x2go-dev April 2015

x2go-dev@lists.x2go.org

27 participants
157 discussions

Bug#835: X2Go issue (in src:x2gobroker) has been marked as pending for release
by Mike Gabriel 02 Apr '15

02 Apr '15

tag #835 pending fixed #835 0.0.3.0 thanks Hello, X2Go issue #835 (src:x2gobroker) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=7f0f216 The issue will most likely be fixed in src:x2gobroker (0.0.3.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 7f0f216383f8729306a685693b58d473e41d216b Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Thu Apr 2 16:02:44 2015 +0200 x2gobroker-ssh: When agent query mode is set to LOCAL, Execute x2gobroker-agent via sudo as group "X2GOBROKER_DAEMON_GROUP". (Fixes: #835). diff --git a/debian/changelog b/debian/changelog index 3d4759e..88e28c5 100644 --- a/debian/changelog +++ b/debian/changelog @@ -312,6 +312,9 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low auto-detect the client-side DPI value and use that for the X2Go session. (Fixes: #834). - Add run-optional-script support to SSH broker. + - x2gobroker-ssh: When agent query mode is set to LOCAL, Execute + x2gobroker-agent via sudo as group "X2GOBROKER_DAEMON_GROUP". (Fixes: + #835). * debian/control: + Provide separate bin:package for SSH brokerage: x2gobroker-ssh. + Replace LDAP support with session brokerage support in LONG_DESCRIPTION.

2 1

Bug#835: x2gobroker-ssh: cannot execute x2gobroker-agent if agent-query-mode is set to LOCAL
by Mike Gabriel 02 Apr '15

02 Apr '15

Package: x2gobroker-ssh Severity: important Version: 0.0.3.0-preview x2gobroker-ssh cannot execute x2gobroker-agent if agent-query-mode is set to LOCAL. Reason: /usr/bin/x2gobroker-ssh is installed with these permissions: -r-sr-x--- 1 x2gobroker <x2gobroker-users> 6168 Apr 1 06:24 /usr/bin/x2gobroker-ssh That means: only users that are members of the POSIX group <x2gobroker-users> (in Debian/Ubuntu, this is configurable via DebConf) can launch a fully featured X2Go Session Broker instance via SSH brokerage. A user that is member of group <x2gobroker-users> launches x2gobroker-ssh and the process permissions are these: real uid: <uidNumber-of-the-user> real gid: <gidNumber-if-the-user> effective uid: x2gobroker effective gid: <gidNumber-if-the-user> So, the setuid flag on /usr/bin/x2gobroker-ssh changes the effective user ID, but not the effective group ID. If agent-query-mode is set to LOCAL, x2gobroker-ssh directly calls /usr/lib/x2go/x2gobroker-agent (via subprocess.Popen) and fails, because of insufficient priveleges: -rwsr-x--- 1 root x2gobroker 6168 Apr 2 06:39 /usr/lib/x2go/x2gobroker-agent Only users that are members of POSIX group "x2gobroker" can launch the x2gobroker-agent script (and gain root priveleges). In a sane environment, no user is member of this group (except the user "x2gobroker"). Solution: --------- (root@medoc) {~} # cat /etc/sudoers.d/x2gobroker-ssh # Allow members of group x2gobroker-users to execute any /usr/lib/x2go/x2gobroker-agent %x2gobroker-users ALL=(:x2gobroker) /usr/lib/x2go/x2gobroker-agent If the user launching x2gobroker-ssh is member of the group <x2gobroker-users>, then the LOCAL query to the x2gobroker-agent is run via sudo. If the evoking user is not a member of the <x2gobroker-users> group, then no sudo gets used (e.g. for executing the x2gobroker-agent via agent-query-mode SSH or via agent-query-mode through the http broker implementation. A patch is in prep and should be committed soon. Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

Bug#834: X2Go issue (in src:x2gobroker) has been marked as pending for release
by Mike Gabriel 02 Apr '15

02 Apr '15

tag #834 pending fixed #834 0.0.3.0 thanks Hello, X2Go issue #834 (src:x2gobroker) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=04a9982 The issue will most likely be fixed in src:x2gobroker (0.0.3.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 04a9982c4a16cdb22a7465930d95461658576993 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Thu Apr 2 06:18:09 2015 +0200 Don't hard-define session DPI value. This allows X2Go Client to auto-detect the client-side DPI value and use that for the X2Go session. (Fixes: #834). diff --git a/debian/changelog b/debian/changelog index b826a6d..ced1bd8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -308,6 +308,9 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low delayed executions of broker agent tasks. This assures that SSH pub keys are removed via the delauthkey broker agent task, if the SSH broker is used. (Fixes: #491). + - Don't hard-define session DPI value. This allows X2Go Client to + auto-detect the client-side DPI value and use that for the X2Go session. + (Fixes: #834). * debian/control: + Provide separate bin:package for SSH brokerage: x2gobroker-ssh. + Replace LDAP support with session brokerage support in LONG_DESCRIPTION.

