x2go-commits

x2go-commits@lists.x2go.org

1 participants
37910 discussions

python-x2go.git - build-main (branch) updated: 0.4.0.8-3-gc69719a
by git-admin＠x2go.org 08 Jan '14

08 Jan '14

The branch, build-main has been updated via c69719a3dd52d73fc18d48805b8fa3451d2b9212 (commit) from 19da038a1e697321203f2aaf9ac5138270ea296b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: debian/changelog | 3 +++ x2go/backends/control/_stdout.py | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) The diff of changes is: diff --git a/debian/changelog b/debian/changelog index 1302c02..0d84279 100644 --- a/debian/changelog +++ b/debian/changelog @@ -3,6 +3,9 @@ python-x2go (0.4.0.9-0~x2go1) UNRELEASED; urgency=low * New upstream version (0.4.0.9): - Agent channels in Paramiko can raise an EOFError if the connection has got disrupted. Ignoring this. + - Store the session password in base64 encoded string in order to make + it harder spotting the long term stored (for the duration of the session) + plain text password. -- Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Wed, 07 Aug 2013 12:18:46 +0200 diff --git a/x2go/backends/control/_stdout.py b/x2go/backends/control/_stdout.py index 292c50b..7b73759 100644 --- a/x2go/backends/control/_stdout.py +++ b/x2go/backends/control/_stdout.py @@ -37,6 +37,7 @@ import re import locale import threading import cStringIO +import base64 from gevent import socket @@ -404,7 +405,7 @@ class X2GoControlSessionSTDOUT(paramiko.SSHClient): timer.start() try: self.logger("executing command on X2Go server ,,%s'': %s" % (self.profile_name, _rerewrite_blanks(cmd)), loglevel=loglevel) - _retval = self.exec_command(_rewrite_password(cmd, user=self.get_transport().get_username(), password=self._session_password), **kwargs) + _retval = self.exec_command(_rewrite_password(cmd, user=self.get_transport().get_username(), password=base64.b64decode(self._session_password)), **kwargs) except AttributeError: self.session_died = True self._transport_lock.release() @@ -935,7 +936,7 @@ class X2GoControlSessionSTDOUT(paramiko.SSHClient): # mark Paramiko/SSH transport as X2GoControlSession ssh_transport._x2go_session_marker = True - self._session_password = password + self._session_password = base64.b64encode(password) if ssh_transport is not None: self.session_died = False hooks/post-receive -- python-x2go.git (Python X2Go Client API) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "python-x2go.git" (Python X2Go Client API).

1 0

python-x2go.git - build-main (branch) updated: 0.4.0.8-4-g8a48422
by git-admin＠x2go.org 08 Jan '14

