admin＠x2go.org 28 Mar '13

28 Mar '13

A page in your DokuWiki was added or changed. Here are the details: Date : 2013/03/28 10:16 Browser : Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 IP-Address : 46.142.186.224 Hostname : 224-186-142-46.pool.kielnet.net Old Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks?rev=13644… New Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:howitworks Edit Summary: [Authentication] User : sunweaver @@ -5,11 +5,17 @@ This is about how X2Go Client and a generic X2Go Session Broker communicate with each other. This article will quickly become rather technical. ===== Authentication ===== - The X2Go client can use different methods of authentication against an X2Go Session Broker. + X2Go Client in broker mode will authenticate twice. First, it will authenticate against the X2Go Session Broker, second, it will authenticate against one of the servers provided by the broker in form of X2Go session profiles. Dual authentication means: the user has to type his/her username and password twice. - With an HTTP(S) broker it could be //username and password//. With an SSH broker a //SSH key authentication// can also be used. + A gain in usability cerainly is, if one manages to reduce these two authentication requests to one. How this can be achieved will be explained further below. + + ==== Authentication methods against X2Go Session Broker ==== + + In general, X2Go client can use different methods for authentication against an X2Go Session Broker. + + With an HTTP(S) broker it could be //username and password//. With an SSH broker a //SSH key based authentication// is also possible. ===== Extra Security: Pre-shared Authentication ID ===== With both types of broker (HTTP, SSH) you can use an additional parameter "authid" for verifying the trust state of an authenticating user. The authentication ID is a user defined string (like a pre-shared key) which is stored in file on the client-side. -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:advanced:x2gobroker:howitworks
by wiki-admin＠x2go.org 28 Mar '13

28 Mar '13

1 0

page changed: wiki:advanced:x2gobroker:start
by wiki-admin＠x2go.org 28 Mar '13

28 Mar '13

A page in your DokuWiki was added or changed. Here are the details: Date : 2013/03/28 10:12 Browser : Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 IP-Address : 46.142.186.224 Hostname : 224-186-142-46.pool.kielnet.net Old Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:start?rev=1364465480 New Revision: http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:start Edit Summary: [How do I use an X2Go Session Broker with X2Go Client] User : sunweaver @@ -29,12 +29,12 @@ * ''<nowiki>--broker-url=<protocol>://[username@]<host>[:port]/path</nowiki>'': URL of session broker. Protocol is either of "http", "https" or "ssh". You can specify a username in URL. In this case it will be pasted into authorization dialog of X2Go Client. URL examples are: * ''<nowiki>--broker-url=https://x2gobroker.org/cgi-bin/x2gobroker.cgi</nowiki>'' * ''<nowiki>--broker-url=ssh://user@x2gobroker.org:22/usr/lib/x2go/x2gobroker.pl</nowiki>'' - * ''<nowiki>--broker-ssh-key=<path to key></nowiki>'': Path to SSH key to use for authorization against SSH broker. This parameter is only valid with SSH brokers. + * ''<nowiki>--broker-ssh-key=<path to key></nowiki>'': Path to SSH key to use for authentication against SSH broker. This parameter is only valid with SSH brokers. - * ''<nowiki>--broker-autologin</nowiki>'': Use default SSH key or SSH agent for authorization against session broker. This parameter is only valid with SSH brokers. + * ''<nowiki>--broker-autologin</nowiki>'': Use default SSH key or SSH agent for authentication against session broker. This parameter is only valid with SSH brokers. - * ''<nowiki>--broker-noauth</nowiki>'': Do not ask for user credentials during broker authorization. This can be useful if you are using an HTTP(S) broker without authentication.\\ If you run an HTTP(S) server without authentication, but with user-specific profiles, then put the username into the broker URL (see above). The username then will be taken from the broker URL and be sent to the session broker. This option is only valid with HTTP(S) brokers. + * ''<nowiki>--broker-noauth</nowiki>'': Do not ask for user credentials during broker authentication. This can be useful if you are using an HTTP(S) broker without authentication.\\ If you run an HTTP(S) server without authentication, but with user-specific profiles, then put the username into the broker URL (see above). The username then will be taken from the broker URL and be sent to the session broker. This option is only valid with HTTP(S) brokers. -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

← Newer
1
...
4
5
6
7
8
9
10
...
103
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

x2go-commits March 2013