2 1

Bug#491: X2Go issue (in src:x2gobroker) has been marked as pending for release
by Mike Gabriel 02 Apr '15

02 Apr '15

tag #491 pending fixed #491 0.0.3.0 thanks Hello, X2Go issue #491 (src:x2gobroker) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=f74b487 The issue will most likely be fixed in src:x2gobroker (0.0.3.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit f74b48714caedc16767d543c104e14ed5195aa85 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Thu Apr 2 06:11:59 2015 +0200 agent.py: Use os.fork() instead of threading.Thread() to handle delayed executions of broker agent tasks. This assures that SSH pub keys are removed via the delauthkey broker agent task, if the SSH broker is used. (Fixes: #491). diff --git a/debian/changelog b/debian/changelog index 37715fb..b826a6d 100644 --- a/debian/changelog +++ b/debian/changelog @@ -304,6 +304,10 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low further possible substitutions for deriving the full path of the authorized_keys file where X2Go Broker Agent's deploys public SSH user keys to. (Fixes: #665). + - agent.py: Use os.fork() instead of threading.Thread() to handle + delayed executions of broker agent tasks. This assures that SSH pub keys + are removed via the delauthkey broker agent task, if the SSH broker + is used. (Fixes: #491). * debian/control: + Provide separate bin:package for SSH brokerage: x2gobroker-ssh. + Replace LDAP support with session brokerage support in LONG_DESCRIPTION.

2 1

Bug#834: defaults.py X2GOBROKER_SESSIONPROFILE_DEFAULTS dpi prevents client from using autodetected dpi
by Jason Alavaliant 01 Apr '15

01 Apr '15

Package: python-x2gobroker Version: 0.0.2.3 Tags: patch It was noted by my users that their x2go sessions started via the broker always got the default dpi setting of 96 instead of the dpi value native to their machine. Tracing through the code as far as I can see the problem is that if the /etc/x2go/broker/x2gobroker-sessionprofiles.conf file doesn't have a dpi= setting defined in it the default one is provided by the value in the /usr/lib/python2.7/dist-packages/x2gobroker/defaults.py file under X2GOBROKER_SESSIONPROFILE_DEFAULTS that's not ideal since it stops the client from supplying it's autodetected one which matches the actual dpi on the user's machine. I'd suggest updating the /usr/lib/python2.7/dist-packages/x2gobroker/defaults.py file to remove the line "u'dpi': 96," from the X2GOBROKER_SESSIONPROFILE_DEFAULTS section (as per the attached patch). In my testing with that default value gone (assuming that setdpi=1 is set); * If a dpi=num value is set in x2gobroker-sessionprofiles.conf (which is the default provided in the sample config file), then that sessionprofile set dpi value is used by the session. * If there is no dpi=num value set in x2gobroker-sessionprofiles.conf then that the x2goclient provides it's own value which is either the autodetected value matching the dpi of the machine that is being connected from or the client falls back to it's default value which is also 96 So as far is I can see in default cases having that default value removed shouldn't change behavior and it would allow people optionally configure their sessionprofiles to have no dpi value set so broker sessions would be free to use the native dpi value provided by the client (which doesn't seem to be possible currently due to the default overriding the client providing it's own value). Thanks Jason

1 0

Bug#665: security improvement for x2gobroker
by Stefan Baur 01 Apr '15

01 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Package: x2gobroker Severity: wishlist Feature Request: Save temporary x2goclient_authorized_key to a tmpfs to ensure safe removal/destruction of file in case of system crash. Note: This may require a SELINUX config change. (Bug filed on behalf of Mike#1) - -- BAUR-ITCS UG (haftungsbeschränkt) Geschäftsführer: Stefan Baur Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364 Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJUXAhaAAoJEG7d9BjNvlEZZFQH/i/gq1/GdTwjw+VRk1Ufev1B abje8Q4zV6gnMjeBAj2panHr8l6xfTBU8Xhi7qQ9XxBrPY3TRpnI/L5dMD/Sfrrp /cb3Cq8D9mFKdi+C7o+hbRy7OJCiTXacPvV2Z/sJlS+0IhuaFQYDGtVKCzpYCn/+ R4bCmmSwEujVUIg++4/KT2I4W01SWKYhvK80QFc3ZXQlRv+NfHBkOKpxBiEO7XZD 0LXmNTQVznPPBLzSEjYeCcz5Jn2rkX5zAaItneJ31iJxib3VkN2LR9V0F/iFgq7o JGBuqI3lXBtkzs1gxdYZR9LR5w+6JRiC/8cuoBAPzUOdbq8XvT2M3M8bacFSGI8= =iCAu -----END PGP SIGNATURE-----

2 1

Bug#665: X2Go issue (in src:x2gobroker) has been marked as pending for release
by Mike Gabriel 01 Apr '15

01 Apr '15

tag #665 pending fixed #665 0.0.3.0 thanks Hello, X2Go issue #665 (src:x2gobroker) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=80b1acb The issue will most likely be fixed in src:x2gobroker (0.0.3.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 80b1acb82639467ff85737cdfc5500535ad92afc Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Apr 1 16:51:49 2015 +0200 x2gobroker-agent.pl: Add %U (uidNumber) and %G (primary gidNumber) as further possible substitutions for deriving the full path to X2Go Broker Agent's public SSH key deployment. (Fixes: #665). diff --git a/debian/changelog b/debian/changelog index 0f5d81f..215d700 100644 --- a/debian/changelog +++ b/debian/changelog @@ -300,6 +300,9 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low load-balanced server farm is unavailable. - x2gobroker-pubkeyauthorizer: Handle replacement of SSH pubkeys with wrong/ old SSH options. + - x2gobroker-agent.pl: Add %U (uidNumber) and %G (primary gidNumber) as + further possible substitutions for deriving the full path to X2Go Broker + Agent's public SSH key deployment. (Fixes: #665). * debian/control: + Provide separate bin:package for SSH brokerage: x2gobroker-ssh. + Replace LDAP support with session brokerage support in LONG_DESCRIPTION.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev April 2015