08 Jan '14

The branch, build-main has been updated via 8a48422fa568620d612901dcd064275122b794e0 (commit) from c69719a3dd52d73fc18d48805b8fa3451d2b9212 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: debian/changelog | 1 + x2go/backends/control/_stdout.py | 55 +++++++++++++++++++++++++++++++------- 2 files changed, 46 insertions(+), 10 deletions(-) The diff of changes is: diff --git a/debian/changelog b/debian/changelog index 0d84279..6dfa5f8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -6,6 +6,7 @@ python-x2go (0.4.0.9-0~x2go1) UNRELEASED; urgency=low - Store the session password in base64 encoded string in order to make it harder spotting the long term stored (for the duration of the session) plain text password. + - Support encryption passphrases on SSH private key files. -- Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Wed, 07 Aug 2013 12:18:46 +0200 diff --git a/x2go/backends/control/_stdout.py b/x2go/backends/control/_stdout.py index 7b73759..648b72e 100644 --- a/x2go/backends/control/_stdout.py +++ b/x2go/backends/control/_stdout.py @@ -857,14 +857,41 @@ class X2GoControlSessionSTDOUT(paramiko.SSHClient): elif (key_filename and os.path.exists(os.path.normpath(key_filename))) or pkey: self.logger('trying SSH pub/priv key authentication with server', loglevel=log.loglevel_DEBUG) paramiko.SSHClient.connect(self, _hostname, port=port, username=username, pkey=pkey, - key_filename=key_filename, timeout=timeout, allow_agent=allow_agent, + key_filename=key_filename, timeout=timeout, allow_agent=False, look_for_keys=look_for_keys) else: self.logger('trying SSH key discovery or agent authentication with server', loglevel=log.loglevel_DEBUG) + paramiko.SSHClient.connect(self, _hostname, port=port, username=username, pkey=None, + key_filename=None, timeout=timeout, allow_agent=allow_agent, + look_for_keys=look_for_keys) + + # since Paramiko 1.7.7.1 there is compression available, let's use it if present... + t = self.get_transport() + if x2go._paramiko.PARAMIKO_FEATURE['use-compression']: + t.use_compression(compress=True) + # enable keep alive callbacks + t.set_keepalive(5) + + except paramiko.PasswordRequiredException, e: + self.close() + if password: + self.logger('unlock SSH private key file with provided password', loglevel=log.loglevel_INFO) + try: - paramiko.SSHClient.connect(self, _hostname, port=port, username=username, pkey=None, - key_filename=None, timeout=timeout, allow_agent=allow_agent, - look_for_keys=look_for_keys) + if (key_filename and os.path.exists(os.path.normpath(key_filename))) or pkey: + self.logger('re-trying SSH pub/priv key authentication with server', loglevel=log.loglevel_DEBUG) + paramiko.SSHClient.connect(self, _hostname, port=port, username=username, pkey=pkey, password=password, + key_filename=key_filename, timeout=timeout, allow_agent=False, + look_for_keys=look_for_keys) + else: + self.logger('re-trying SSH key discovery or agent authentication with server', loglevel=log.loglevel_DEBUG) + paramiko.SSHClient.connect(self, _hostname, port=port, username=username, pkey=None, password=password, + key_filename=None, timeout=timeout, allow_agent=allow_agent, + look_for_keys=look_for_keys) + except paramiko.AuthenticationException: + # the provided password cannot be used to unlock any private SSH key file (i.e. wrong password) + raise paramiko.PasswordRequiredException(str(e)) + except paramiko.SSHException, e: if str(e) == 'No authentication methods available': raise paramiko.AuthenticationException('Interactive password authentication required!') @@ -874,12 +901,11 @@ class X2GoControlSessionSTDOUT(paramiko.SSHClient): self.sshproxy_session.stop_thread() raise(e) - # since Paramiko 1.7.7.1 there is compression available, let's use it if present... - t = self.get_transport() - if x2go._paramiko.PARAMIKO_FEATURE['use-compression']: - t.use_compression(compress=True) - # enable keep alive callbacks - t.set_keepalive(5) + else: + self.close() + if self.sshproxy_session: + self.sshproxy_session.stop_thread() + raise(e) except paramiko.AuthenticationException, e: self.close() @@ -899,6 +925,15 @@ class X2GoControlSessionSTDOUT(paramiko.SSHClient): self.sshproxy_session.stop_thread() raise(e) + except paramiko.SSHException, e: + if str(e) == 'No authentication methods available': + raise paramiko.AuthenticationException('Interactive password authentication required!') + else: + self.close() + if self.sshproxy_session: + self.sshproxy_session.stop_thread() + raise(e) + except: self.close() if self.sshproxy_session: hooks/post-receive -- python-x2go.git (Python X2Go Client API) This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "python-x2go.git" (Python X2Go Client API).

1 0

page changed: wiki:security:start
by wiki-admin＠x2go.org 08 Jan '14

08 Jan '14

A page in your DokuWiki was added or changed. Here are the details: Date : 2014/01/08 10:20 Browser : Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 Iceweasel/26.0 IP-Address : 134.245.252.114 Hostname : listrac.informatik.uni-kiel.de Old Revision: http://wiki.x2go.org/doku.php/wiki:security:start?rev=1389176404 New Revision: http://wiki.x2go.org/doku.php/wiki:security:start Edit Summary: [SQLite] User : sunweaver @@ -8,9 +8,9 @@ ==== SQLite ==== - * In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. + * In X2Go Server versions prior to 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. ====== X2Go client-side Printing ====== -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:security:start
by wiki-admin＠x2go.org 08 Jan '14

08 Jan '14

A page in your DokuWiki was added or changed. Here are the details: Date : 2014/01/08 10:20 Browser : Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 Iceweasel/26.0 IP-Address : 134.245.252.114 Hostname : listrac.informatik.uni-kiel.de Old Revision: http://wiki.x2go.org/doku.php/wiki:security:start?rev=1389176365 New Revision: http://wiki.x2go.org/doku.php/wiki:security:start Edit Summary: [PostgreSQL] User : sunweaver @@ -3,9 +3,9 @@ ===== Session Database Backends ===== ==== PostgreSQL ==== - * In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. + * In X2Go Server versions prior to 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. ==== SQLite ==== -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:security:start
by wiki-admin＠x2go.org 08 Jan '14

