- x2go-dev - X2Go ListServ

no "invalid credentials message" during login
by Florian Apolloner 03 Apr '11

03 Apr '11

Hi, if I provide a wrong password I get this error: Connection failed 192.168.1.70: Unable to connect: /home/florian/.x2go/ssh/socaskpass-m17820 Unable to connect: /home/florian/.x2go/ssh/socaskpass-m17820 Unable to connect: /home/florian/.x2go/ssh/socaskpass-m17820 Permission denied, please try again. Unable to connect: /home/florian/.x2go/ssh/socaskpass-m17820 Permission denied, please try again. Unable to connect: /home/florian/.x2go/ssh/socaskpass-m17820 Received disconnect from 192.168.1.70: 2: Too many authentication failures for florian I think it would be nicer if one would get a correct error message saying that user/pwd combo is invalid. Aside from that I can't seem to get ssh key based login to work, any hints for me? System: Ubuntu 10.10 with the packages provided in the debian repo for lenny. Thx, Florian Apolloner

1 0

X2go FF4 / Chrome plugin support?
by Fortier,Vincent [Montreal] 01 Apr '11

01 Apr '11

Hi all, I was wonderring if there where intentions to port the x2go plugin to either FF4 or Chrome. The current FF3 plugin version is incompatible with FF4 even with extensions.checkCompatibility.4.0 set to false. Thnx! - vin

1 0

Re: [X2go-dev] concept for X2go session lock-down to kiosk-mode (was Re: X2go is insecure)
by Dick Kniep 01 Apr '11

01 Apr '11

Hi list, Reading all comments on my stone in the pond I still think it is not really clear what the problem is (and my proposed solution) I do not want to secure the entire server. I only want a door that can be locked. So I allow a user to use the terminal. Okay he is allowed to use the terminal and so he can do anything he likes. No problem. Or I say on the server the user may only use program XYZ. XYZ starts and that is all. If XYZ deletes my system that is Okay by me. The user had access to that program and that is it. This can be enforced by my simple solution. From the client a command is sent, say "Start terminal". Then in the wrapper, the user is matched with the command and if the match exists, the command is allowed and is executed. If not, the request is rejected. Maybe this can be achieved also by apparmor, but it looks to me that apparmor is intended to secure the entire system which is really not what I want. (Or maybe I am mistaken because of lack of knowledge of apparmor) Dick Kniep -----Oorspronkelijk bericht----- Van: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Verzonden: wo 30-03-11 20:22:45 Aan: x2go-dev(a)lists.berlios.de; Dick Kniep <dick.kniep(a)lindix.nl>; Onderwerp: Re: [X2go-dev] concept for X2go session lock-down to kiosk-mode (was Re: X2go is insecure) Hi Dick, On Mi 30 Mär 2011 18:46:49 CEST Dick Kniep wrote: > We have developed the wrapper that does exactly what I describe > here. Currently it is lacking a screen where an authorized user can > change the authorization db, but that will come on short notice. > > I hope it is a little clearer now what the problem is and how it can > be solved. What I have been thinking the last day is that it might be much more generic and by far more effective to use the apparmor tool for this kind of lock-down. However, I have never played with apparmor, only in cases when the rules package maintainers had included in their packages were too strict... Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, dorfstr. 27, 24245 barmissen fon: +49 (4302) 281418, fax: +49 (4302) 281419 GnuPG Key ID 0xB588399B mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

6 6

Re: [X2go-dev] concept for X2go session lock-down to kiosk-mode (was Re: X2go is insecure)
by Dick Kniep 01 Apr '11

01 Apr '11

Hi LIst, I completely agree with you John, it looks like some people understand the need for this and others simply don't see the point (and probably for good reasons). However the problem is more complex than it seems, because to be able to use a wrapper, changes must be implemented in the clients. This is because the client cannot simply say anymore: x2gomount ... ... ... or any other command it needs to execute on the server, but it has to start this command thru the wrapper. So not only do we have to change the client, but also without extra measures we will be incompatible with earlier clients and most definitely older clients will not work with a newer server. That is, IF we implement this as a standard part of the X2go package. We could implement this by adding a package (x2gokiosk?) that alters the ssh config and adds the wrapper. Requirements for this solution are: An api is needed for communications between the server and the client that defines: - Kind of server that is there (x2goserver or x2gokiosk) - Version of the interface - Possibility to retrieve the allowed commands from the server In that case we get the best of both worlds. If one wants the extra security the x2gokiosk package offers, x2gokiosk is installed and there is no problem that older clients cannot connect anymore, because the user has chosen for the extra security. However if a newer client connects to an older server without the x2gokiosk package it should be able to see that there is no secure x2gokiosk on the other side and it should use the old way of connecting. In that case, also an older client with a newer server (no x2gokiosk) will work as expected. Cheers, Dick Kniep -----Oorspronkelijk bericht----- Van: John A. Sullivan III <jsullivan(a)opensourcedevel.com> Verzonden: vr 01-04-11 02:56:09 Aan: x2go-dev(a)lists.berlios.de; Onderwerp: Re: [X2go-dev] concept for X2go session lock-down to kiosk-mode (was Re: X2go is insecure) On Fri, 2011-04-01 at 02:44 +0200, Dick Kniep wrote: > Hi list, > > > > Reading all comments on my stone in the pond I still think it is not > really clear what the problem is (and my proposed solution) > > > I do not want to secure the entire server. I only want a door that can > be locked. So I allow a user to use the terminal. Okay he is allowed > to use the terminal and so he can do anything he likes. No problem. > > > > Or I say on the server the user may only use program XYZ. XYZ starts > and that is all. If XYZ deletes my system that is Okay by me. The user > had access to that program and that is it. > > > > This can be enforced by my simple solution. From the client a command > is sent, say "Start terminal". Then in the wrapper, the user is > matched with the command and if the match exists, the command is > allowed and is executed. If not, the request is rejected. > > > > Maybe this can be achieved also by apparmor, but it looks to me that > apparmor is intended to secure the entire system which is really not > what I want. (Or maybe I am mistaken because of lack of knowledge of > apparmor) <snip> Again I confess that I've not taken a lot of time to digest this issue but, I wonder if the back and forth is cause because for some users, this would be a highly desirable feature whereas, for others, it not only makes no sense but would be a significant obstacle. Can it be built as a configurable option that can be enabled with a setting in x2go.conf (or whatever file we are using for configuration)? - John _______________________________________________ X2go-dev mailing list X2go-dev(a)lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev !DSPAM:4d9522a930777730779061!

