x2go-dev July 2013

x2go-dev@lists.x2go.org

23 participants
102 discussions

Bug#261: marked as done (x2go crashing when keyboard is used)
by owner＠bugs.x2go.org 18 Jul '13

18 Jul '13

Your message dated Thu, 18 Jul 2013 11:36:25 +0200 with message-id <20130718113625.18605og81xk4s74p(a)mail.das-netzwerkteam.de> and subject line Re: [X2Go-Dev] Bug#261: Working on 12.04 has caused the X2Go Bug report #261, regarding x2go crashing when keyboard is used to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner(a)bugs.x2go.org immediately.) -- 261: http://bugs.x2go.org/cgi-bin/bugreport.cgi?bug=261 X2Go Bug Tracking System Contact owner(a)bugs.x2go.org with problems

1 0

Bug#245: Duplicate of X2Go issue #231
by Mike Gabriel 18 Jul '13

18 Jul '13

reassign #245 x2goserver close #245 merge #245 #231 thanks This is a duplicate of issue #231 which has already been fixed (in X2Go Server 4.0.1.1). Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

2 1

Bug#259: centos problems
by Timotheus Pokorra 18 Jul '13

18 Jul '13

Just for the record: The workaround described on the associated discussion on the development list https://lists.berlios.de/pipermail/x2go-dev/2013-June/005792.html works for me: mv /usr/libexec/x2go/* /usr/lib64/x2go rm -Rf /usr/libexec/x2go ln -s /usr/lib64/x2go /usr/libexec/x2go service x2gocleansessions start chkconfig x2gocleansessions on Obviously it would be good that the rpm packages would be fixed.

1 0

Bug#261: Wokring on 12.04
by tjohnson＠lic.co.nz 12 Jul '13

12 Jul '13

I have been able to get around the issue with keyboard lockups by running the server on ubuntu 12.04 instead of 10.04. Most likely an issue with the particular install of 10.04 so I'm happy to close this bug. loving x2go Tom Johnson Research Programmer Private Bag 3016 (Cnr Ruakura & Morrinsville Roads, Newstead) Hamilton 3240 NEW ZEALAND Ph: 07 856 6897 Mobile: 022 089 6874 Web: www.lic.co.nz P Please consider the environment before you print this e-mail

1 0

Bug#139: Update?
by Gross, Christopher W. (Chris) 10 Jul '13

10 Jul '13

This app has not been updated since March and this is a fairly glaring bug (especially since sessions seem to auto-terminate fairly regularly, so re-logging is necessary, but painful when you have to keep restarting the client) that is probably fairly simple to fix. Can you please provide an update regarding whether or not this will be released sometime soon? [The Ohio State University] Chris Gross Web Design & Development Specialist Marketing, Communication & Training, Office of the Chief Information Officer 464 Baker Systems Engineering, 1971 Neil Ave, Columbus, OH 43210 614-688-3911 Office gross.364(a)osu.edu<mailto:gross.364@osu.edu> ocio.osu.edu<http://ocio.osu.edu>

1 0

Bug#258: Bug#258: Bug#258: Bug#258: SECURITY: x2goclient allows clipboard sniffing
by Christoph Anton Mitterer 03 Jul '13