08 Jan '14

A page in your DokuWiki was added or changed. Here are the details: Date : 2014/01/08 10:19 Browser : Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 Iceweasel/26.0 IP-Address : 134.245.252.114 Hostname : listrac.informatik.uni-kiel.de Old Revision: http://wiki.x2go.org/doku.php/wiki:security:start?rev=1389176358 New Revision: http://wiki.x2go.org/doku.php/wiki:security:start Edit Summary: [PostgreSQL] User : sunweaver @@ -3,9 +3,9 @@ ===== Session Database Backends ===== ==== PostgreSQL ==== - * In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. + * In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. ==== SQLite ==== -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:security:start
by wiki-admin＠x2go.org 08 Jan '14

08 Jan '14

A page in your DokuWiki was added or changed. Here are the details: Date : 2014/01/08 10:19 Browser : Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 Iceweasel/26.0 IP-Address : 134.245.252.114 Hostname : listrac.informatik.uni-kiel.de Old Revision: http://wiki.x2go.org/doku.php/wiki:security:start?rev=1389176347 New Revision: http://wiki.x2go.org/doku.php/wiki:security:start Edit Summary: User : sunweaver @@ -3,9 +3,9 @@ ===== Session Database Backends ===== ==== PostgreSQL ==== - * In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit] that got reported and fixed around X-mas 2013. + * In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. ==== SQLite ==== -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:security:start
by wiki-admin＠x2go.org 08 Jan '14

08 Jan '14

A page in your DokuWiki was added or changed. Here are the details: Date : 2014/01/08 10:19 Browser : Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 Iceweasel/26.0 IP-Address : 134.245.252.114 Hostname : listrac.informatik.uni-kiel.de Old Revision: http://wiki.x2go.org/doku.php/wiki:security:start?rev=1389176333 New Revision: http://wiki.x2go.org/doku.php/wiki:security:start Edit Summary: [PostgreSQL] User : sunweaver @@ -1,9 +1,12 @@ ~~NOTOC~~ ====== Thoughts on Security ====== ===== Session Database Backends ===== ==== PostgreSQL ==== - <note>No known exploits</note> + + + * In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit] that got reported and fixed around X-mas 2013. + ==== SQLite ==== * In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:security:start
by wiki-admin＠x2go.org 08 Jan '14

08 Jan '14

A page in your DokuWiki was added or changed. Here are the details: Date : 2014/01/08 10:18 Browser : Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 Iceweasel/26.0 IP-Address : 134.245.252.114 Hostname : listrac.informatik.uni-kiel.de Old Revision: http://wiki.x2go.org/doku.php/wiki:security:start?rev=1389176316 New Revision: http://wiki.x2go.org/doku.php/wiki:security:start Edit Summary: [SQLite] User : sunweaver @@ -5,9 +5,9 @@ <note>No known exploits</note> ==== SQLite ==== - In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. + * In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. ====== X2Go client-side Printing ====== -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:security:start
by wiki-admin＠x2go.org 08 Jan '14

08 Jan '14

A page in your DokuWiki was added or changed. Here are the details: Date : 2014/01/08 10:18 Browser : Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 Iceweasel/26.0 IP-Address : 134.245.252.114 Hostname : listrac.informatik.uni-kiel.de Old Revision: http://wiki.x2go.org/doku.php/wiki:security:start?rev=1389176306 New Revision: http://wiki.x2go.org/doku.php/wiki:security:start Edit Summary: User : sunweaver @@ -5,9 +5,9 @@ <note>No known exploits</note> ==== SQLite ==== - In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit] that got reported and fixed around X-mas 2013. + In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013. ====== X2Go client-side Printing ====== -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

page changed: wiki:security:start
by wiki-admin＠x2go.org 08 Jan '14

08 Jan '14

A page in your DokuWiki was added or changed. Here are the details: Date : 2014/01/08 10:18 Browser : Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 Iceweasel/26.0 IP-Address : 134.245.252.114 Hostname : listrac.informatik.uni-kiel.de Old Revision: http://wiki.x2go.org/doku.php/wiki:security:start?rev=1387314710 New Revision: http://wiki.x2go.org/doku.php/wiki:security:start Edit Summary: [SQLite] User : sunweaver @@ -4,9 +4,11 @@ ==== PostgreSQL ==== <note>No known exploits</note> ==== SQLite ==== - <note>No known exploits</note> + + In versions of X2Go Server less than 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit] that got reported and fixed around X-mas 2013. + ====== X2Go client-side Printing ====== <note important>Might be exploited if someone becomes x2goprint-user</note> -- This mail was generated by DokuWiki at http://wiki.x2go.org/

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

x2go-commits