1 0

Re: [X2go-dev] concept for X2go session lock-down to kiosk-mode (was Re: X2go is insecure)
by Dick Kniep 30 Mar '11

30 Mar '11

Hi list, First of all sorry for the somewhat provocative way I entered this discussion. Now about the use case we have: We are providing an application over the internet to users. This application should run seamlessly on the desktop of the user. So we do NOT export a complete desktop but only a single application. The users should be able to start this application, but nothing else...... Our users are on the Internet at random places. Some might logon with the nice python client of Mike, some might use an X2go plugin in a browser etc. As the users should only be able to execute our application and nothing more, security should be done at the server and NOT at the client. The way X2go works is that commands defined in the client are sent to the server and executed there. So if a user starts a desktop, the client sends the command to start the desktop to the server and it is executed there. The screen shows throught nx and he can work. From the moment the desktop is running, only the screens, the mouseclicks and keyboard is sent thru the tunnel. Because the user can change the profiles stored in the X2goclient, he could enter any command there and send it to the server. So, what I suggest is that on the server there is a file where the allowed user commands are stored per usergroup (Off-course Unix usergroups can be used here). This is not very complicated, because if the user is allowed to start the shell, this is only checked when the connection is made and not afterwards. This should be sufficient. Example ---------//----------- The group x2gousers on the server is allowed to execute the terminal and kde and a special application (say CVix, our application). So, when the user connects to the server, the server reports to the user, OK, you can start kde, the terminal or CVix. If the user chooses the terminal, then the terminal is started and the user can execute any command allowed for him in the terminal. Now this is a trivial example, because the user is allowed to execute the terminal and can do anything he likes. However if the user is only allowed to execute CVix, there is no way whatsover for him to circumvent this authorization, because the wrapper simply prohibits any command that is not defined in the db. ----------//---------- In the X2go client, commands must be executed on the server to build the session. The number of commands that must be issued by the client is not very high and can be delivered preconfigured with the X2go server in the allowed commands db. We have developed the wrapper that does exactly what I describe here. Currently it is lacking a screen where an authorized user can change the authorization db, but that will come on short notice. I hope it is a little clearer now what the problem is and how it can be solved. Dick Kniep -----Oorspronkelijk bericht----- Van: John A. Sullivan III <jsullivan(a)opensourcedevel.com> Verzonden: wo 30-03-11 11:44:06 Aan: x2go-dev(a)lists.berlios.de; Onderwerp: Re: [X2go-dev] concept for X2go session lock-down to kiosk-mode (was Re: X2go is insecure) On Wed, 2011-03-30 at 10:58 +0200, Erik Auerswald wrote: > Hi, > > On Tue, Mar 29, 2011 at 06:31:07PM +0200, Mike Gabriel wrote: > > On Di 29 Mär 2011 16:55:50 CEST Alexander Wuerstlein wrote: > >> On 11-03-29 15:36, Dick Kniep <dick.kniep(a)lindix.nl> wrote: > > > >> An authorized user running commands over ssh is not a security problem > >> at all. It works as intended. ssh provides shells. > > > > As Reinhard has mentioned in another post: Dicks setup requires a > > complete lock-down-kiosk-mode-kind-of-thing. He wants a user to be able > > to run a small set of commands only (i.e. the rootless applications he > > wants to provide to his customers). From his perspective AFAIK a user > > logged in via SSH is a security issue. May it be so. > > > >>> The $SSH_ORIGINAL_COMMAND contains the original command that the > >>> client wants to execute on the server. This command is checked against > >>> the allowed commands for the user within the wrapper. > >> > >> From the invocation I infer, that the intended language for the > >> wrapper is shellskript. This is extremely dangerous if intended as a > >> security measure like you claim. Also please note that it is very hard > >> to write such wrappers in a secure way, such that stuff like e.g. > >> 'allowed_command foo bar ; evil_command' is not possible. > > > > This is a very worthy remark!!! I also think that it needs quite an > > effort to script such a wrapper (and have it accepted in X2go > > upstream!!!) > > An example for rsync via SSH can be found at: > http://troy.jdmz.net/rsync/index.html > > The validate-rsync script there can be used as a starting point. > > Regards, > Erik I admit I have not thought this issue through thoroughly as I'm under a brutal deadline right now but I would think the problem is that one can use X2Go for application publishing and not just complete desktops. Do we know in advance every possible application one might want to publish via X2Go? If we did (and I can't imagine we would), would we want to identify those via X2Go or some other mechanism built more for the task? My guess is, since we are an application publishing application, we should leave restriction of applications to the sysadmin using the tools already at their disposal. Again, that is only a half baked thought but I think it has some merit - John _______________________________________________ X2go-dev mailing list X2go-dev(a)lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev !DSPAM:4d92fb66203787818312239!

2 1

X2go is insecure
by Dick Kniep 30 Mar '11

30 Mar '11

Hi list, In the past few month, Mike has developed a very nice python client for x2go that caters to our need as a Application service provider. However during that period, we have investigated the security of X2go and it proves that X2go is an insecure product if used in a hostile environment like the Internet. I know many of you are wondering: But we are using ssh, how can that be insecure? Well, as many of you know, one can connect to a server with ssh with a terminal and execute commands on that server, including commands like rm -Rf * or other commands. Even if the shell is disabled, it is still possible to execute any command on the server by using ssh user@server 'command' The problem is caused by the fact that the x2go server does not restrict the commands that can be entered thru ssh. This is bad, but what is worse, is that the X2go clients actually use this security hole to start any command it needs. To make it secure, ssh should be configured to allow only a single command. This wrapper-command effectively checks server side whether a requested command is allowed and started by the proper user. Only if both criteria are met, the command can be executed. So in the configuration of the x2gossh daemon, the following line is added: ForceCommand="x2gowrapper.sh $SSH_ORIGINAL_COMMAND" ssh-rsa The $SSH_ORIGINAL_COMMAND contains the original command that the client wants to execute on the server. This command is checked against the allowed commands for the user within the wrapper. Currently we are developing this wrapper that checks whether a command is allowed. When this is ready, we will make this available to the X2go project. However, acceptance of this solution will only happen if the principle problem is recognized. In pyhoca-gui a distinction can be made between an x2go system user and the end-user that is running the application. This is a good start, but does not solve the problem mentioned above. However if combined with the wrapper it is a real secure solution, as in the wrapper, the system user can only execute a number of x2go commands, while the end-user can only execute another set of commands. Furthermore, the client should be able to request the allowed commands for the end-user from the server and show them. If a user wants to change a profile, he/she should be allowed to choose only from the allowed commands. Also by this method it should be possible to generate the profiles automatically from the data from the server combined with some general parameters (like client-side printing and ways to connect). Therefore the following changes are requested: 1. A seperate instance of the ssh daemon for x2go. 2. A wrapper that is ALWAYS called when connecting to the server by the ssh configuration 3. Separate users for the x2go system calls and the end-user 4. A change to the x2go clients to accomodate this change 5.An api on the server to request the allowed commands 6. Automatic generation of the configuration on the cliënt side. Anyone willing to make a comment, please do so. The overall quality will only increase! Dick Kniep

8 8

Suggestion: Make x2gothinclientsystem less invasive
by Michael Hierweck 25 Mar '11