03 Jul '13

On Tue, 2013-07-02 at 18:07 +0200, Alexander Wuerstlein wrote: > Well, in that aspect, VNC, RDP and x2go/NX are somewhat different. VNC and RDP > basically started from some dumb kind of framebuffer and keyboard/mouse event > forwarding. I knew (at least the VNC / RDP part)... and I started to realise the difference from NX ;) > X11 has a far larger amount of functionality and a huge system of > extensions on top. Sure... > x2go/NX starts out from X11 and changes some aspects, > pruning things that are slow or unnecessary (e.g. synchronous calls or > uncompressed bitmaps). So while with VNC/RDP you have a very simple starting > point from which you then can add some extensions like clipboards, with > X11/x2go/NX you have everything and need to throw away stuff that might be bad. > People are still in the process of figuring out the bad stuff, and generally its > the far more hazardous direction of development. That's the problem... at least security wise... I mean it's no wonder that no sane person uses ssh -X on other hosts (especially untrusted ones)... the X protocol is so complex especially with all extensions.. and the typical attacks like global event grabbing or a "screen man in the middle attack" where a new full screen window tricks you into something evil... are probably just the simplest ideas of attacking. > > This includes that users don't expect (or at least they shouldn't have > > to) that such connections allow wiretapping, e.g. if such a system > > supports audio forwarding... it shouldn't allow the remote side to > > activate my MIC and listen to what I say/sing/etc. > Well, if you switch on audio forwarding in RDP, the other side can do exactly > that... Sure... but at least you can turn it of (unfortunately many programs don't do so by default, neither do they warn you what switching it on means. > > That this can indeed lead to compromise showed a recent attack we've > > had on one our institutes' machines, where sensitive information was > > caught via an X2go connection and later on used for other attacks. > Do you have any more in-depth writeup of that attack so we maybe can learn from > it and look at certain things more specifically? Well the problem is that I'm not really allowed to give much defaults (as you can see I also write from my private address)... Simply said... an attacker took over root on the remote system... and it seems he did just such sniffing stuff... :/ > > Now for the technical side... admittedly I don't know the details of > > how NX interacts with X... but there must be some way to achieve > > blocking of the clipboard sync. > > Even if the protocol demands to send some content,... well then simply > > hook in an clear it always (per default). > > Yes, that should be possible. Its just that someone has to implement it. AFAIU, one would need to do that on the nxproxy level then? > > Now with NX I understand it's compression at the X protocol level, so > > "no JPEGs being transferred"... but where do remotes X protocol go to? > > Directly into the local X? Or is it taken by NX/X2go and rendered as > > if NX/X2go would be an X server that is displayed in a _single_ > > window of another one (i.e. like Xephyr)? > Some protocol calls are taken as is and passed to the local X, others are > "transformed", e.g. made asynchronous, bitmap-compressed, etc. I see... > Well, the remote can't take over your system afaik. But there are concerns > about the security of ssh -X vs. -Y. Keystroke monitoring is one of those > concerns. Why don't you do the following: Not passing on any X stuff to the local X server... but staring an Xephyr server and sending it there? Admittedly I don't really know how the Xephyr server itself does things (I once tried to ask the developers but got no reply)... and if that would really work like a sandbox ... At least my hope would be (as it was before with VNC/RDP/NX)... that any evil remote... could at least only take over the one single window... and in case of Xephyr... hopefully only the single Xephyr window. First thanks for your answers... I'd propose the following now: As this bug is now cluttered all over with two different issues - clipboard sniffing and the warning when it was activated - security measures and better documentation about what NX/X2go really does I'd close this bug, and open two new ones, one for each issue... referencing that old bug... so that all topics can be discussed (perhaps fixed) in a more simple fashion. Okay? Cheers, Chris.

2 1

Bug#258: SECURITY: x2goclient allows clipboard sniffing
by Christoph Anton Mitterer 02 Jul '13

02 Jul '13

Package: x2goclient Severity: grave Tags: security Hi. From: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=714588 It seems that per default (and I even found no way to disable it) x2goclient (and perhaps other related tools?) transmit the content of the clipboard to the remote host. As this may easily contain passwords or other sensitive information, this is a extremely critical hole. Cheers, Chris.

3 7

x2go plugin for windows
by Dario Zarama 02 Jul '13

02 Jul '13

Good Evening I'm Conducting a setup project of an operating system for the cloud and I have few questions to let them to you 1- There is a version for windows x2go plugin? 2- If there is, as I can get it? thanks, Dario Fernando Zarama.

3 2

Load balancing X2Go with X2Go Session Broker
by Mike Gabriel 02 Jul '13

02 Jul '13

Hi all, I have started a (still quite rough) page explaining how load balancing with X2Go can be set up. http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:loadbalancing Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

Bug#255: X2Go issue (in src:x2goclient) has been marked as pending for release
by xypron.glpk＠gmx.de 01 Jul '13

01 Jul '13

Hello Mike +override_dh_strip: + dh_strip --dbg-package=x2goclient-dbg implies debug symbols for all packaged built. I guess additonal parameter -p x2goclient is needed. But this needs to be checked. Best regards Heinrich Schuchardt http://www.xypron.de Am 01.07.13 um 02:14 schrieb Mike Gabriel > tag #255 pending > > fixed #255 4.0.1.1 > > thanks > > > > Hello, > > > > X2Go issue #255 (src:x2goclient) reported by you has been > > fixed in X2Go Git. You can see the changelog below, and you can > > check the diff of the fix at: > > > > http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=2f8cdb2 > > > > The issue will most likely be fixed in src:x2goclient (4.0.1.1). > > > > light+love > > X2Go Git Admin (on behalf of the sender of this mail) > > > > --- > > commit 2f8cdb2dd5778cdd8104c6427c25167f7c0c3bf9 > > Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> > > Date: Mon Jul 1 02:13:33 2013 +0200 > > > > Provide bin:package with debug symbols for X2Go Client. (Fixes: #255). > > > > diff --git a/debian/changelog b/debian/changelog > > index 0ca8369..dd7122b 100644 > > --- a/debian/changelog > > +++ b/debian/changelog > > @@ -30,6 +30,7 @@ x2goclient (4.0.1.1-0~x2go1) UNRELEASED; urgency=low > > just calling free(). Required under MS Windows as documented in libssh2 > > API. (Fixes: #243). (For further details see: > > http://api.libssh.org/master/group__libssh__session.html) > > + * Provide bin:package with debug symbols for X2Go Client. (Fixes: #255). > > > > [ Ezra Bühler ] > > * New upstream version (4.0.1.1):

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev July 2013