25 Mar '11

Hi x2go folks, I would like to suggest a solution to make x2gothinclientsystem less invasive. Instead of mounting a ramdisk and removing/symlinking some files and directories (which might be a Debian packaging policy violation) it might be smarter to mount a read only root filesystem and transparently overlay it with a tempfs. I can this be achieved? a) Install aufs modules in the clients' chroot environment. Aufs modules are part of Squeeze's default kernel. b) Add "aufs" to /etc/initramfs-tools/modules. c) Set "BOOT=aufs" in /etc/initramfs-tools/initramfs.conf. d) Add a "magic" script (see attachment) named "aufs" to /etc/initramfs-tools/scripts e) Call update-initramfs -u inside the chroot. The "aufs" script is based on Debian's /usr/share/initramfs-tools/scripts/nfs script. The attached script provides a three layer file root filesystem. ro nfsroot/master (generic thinclients' chroot) ro nfsroot/<ip-address> (individual thinclient's configuration overriding master) rw tempfs (simulates a fully rw root file system) Pros: * simple (to my mind) * flexible * less "hacky" (less/no conflicts with other packages) * therefore more Debian compliant (to my mind) * x2go related stuff currently stored in /ramdisk can go into /var/lib/x2go... Cons: * any? Any feedback is appreciated. Michael -- EDV-Serviceteam Annika & Michael Hierweck GbR Egerstraße 53, 44225 Dortmund (Germany) http://www.edv-serviceteam.net # NFS filesystem mounting -*- shell-script -*- # FIXME This needs error checking retry_nr=0 # parse nfs bootargs and mount nfs do_nfsmount() { configure_networking # get nfs root from dhcp if [ "x${NFSROOT}" = "xauto" ]; then # check if server ip is part of dhcp root-path if [ "${ROOTPATH#*:}" = "${ROOTPATH}" ]; then NFSROOT=${ROOTSERVER}:${ROOTPATH} else NFSROOT=${ROOTPATH} fi # nfsroot=[<server-ip>:]<root-dir>[,<nfs-options>] elif [ -n "${NFSROOT}" ]; then # nfs options are an optional arg if [ "${NFSROOT#*,}" != "${NFSROOT}" ]; then NFSOPTS="-o ${NFSROOT#*,}" fi NFSROOT=${NFSROOT%%,*} if [ "${NFSROOT#*:}" = "$NFSROOT" ]; then NFSROOT=${ROOTSERVER}:${NFSROOT} fi fi if [ -z "${NFSOPTS}" ]; then NFSOPTS="-o retrans=10" fi [ "$quiet" != "y" ] && log_begin_msg "Running /scripts/nfs-premount" run_scripts /scripts/nfs-premount [ "$quiet" != "y" ] && log_end_msg if [ ${readonly} = y ]; then roflag="-o ro" else roflag="-o rw" fi mkdir -p /aufs-root mkdir -p /aufs-conf mkdir -p /aufs-temp nfsmount -o nolock ${roflag} ${NFSOPTS} ${NFSROOT}/master /aufs-root nfsmount -o nolock ${roflag} ${NFSOPTS} ${NFSROOT}/config/${IPV4ADDR} /aufs-conf mount -t tmpfs tmpfs /aufs-temp mount -t aufs -o dirs=/aufs-temp=rw:/aufs-conf=ro:/aufs-root=ro aufs ${rootmnt} } # NFS root mounting mountroot() { [ "$quiet" != "y" ] && log_begin_msg "Running /scripts/nfs-top" run_scripts /scripts/nfs-top [ "$quiet" != "y" ] && log_end_msg modprobe nfs # For DHCP modprobe af_packet wait_for_udev 10 # Default delay is around 180s # FIXME: add usplash_write info if [ -z "${ROOTDELAY}" ]; then delay=180 else delay=${ROOTDELAY} fi # loop until nfsmount succeds while [ ${retry_nr} -lt ${delay} ] && [ ! -e ${rootmnt}${init} ]; do [ ${retry_nr} -gt 0 ] && \ [ "$quiet" != "y" ] && log_begin_msg "Retrying nfs mount" do_nfsmount retry_nr=$(( ${retry_nr} + 1 )) [ ! -e ${rootmnt}${init} ] && /bin/sleep 1 [ ${retry_nr} -gt 0 ] && [ "$quiet" != "y" ] && log_end_msg done [ "$quiet" != "y" ] && log_begin_msg "Running /scripts/nfs-bottom" run_scripts /scripts/nfs-bottom [ "$quiet" != "y" ] && log_end_msg }

3 3

Re: [X2go-dev] [X2go-user] LDAP-Problem: Zertifikateproblem
by Mike Gabriel 23 Mar '11

23 Mar '11

Hi Mike, On Mi 23 Mär 2011 14:21:12 CET wrote: > Yes, I know that LDAP is not absolutely necessary. I am using x2go > already that way. This is to make a test installation for a > presentation of the software with the option of using it for a > company, so LDAP is an option. I would like to use it, but I am not > experienced with LDAP yet myself and the one who is experienced > proposes NX. > Plus one can only gain experiences. Do you want to use the load balancing support of X2go/LDAP? Or do you just want to administrate users in LDAP. For the latter, I personally recommend setting up your LDAP tree manually (there are plenty of howtos in the web for this...). For learning LDAP this should be your way to go. Then make sure you can use LDAP as libnss and pam source for passwd, group, shadow. At last you have to make sure that LDAP users are in the x2gousers group (which can be local or also a group in LDAP). Once you have that, LDAP users can login via X2go. [Once you have such a simple LDAP DIT up and running you might want to start from scratch and set up an LDAP-server that gets administered by GOsa² or CIPUX ;-) ...] If you want to use load balancing with X2go, then this should also be possible manually, but basically that's what the scripts were intended for (they were also intended for easy LDAP-setup, but you can do this manually...). However, to my personal view, the LDAP implementation needs quite some work before the Baikal release and also needs proper documentation of the way LDAP data is used and interpreted... Maybe someone else has experience on LDAP/loadbalancing... Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, dorfstr. 27, 24245 barmissen fon: +49 (4302) 281418, fax: +49 (4302) 281419 GnuPG Key ID 0xB588399B mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 1

Re: [X2go-dev] Bump LDAP / AD / Pulseaudio related login issues
by Robert Schumann 23 Mar '11

23 Mar '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Date: Wed, 23 Mar 2011 09:10:58 -0000 (GMT) > From: "--[ UxBoD ]--" <uxbod(a)splatnix.net> > Robert, > as John has mentioned we use LDAP with AD in our environment. The local/central database holds details pertinent to the session state eg. mounted shares; whereas the authentication is performed against whatever you have configured in PAM. Have you integrated Linux authentication with AD yet ? Phil, thanks for your answer. Yes I have already integrated AD into my Linux boxes. The user is authenticated through winbind. Everything works like expected, all the NX clients and plain SSH - for the login I have to use a scheme like DOMAIN\USER or USER@DOMAIN because we have a multi-trusted domain environment here. I cannot enable "use default domain" in Samba therefore. For plain SSH I can run it like that: ssh 'domain\user'@box and it's working. For x2go no matter if I use "\" or "@", they both seem to result in some trouble (not created folders and links on the box, or if they are created then the "\" is missing and the session ID refers to a non existing folder). Most stuff is called from the client, but when ending the session a perl script on the server fails too, because it cannot find the cmdoutput file IIRC. Cheers Robert - -- |-----------------------------------------------------address-+ | work: jacob-und-wilhelm-grimm-zentrum | geschwister-scholl-str. 1, 10117 berlin | postal: humboldt-universität zu berlin | computer- und medienservice | unter den linden 6 | 10099 berlin |-----------------------------------------------------contact-+ | mail: schumann(a)informatik.hu-berlin.de | icq: 93163687 | xmpp: betulichergutmensch(a)googlemail.com | huchat: schumanr(a)chat.hu-berlin.de | phone: +49(0)30-2093-70133 |-----------------------------------------------------gpg/pgp-+ | key: remembrance.de/gpg/0xA5A5FAA2.asc | fprint: 9220-9732-7390-7A0C-5623-3336-4233-FDF8-A5A5-FAA2 |-------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk2J1yMACgkQQjP9+KWl+qJVJwCeKnpWKu57zfhII8p5Ew/fRDtv NyMAn2NmEqzQPjQGvXU8n85smBJY3d3M =gmmM -----END PGP SIGNATURE-----

1 0

Bump LDAP / AD / Pulseaudio related login issues
by Robert Schumann 23 Mar '11

23 Mar '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Heyho guys, since nobody responded to my mail I sent on the 7th of February I'd like to bring that topic up again. While I'm totally agreeing with you that there are other important problems to solve, I consider the lack of a proper login in bigger networks a major showstopper for your project. It can only be of your interest, that people in a LDAP/AD configuration with usernames like DOMAIN\USER are able to use your services. I pointed out, that it's probably just a few fixes away from a solution. I'm understanding that your test case focusses on local users in some kind of databases, but however... I hardly see this as a "normal environment" in every company or organization which might want to use x2go. Really nobody is using local user databases on some Linux machine for storing user information and accounts except for Bob and Alice maybe. If any of you likes to investigate this issue I can provide an writable x2go server and a domain account to test things out and find fixes for that. Best regards Robert - -- |-----------------------------------------------------address-+ | work: jacob-und-wilhelm-grimm-zentrum | geschwister-scholl-str. 1, 10117 berlin | postal: humboldt-universität zu berlin | computer- und medienservice | unter den linden 6 | 10099 berlin |-----------------------------------------------------contact-+ | mail: schumann(a)informatik.hu-berlin.de | icq: 93163687 | xmpp: betulichergutmensch(a)googlemail.com | huchat: schumanr(a)chat.hu-berlin.de | phone: +49(0)30-2093-70133 |-----------------------------------------------------gpg/pgp-+ | key: remembrance.de/gpg/0xA5A5FAA2.asc | fprint: 9220-9732-7390-7A0C-5623-3336-4233-FDF8-A5A5-FAA2 |-------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk2IjrgACgkQQjP9+KWl+qKvMACcDksNkkhnLmrN5HmjAlcAUE4i GW4An1kDm46a3QIkhYPAZ62sfr+NGjqm =7DSP -----END PGP SIGNATURE-----

4 3

Trinity and X2go
by Mike Gabriel 22 Mar '11

22 Mar '11

Hi x2go-dev, I have just started upgrading my always-as-stable-as-possible-Debian-office-computer to Debian squeeze and installed Trinity (KDE3.5 fork). Not that my personal todo list and probably those of others are not long enough already, but we should definitely add Trinity support to X2go. @John: in one of your postings lately I may remember you mentioning Trinity in relation to X2go. Do you have any patches or a howto for an installation. Basically, I think an adaptation of x2gokdebindings and the x2gostartagent script shouldn't be too difficult... Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, dorfstr. 27, 24245 barmissen fon: +49 (4302) 281418, fax: +49 (4302) 281419 GnuPG Key ID 0xB588399B mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

2 3

Wishlist: x2gofeatures query before session start
by Mike Gabriel 22 Mar '11

22 Mar '11

Hi there, Here is a feature request proposal for the post-Baikal release (Rebun): The handshake on session start should be extended in the following way: o login as user o call a script x2gofeatures (or similar) o this script replies with some file format that states - user may / must not start an X2go session - user may / must not start in rootless/desktop mode - available commands to execute (KDE, TERMINAL, /usr/bin/xterm...) - user may / must not print - user may / must not use audio - ... o the client should obey to this returned list of features o if the user tries to hack some feature that he/she is not allowed to use, the server of course also has to deny this feature (and maybe even the whole session) Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, dorfstr. 27, 24245 barmissen fon: +49 (4302) 281418, fax: +49 (4302) 281419 GnuPG Key ID 0xB588399B mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

5 13

Torn down TCP connections
by --[ UxBoD ]-- 21 Mar '11

21 Mar '11

Hello All, Am facing a problem where the three SSH tcp connections are being torn down. Personally I am using a Cisco router and reflexive ACLs and can see what is happening. I have tried configuring SSHD on the remote server side with the following: TCPKeepAlive no ClientAliveInterval 30 ClientAliveCountMax 3 This appears to have resolved the issue with File&Print but the PulseAudio connection is still being torn down. Have thought about removing the ClientAliveCountMax but why would three attempts fail when I was still connected to my X2go session ? This is so frustrating and cannot believe nobody else has hit it; unless everybody is running it across a LAN ??? -- Thanks, Phil

2 6

Re: [X2go-dev] Wishlist: x2gofeatures query before session start
by Dick Kniep 19 Mar '11

19 Mar '11

Hi Morty, I totally agree with you on this. As a matter of fact we are developing a script that checks serverside whether one is allowed to start a certain command. It uses the normal Linux users and groups and there is also a maintainance option. Within 4 weeks this should be completely finished and I can send you the code together with the patches of the server. As soon as it is ready (and tested) I will send the patch also to Mike and Alex and ask them to incorporate it in the main distribution. But again, it will take some time. Also, in the pyhoca-gui there is a possibility (with some tweeking of the ssh config) to make a connection to the client with a key and after that a logon with a user. Mike has done a wonderful job on that one! Dick Kniep -----Oorspronkelijk bericht----- Van: Moritz Strübe <Moritz.Struebe(a)informatik.uni-erlangen.de> Verzonden: za 19-03-11 19:10:05 Aan: x2go-dev(a)lists.berlios.de; Onderwerp: Re: [X2go-dev] Wishlist: x2gofeatures query before session start Hi Mike, to make this reasonable there must be ways to actually enforce this. Currently a little tweaking of the client will allow you to circumvent any of these rules: Start x2goagent "manually" - the db is only convenience, desktop-mode is client-related only, you can patch the client to start any command you wish, audio is only a matter of setting the right environment variables, etc. Basically x2go is just an optimized x-forwarding. So doing rights-control on this level would be to block the main road and leave the side roads open. While this might be enough for a lot of scenarios it might also let administrators think, that there rules are actually enforced. All in all it would be just as safe as doing all the rights-management in the client.... The right way of doing this, would be to the learn about Linux system administration and use the sufficient tools already provided to you (e.g. ACLs). Everything else creates false feeling of security. Cheers Morty Am 19.03.2011 17:11, Mike Gabriel schrieb: Hi there, Here is a feature request proposal for the post-Baikal release (Rebun): The handshake on session start should be extended in the following way: o login as user o call a script x2gofeatures (or similar) o this script replies with some file format that states - user may / must not start an X2go session - user may / must not start in rootless/desktop mode - available commands to execute (KDE, TERMINAL, /usr/bin/xterm...) - user may / must not print - user may / must not use audio - ... o the client should obey to this returned list of features o if the user tries to hack some feature that he/she is not allowed to use, the server of course also has to deny this feature (and maybe even the whole session) Greets, Mike _______________________________________________ X2go-dev mailing list X2go-dev(a)lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev !DSPAM:4d84f17d19577730779061!

1 0

Questions about the source
by Tyler Jameson Little 19 Mar '11

19 Mar '11

I am developing a way to pipe NX over HTTP (client and NodeJS server module), and I noticed that x2go is a full-featured solution based on NX technology. I already asked about this on the users mailing list and I was directed here by Mike Gabriel. I'll try to not repeat anything that was already answered. Mike informed me that the x2go team is already developing browser plugins, but I wanted a way to integrate a remote session into a browser using pure HTML5 and JavaScript. Anyway, my question has more to do with the underlying NX server source. Has the x2go team significantly modified the base NX server code? If so, where can I get the full source code for the server (not just the scripts)? Mike led me to this website: http://i4git.informatik.uni-erlangen.de/, but I wasn't able to figure out how to clone the repositories. I don't mean to be too forward, especially since I'm new to this list, but has the x2go team considered using a free code sharing site like GitHub? I will mostly want to be looking at where the data gets sent to the client, but I'm not sure where the best place to look for that would be. Thank you so much for your help!

4 6

auth.log grows
by tony.blue.mailinglist＠gmx.de 19 Mar '11

19 Mar '11

Hello Mailinglist, x2goserver-home grows my auth.log-file. Continious I geth the following messages: ... Mar 6 06:40:02 servername sudo: root : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/x2gopgwrapper listsessionsroot servername Mar 6 06:40:29 servername sudo: last message repeated 5 times Mar 6 06:40:29 servername CRON[5578]: pam_unix(cron:session): session closed for user munin Mar 6 06:40:32 servername sudo: root : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/x2gopgwrapper listsessionsroot servername Mar 6 06:41:37 servername sudo: last message repeated 13 times ... My system: ubuntu-server with debian x2go-packages. Thank you! -- NEU: FreePhone - kostenlos mobil telefonieren und surfen! Jetzt informieren: http://www.gmx.net/de/go/freephone

6 6

Re: [X2go-dev] [X2go-user] Question about the source
by Mike Gabriel 19 Mar '11

19 Mar '11

Hi Tyler, I will divert this posting to x2go-dev(a)lists.berlios.de. Please let us continue the discussion there. On Sa 19 Mär 2011 03:24:51 CET Tyler Jameson Little wrote: > I downloaded a copy of the source by using this command: git clone git:// > code.x2go.org/x2goserver.git The site is still under construction. The package has been uploaded for evaluation by two guys from university of Erlangen, Germany. For now, please refer to their Git site for the other packages (x2goagent, nxlibs etc.): http://i4git.informatik.uni-erlangen.de > I want to try to make a module on NodeJS, and I had assumed that I would get > a bunch of source files written in C or C++, but what I got was a bunch of > Perl scripts. > > Is that all the server is? Am I missing something? My goal is to make an > NX server that can run over a simple TCP or HTTP server and I was going to > write a client for display in the browser. The X2go developers are already working on a QtPlugin based browser plugin. Maybe you should take a look at that. Code is included in the x2goclient project: http://i4git.informatik.uni-erlangen.de/x2goclient.git/ > From my research, X2Go is > supposed to be the most fully featured, open source NX implementation out > there. I downloaded the source from NoMachine.com for part of their server > and it was as I expected, a bunch of C and C++ sources. > > With NodeJS, I have a couple of options: > > - Include a C++ module by exporting certain functions > - Write the source in server-side JavaScript > - Use the exec command to execute scripts on the command-line > > > If the server really is that simple, then my project will be a lot less > painful and will take me a lot less time than expected to make work with > NodeJS. If the server really is this simple, how does it compare > performance-wise with the open source version from NoMachine? I want to > possibly have several NX servers piped through a single webserver where each > NX server is running in it's own VM, so efficiency is what I'm after. I am > primarily looking at just running this on Ubuntu, so this package looked > like it was the right one (debian). For Ubuntu there is the development ppa of university of Erlangen: https://launchpad.net/~siretart/+archive/x2go > Any help that any of you could offer would be much appreciated. I'm excited > to start playing with this software!! Don't worry, anything I produce will > be Open Source, regardless of whether I do a complete rewrite. Note that most of components of X2go will become AGPL (http://www.gnu.org/licenses/agpl.html) before the next release (,,Baikal''). Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, dorfstr. 27, 24245 barmissen fon: +49 (4302) 281418, fax: +49 (4302) 281419 GnuPG Key ID 0xB588399B mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

Bug: xmodmap should be set by client
by Moritz Struebe 18 Mar '11

18 Mar '11

Hi there, I just had some trouble with my alt-gr-key. There reason was, that after the update to squeeze the server had a different xmodmap then my client ( http://daniel-lange.com/archives/45-Fixing-FreeNX-NoMachine-NX-keyboard-gli…) . Probably it would be a good idea if the x2go-server-client makes sure the server-Xserver has the same xmodmap as the client-Xserver. Any other Ideas or comments? Cheers Morty -- Dipl.-Ing. Moritz 'Morty' Struebe (Wissenschaftlicher Mitarbeiter) Lehrstuhl für Informatik 4 (Verteilte Systeme und Betriebssysteme) Friedrich-Alexander-Universität Erlangen-Nürnberg Martensstr. 1 91058 Erlangen Tel : +49 9131 85-25419 Fax : +49 9131 85-28732 eMail : struebe(a)informatik.uni-erlangen.de WWW : http://www4.informatik.uni-erlangen.de/~morty

1 0

Connection to localhost
by Manovel 15 Mar '11

15 Mar '11

Hi everybody, I wanted to know what's the status on the problem by connecting to localhost, any news? Thank you, manovel

5 7

vacation
by Heinz-M. Graesing 14 Mar '11

14 Mar '11

hello list members, I just want to inform you that Alex is on vacation this week and I'll be unavailable for the coming next two weeks. After our vacation we'll try to publish a roadmap including the features of the new version. As you all know there have been huge changes made to the planned release so please don't expect the final version in the next 4 weeks. As far as we can tell now, we'll change the licence of our core components (x2goclient, x2goserver) to the AGPL licence. The licence of all used code of other projects will stay untouched of cause. Our wiki is used by more and more people and it will become our main documentation platform. The needed static websites will moved to the blog, so that there will be only two web platforms left (redirections will save the existing links). Regards, Heinz

2 1

libssh and keep alive
by --[ UxBoD ]-- 14 Mar '11

14 Mar '11

Alex/Heinz, with the latest x2go clients using libssh2 have keep alive packets been enabled as according to http://trac.libssh2.org/wiki/KeepAlive they are off by default. I have noticed my sound and spool directory keeps disappearing and wondering whether this is what the cause is. -- Thanks, Phil

1 0

Re: [X2go-dev] x2go on Android ?
by brian mullan 11 Mar '11

11 Mar '11

I think Tablets are going to be a huge opportunity for x2go. Unless the tablet allows some linux to be installed on it to replace Android -or- comes with linux the ability to run an xserver & x2go will be a good Plan B

1 0

x2go on Android ?
by --[ UxBoD ]-- 10 Mar '11

10 Mar '11

Could this be what we have been waiting for ? http://labs.qt.nokia.com/2011/02/28/necessitas/ It very much looks like we could soon develop a version of x2go for running on Android based devices which would be awesome! :) -- Thanks, Phil

4 4

Looking for information on the future of x2go (and some other x2go-related stuff)
by Stefan Baur 03 Mar '11

03 Mar '11

Hi list, I have been "playing" with x2go for a while and it looks very promising - a worthy successor to Nomachine NX - though I am unsure about a few things - maybe someone here on this list could provide some information? My questions are: 1) With the recent announcement of Nomachine going closed source, what does the future of x2go look like? 1a) As far as I understand, x2go uses parts of the GPL'ed Nomachine code, which will remain available in its current state due to the GPL, but will not be maintained by Nomachine any more. Are the x2go developers willing - and able - to maintain this part of the code, in case it requires maintenance and / or security patches? 1b) Or are you going to do a re-write of the Nomachine code currently in use? 1c) FreeNX seems to be a dying project (correct me if I'm wrong), since their lead developer Fabian Franz has left the project (or at least became inactive) quite a while ago - There are no Debian packages available any more, the latest Ubuntu packages are, umm, "flaky", and there hasn't been a new upstream release from the FreeNX team in a few years, unless I'm totally mistaken. From what I found out about x2go, the guy in the lead is Heinz-M. Graesing, who is working full-time as a system administrator and maintaining x2go purely in his spare time (again, correct me if I'm wrong). I would hate to see x2go going the FreeNX route once something happens to Heinz that leaves him unable to maintain the project. So I was wondering if there is a sufficient amount of other people backing the project that the loss of the lead developer (be it due to increased workload at his day job, health issues, or simply loss of interest) can be dealt with, should the situation arise? If that isn't the case right now, I would like to suggest making plans for it asap - the best time to install a fire escape ladder is before the house has a chance to start burning. ;-) 2) I read that Univention is using x2go for their desktop virtualization (see <http://wiki.univention.de/index.php?title=UCS_Desktop_Virtualization_Servic…>). Are they active supporters of x2go (i.e. donating money or manpower to the project)? (I ask because I'm hoping that a company planning a large-scale commerial deployment like Univention seems to be doing would have an interest in the x2go project staying alive and expanding.) 3) I heard of legal issues regarding the project name and some other stuff. That was back in December. Since the project is still named x2go, and Univention is openly using this name, I was wondering if these issues have been resolved? 4) Browsing the list archive, I saw that you are planning to provide packages for sid and wheezy via the official Debian repositories - I understand that it is too late to add packages for squeeze to the official Debian repositories, now that squeeze has been released, but will you provide packages for squeeze via your own repository? Currently it only shows packages for lenny (regarding Debian; I'm aware that you are providing packages for other Debian-based Distros as well). 5) I understand that you need some sort of full-screen application (similar to xdm/kdm/gdm) when running in thin client mode, and that this is why the current x2go client looks the way it looks, but I would really like to see a client that doesn't take up as much screen space, especially on Windows. Would it be possible to add an option for a "smaller" login window, similar to the one used by the current NX client: Provide text entry fields for username and password, and a drop-down list for the session name; when a session name is given on the command line, only show username and password fields; when the session file was stored with a password, directly start the login process? (The reason why I'm asking for this is that I see a use case where x2go is used in rootless mode to allow access to single applications, and the big fullscreen thingie is kind of annoying to the users that are currently used to the NX client.) Regarding question 5, I cannot provide patches myself, as I am not a coder, but I would be willing to make a financial contribution either to the x2go project, if it is possible for them to accept such contributions, or to the coder providing the necessary patches (as long as the price quote seems reasonable and affordable to me) - if that helps motivate you to code. ;-) 6) Is there any way to get sound working (especially in rootless mode, say, for Flash-based websites displayed in a remote Firefox/Iceweasel window) with Debian lenny or squeeze on the server side, and Windows on the client side? I've seen a few messages concerning sound issues in the list archives, but I'm not sure if I made a mistake during my test installation or if there is a general problem and I can stop banging my head against the wall until the developers declare that the issue is fixed. Kind Regards, Stefan Baur PS: I really like the idea of how you deal with printing, as opposed to the Nomachine approach - I had planned to implement something similar before, when I hadn't heard of x2go and was stuck with Nomachine, but failed due to my lack of coding skills and time.

9 49

x2go-home
by Alexander Crössmann 03 Mar '11

03 Mar '11

Hallo, ich bin ein absoluter Neuling hier und hab mir auf Ubuntu 9.10 x2go-home installiert. Leider kann ich mich über den client nicht einloggen. Die Fehlermeldung lautet "The remote proxy closed the connection while negotiating the session. This may be due to the wrong authentication credentials passed to the server.". Ab und zu sehe ich noch das hier " NXPROXY - Version 3.4.0 Copyright (C) 2001, 2007 NoMachine. See http://www.nomachine.com/ for more information. Info: Proxy running in client mode with pid '25163'. Session: Starting session at 'Fri Aug 13 10:29:55 2010'. Info: Connecting to remote host 'localhost:30002'. Info: Connection to remote proxy 'localhost:30002' established. Error: The remote NX proxy closed the connection. Error: Failure negotiating the session in stage '7'. Error: Wrong version or invalid session authentication cookie. Session: Terminating session at 'Fri Aug 13 10:29:56 2010'. Session: Session terminated at 'Fri Aug 13 10:29:56 2010'. NXPROXY - Version 3.4.0 Copyright (C) 2001, 2007 NoMachine. See http://www.nomachine.com/ for more information. Info: Proxy running in client mode with pid '25985'. Session: Starting session at 'Fri Aug 13 10:30:10 2010'. Info: Connecting to remote host 'localhost:30001'. Info: Connection to remote proxy 'localhost:30001' established. " Also host habe ich sowohl 127.0.0.1 als auch localhost probiert. Anmeldename ist mein lokaler Name, der auch in der entsprechenden x2go Gruppe ist. ssh Port ist bei mir nicht 22, das habe ich aber entsprechend eingestellt. Kann mir jemand sagen woran das jetzt noch liegen könnte? Viele Grüße Alex

4 9

PyHoca and the web
by contact＠gmli.fr 03 Mar '11

03 Mar '11

Hi, As you may know, nomachine released the 4th version of NX with web (HTML) support. I was wondering if PyHoca could help to do it… The approach of nomachine is a bit bloated, so I think the best to do could be this : Write a PyHoca-Gui which generates a full HTML rendering of the session. Then the user just has to connect to it. The client and the server could be on the same machine, and the user will connect to the web frontend with his browser like with vlc or transmission. Is that possible ? gml PS. of course no sound (etc), for the moment (maybe with a Java or Flash plugin).

7 12

Browser x2goplugin
by Shanon Loughton 03 Mar '11

03 Mar '11

Hi all This question may have already been asked: 1) Is there a plugin in the works for internet explorer? It mentions it could be possible on http://wiki.x2go.org/x2goplugin Please point me to the thread if already discussed. My second question is 2) Where can I report bugs / tests? The plugin does not register on firefox 4 beta 11 on vista. thanks. Congratulations on such a great piece of software. Shanon

1 0

3.01-18 client and SFTP
by --[ UxBoD ]-- 28 Feb '11

28 Feb '11

Alex, there appears to be a problem with the latest windows build in that the sftp-server.exe processes are not being destroyed once a session has been suspended. I launched a fresh session and checked task manager for which two sftp server processes were present. I then suspended my session, waited 60 seconds, and then resumed the session. Now there were four sftp server processes. Would somebody be able to confirm my findings ? -- Thanks, Phil

1 0

PulseAudio binaries for Windows
by Mike Gabriel 26 Feb '11

26 Feb '11

Hi there, does anyone know about PulseAudio binaries for Windows that are newer than Cendio's PulseAudio 0.9.6 (dates back to 2007)? http://www.cendio.com/pulseaudio/ Currently, I ship those with PyHoca-GUI, but there are some issues: o latest pavucontrol cannot be used with 0.9.6 anymore o pulseaudio.exe 0.9.6 does not work within RDP sessions o I cannot terminate pulseaudio.exe properly on application exit BTW: What version does the x2goclient-qt use? Has anyone ever tried to compile PulseAudio from source on Windows (or for Windows). Any help appreciated... Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, dorfstr. 27, 24245 barmissen fon: +49 (4302) 281418, fax: +49 (4302) 281419 GnuPG Key ID 0xB588399B mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

2 2

Python-X2go printing on Windows
by Mike Gabriel 25 Feb '11

25 Feb '11

Hi Dick, hi x2go-dev list, ----------- Context: Dick Lindix contracted me to make PyHoca-GUI usable for his company software. We are currently testing functionality heavily to get it ready for roll-out in his company. I post this mail to the x2go-dev list as there might be someone who has an opinion and/or idea about the described problem. ----------- I am currently not really happy with the X2goPrintActionPRINT implementation of Python X2go on Windows (print incoming X2go print job directly to a printer). Till now, I have used a win32api ShellExecute call to print the incoming PDF document (that gets posted to the client by x2goprint). The ShellExec API calls the standard app for PDF (Acrobat Reader X on my system), but the Acrobat Reader X (might be an issue of this version only) does not handle the printing well: an empty Acrobat Reader window remains open after the print job has been handed over to the GDI print spooler... What I am currently implementing as first choice printing in Python X2go is usage of gsprint.exe from gsview/Ghostgum. To use this printing method the Ghostscript and the Ghostview application has to be installed on the client. This seems to be the cleaner approach to printing (that is: diverting the Acrobat Reader). However, this means an extra app to be either side-installed next to PyHoca-GUI or to be shipped with PyHoca-GUI itself (which would inflate the setup.exe tremendously...). I am currently still playing with gsprint to see if it really works for PyHoca-GUI, I suppose it will. However, if gsprint is not installed on the client there will always be a fallback to the system's standard PDF app via win32api (that is Acrobat Reader in most cases). However, maybe someone on the list has another idea about PDF Windows printing from a Python environment... Greets + Thanks, Mike -- DAS-NETZWERKTEAM mike gabriel, dorfstr. 27, 24245 barmissen fon: +49 (4302) 281418, fax: +49 (4302) 281419 GnuPG Key ID 0xB588399B mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 1

x2goprint broken with x2goserver-3.0.99 / support for homes mounted via NFS
by Mike Gabriel 24 Feb '11

24 Feb '11

Hi Developers, When using x2goserver 3.0.99 the latest available x2goprint script is broken. The attached patch (a) adds x2godbwrapper to x2goprint (b) allows x2goprint when homes are mounted via NFS (with root_squash or sec=krb5*) Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, dorfstr. 27, 24245 barmissen fon: +49 (4302) 281418, fax: +49 (4302) 281419 GnuPG Key ID 0x1943CA5B mail: m.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

EyeOS
by John A. Sullivan III 23 Feb '11

23 Feb '11

Hello, all. I'd imagine none of us have the time to investigate this but I just took a quick look at EyeOS (http://www.eyeos.org) It is an open source cloud desktop solution. Version 2 was very slow and buggy but version 1 was amazingly fast. It was entirely acceptable to watch streaming video in its web browser. It also seemed to do local redirection for video- although, as I said, viewing video within the desktop had both excellent video and sound. I wonder what they use for a transport mechanism in version 1. It might be something we could investigate as an alternative to NX. It was truly impressive. I'd imagine we could also learn how they do the redirect detection. X2Go is still the product for us as we need the flexibility of running any application, not just those written to run on EyeOS but we might be able to learn quite a bit from their work - John

5 14

Windows client 3.01-18, VcXsrv 1.9.4.1
by John Williams 22 Feb '11

22 Feb '11

I've been using windows client 3.01-13 for a couple months, and it works reasonably well, but I have experienced two consistent problems -- apparently random disappearance of the mouse pointer (fixed by quitting x2go and starting again), and some problems with windows updates, especially with gnome-terminal windows when there is a long scroll job, sometimes the windows do not update (waving the mouse cursor in front of the window usually causes it to update). I decided to test the recent 3.01-18 client and VcXsrv 1.9.4.1. First I just tried 3.01-18 with the built-in xserver. I only tested that for a short time, but one problem I found was that sound was broken. Sound works fine when I go back to 3.01-13, but sound does not work at all with 3.01-18. VLC complains about the ALSA driver and locks-up, adobe flashplayer 64-bit prerelease "square" hangs. Both apparently related to the broken sound. Moving on, I tried 3.01-18 with VcXsrv 1.9.4.1 for a few hours, mostly web browsing. I did not have the cursor disappear, but I did have a couple serious issues. One was when the screen was not redrawn properly when I dragged a Firefox window around. It seemed random -- I was working fine for about an hour, but suddenly when I tried dragging a firefox window, it left trails everywhere, totally munging the screen. I tried dragging other windows around, and even quitting and restarting x2go, but nothing seemed to be able to redraw the screen properly after that. So I started a new session, and that worked for a while, but then it locked up completely, and I had to kill the session. Is any of this behavior known? If not, what can I do to aid in debugging? With the exception of broken sound (which was repeatable), the other problems seemed random.

2 1

Which version of x2go to use for package creation
by Oliver Burger 21 Feb '11

21 Feb '11

Hi there, I'm just about to begin packaging x2go for Mageia. But I'm a bit confused about which versions to take. Is it recommended to stay with the old ones from pool-lenny or are the ones in pool-heuler reasonably stable? Yours, Oliver -- Oliver aka obgr_seneca substitute leader - i18n team substitute leader - web team http://www.mageia.org/ - Mageia, the magic continues

2 1

X2go git improved release-oriented model
by Mike Gabriel 21 Feb '11

21 Feb '11

Hi there, Ok, now here the official mail that shall shortly propose an improved Git project tree for X2go upstream. At http://git.x2go.org you will currently find some X2go project that start with _old_.... and some starting with _new_.... As already mentioned in a former reply to Morty's question about a change going on in X2go upstream Git, here again the ideas behind that changes going on. Please compare the _old_.x2gosomething.git with the _new_.x2gosomething.git repositories: o pristine-tar branch provides tarballs directly from git (i.e. with correct time stamps on the files in the tarball) o /debian folders have been removed o as many of history releases as possible have been imported and tagged and made available in pristine-tar branch o old release versions have not changed, but each X2go project has a ,,first'' Git-based release with a quadruple version number, there will be no ,,-'' in future upstream releases of X2go any more as they pseudo-conflict with package revisions in diverse distributions I am aware of the change in md5sums that will smash Git hashes completely, but as we have not yet announced the X2go Git officially, I personally do not see this as critical, especially when considering the gain of getting as much history into X2go Git as is currently available to me. Best, Mike -- DAS-NETZWERKTEAM mike gabriel, dorfstr. 27, 24245 barmissen fon: +49 (4302) 281418, fax: +49 (4302) 281419 GnuPG Key ID 0xB588399B mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

x2go security Issues
by Moritz Struebe 21 Feb '11

21 Feb '11

Hi, Morning, I am testing PyHoca. One of the problems a came around is, that the client checks whether I am in the x2go group - which I'm not. I also noticed that some other security-checks are done in the client. I believe this is dangerous, because administrators might think that these are real security checks, while they can easily be circumvented. I believe these check must be done server-side. That way they can also easily be adjusted by administrators. Besides that, one of our admins did quite a few security patches to avoid x2gowrapper having to run as root. At the moment this only works for Postgres. None the less I must say that I'm not happy running x2gowrapper, which is easy to exploit using SQL-Injections, as root. It should at least do a "sudo -u x2go" or similar. This user only needs access to the database. That way worst case the db is corrupted and not the whole system. Cheers Morty -- Dipl.-Ing. Moritz 'Morty' Struebe (Wissenschaftlicher Mitarbeiter) Lehrstuhl für Informatik 4 (Verteilte Systeme und Betriebssysteme) Friedrich-Alexander-Universität Erlangen-Nürnberg Martensstr. 1 91058 Erlangen Tel : +49 9131 85-25419 Fax : +49 9131 85-28732 eMail : struebe(a)informatik.uni-erlangen.de WWW : http://www4.informatik.uni-erlangen.de/~morty

7 21

Use case for an x2go user-group
by Moritz Struebe 21 Feb '11

21 Feb '11

Hi there, we already talked to Alex, but maybe it's a good idea to ask a broader audience: Has anybody got an use case where someone who has ssh access is not allowed to start x2go? In short: We want to get rid of the sudo-entry and use suidperl instead. Cheers Morty -- Dipl.-Ing. Moritz 'Morty' Struebe (Wissenschaftlicher Mitarbeiter) Lehrstuhl für Informatik 4 (Verteilte Systeme und Betriebssysteme) Friedrich-Alexander-Universität Erlangen-Nürnberg Martensstr. 1 91058 Erlangen Tel : +49 9131 85-25419 Fax : +49 9131 85-28732 eMail : struebe(a)informatik.uni-erlangen.de WWW : http://www4.informatik.uni-erlangen.de/~morty

7 23

X2Go Client Code Changes
by --[ UxBoD ]-- 18 Feb '11

18 Feb '11

Hello All, We are deep into the x2goclient code at the moment getting it to work better with vcxsrv and have a question around when the X server is started. It would appear that SSH, X and Pulse are all started, on Windows, when the application is initially launched. We can understand why SSH and Pulse are though unsure about X. Was there any technical reason why X could not be launched when a business card was selected and the login credentials entered ? Our thinking was that if it were launched then multiple sessions could be initiated each with there own display ID. We would very much welcome your thoughts on this matter before we spend to much time attempting to make the code changes. -- Thanks, Phil

10 70

x2go with ubuntu/natty
by Reinhard Tartler 17 Feb '11

17 Feb '11

Hi, I've experimented with running x2goserver on ubuntu/natty. I can report success, but the 'default' GNOME session just makes the x2goagent segfault. As a workaround, I can get a proper gnome session by using a 'custom desktop' with the following command line: /usr/bin/gnome-session --session 2d-gnome I find this pretty unobvious, but I can only conclude that ubuntu tries to enable unity and/or graphic effects by default, which in turn causes the mentioned segmentation fault in the x2goagent. How can this be improved in x2go? On a brief code inspection, it seems that the "session command" is determined in x2goclient. However as I suspect that not all distributions and/or gnome installations support the '2d-gnome' session type, this should only happen where necessary. What are your thoughts on this issue? -- Gruesse/greetings, Reinhard Tartler, KeyID 945348A4

2 1

x2go plugin and proxy?
by Milan Knížek 16 Feb '11

16 Feb '11

Hello, are there any plans to introduce connection through http proxy within x2go plugin and/or client? ATM, I create a SSH tunnel (with putty in MS Windows) and set x2go client to connect to locahost at forwarded ports. Regards, Milan -- http://www.milan-knizek.net/

4 5

Dependency based booting in Squeeze
by Paul van der Vlis 16 Feb '11

16 Feb '11

Hello, X2go is for Lenny, but it also runs in Squeeze. A problem is the dependency based booting in Squeeze. When I edit /etc/init.d/x2goserver and replace the first line: #! /bin/sh By these 9 lines: ---------------- #! /bin/sh ### BEGIN INIT INFO # Provides: x2goserver # Required-Start: $remote_fs $syslog # Required-Stop: $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: Start and stop the x2go daemon ### END INIT INFO ------------------ the dependency based booting works fine. (I can enable it, I have not really tested the boot-process). You can enable dependency based booting with: apt-get install insserv dpkg-reconfigure insserv sysv-rc More information: http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot With regards, Paul van der Vlis. -- http://www.vandervlis.nl/

3 3

GPG key server
by Paul van der Vlis 16 Feb '11

16 Feb '11

Hello, In de manual I see this command: gpg --keyserver wwwkeys.eu.pgp.net --recv-keys C509840B96F89133 This GPG keyserver is down for a long time. I found this alternative what works and has the key: gpg --keyserver wwwkeys.stinkfoot.us.pgp.net --recv-keys C509840B96F89133 Met vriendelijke groet, Paul van der Vlis. -- http://www.vandervlis.nl/

3 4

x2go-keyring in GIT
by Mike Gabriel 12 Feb '11

12 Feb '11

HI x2go-dev folks, I have added a package ,,x2go-keyring'' to the X2go Git. I have been using this bit of code (as Debian package) for quite a while to distribute the X2go archive key and the X2go maintainer key(s). http://code.x2go.org/gitweb?p=x2go-keyring.git;a=summary Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, dorfstr. 27, 24245 barmissen fon: +49 (4302) 281418, fax: +49 (4302) 281419 GnuPG Key ID 0xB588399B mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

Smartcard rules
by Moritz Struebe 12 Feb '11

12 Feb '11

Hi, while cleaning up the build environment I cam across the udev rules for the gnupg smart-card reader. I rewrote them, so you only need one file, and not two of them. I don't have a reader, though and would appreciate if someone could have a look at it. If anyone knows of a package doing the same that is ok, too. Cheers Morty -- Dipl.-Ing. Moritz 'Morty' Struebe (Wissenschaftlicher Mitarbeiter) Lehrstuhl für Informatik 4 (Verteilte Systeme und Betriebssysteme) Friedrich-Alexander-Universität Erlangen-Nürnberg Martensstr. 1 91058 Erlangen Tel : +49 9131 85-25419 Fax : +49 9131 85-28732 eMail : struebe(a)informatik.uni-erlangen.de WWW : http://www4.informatik.uni-erlangen.de/~morty

1 0

Re: [X2go-dev] VcXsrv
by Dick Kniep 11 Feb '11

11 Feb '11

Hi List, Solves using VcXsrv in rootless mode also the issues with the clipboard? Using XMing on a windows machine in rootless mode, I have the problem that I cannot cut/paste from the windows session to the x2go session vice/versa Cheers, Dick Kniep Lindix BV tel. 036-5215580 mob. 06-50991858 -----Oorspronkelijk bericht----- Van: John A. Sullivan III <jsullivan(a)opensourcedevel.com> Verzonden: vr 04-02-11 16:12:27 Aan: x2go-dev(a)lists.berlios.de; Onderwerp: Re: [X2go-dev] VcXsrv On Fri, 2011-02-04 at 07:52 +0100, Oleksandr Shneyder wrote: > Am 03.02.2011 20:26, schrieb John A. Sullivan III: > > > Alex, we would actually prefer you do that as we truly are not > > developers. Do you have time for that portion, i.e., not fixing vcxsrv > > but simply changing the X2Go Client code? If, not, we'll take our best > > stab at it. > > Ok, I'll try to make this changes next week (x2goclient using vcxsrv or > custom Xserver). But I can't promise it, I have a lot of work to do. > <snip> Fabulous. And just to make sure they are included in these changes: 1) Adding the clipboard parameter 2) Reading the session settings in Windows thus enabling fullscreen (-fullscreen) and available area (-rootless) which implies: 3) Moving the X Server start to after we have the session information. Thanks very much - John _______________________________________________ X2go-dev mailing list X2go-dev(a)lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev !DSPAM:4d4c175b321867818312239!

4 3

Re: [X2go-dev] re Project Management
by Angela Fuß 10 Feb '11

10 Feb '11

Dear Heinz, Alex, Mike and Moritz, Dear List, the actual message I want to leave here is short - but I think I have to give some explanations first so that my message doesn`t irritate anyone here (probably a rather female way of saying something, we like to explain things lengthy ;-)). The professional background of writing this mail is, that mike and I are working together at a project in which we are setting up (educational) IT-Systems at schools in Kiel. We want to use X2Go for this project and thats why I started reading this list a couple of weeks ago; its also the reason why I am very interested in having X2Go work well. I have no technical IT-backgound, my contribution to and role in our project is to set up and implement a well-performing structure for all the communication that is needed (leading seminars, coaching, mediation, moderation of meetings etc.). The private background is that I am in relationship with mike - that was first, the working together started only a few months ago. One reason why I really enjoy working in an IT-context using Open Source Software is because I am deeply moved and inspired by the social, political and collaborative context in which every step of development is taking place. Thats my context in which I am reading this mailing-list. Now I have just read Mikes last mail and the only thing I want to contribute is: YOU GUYS MUST TALK! The guys I mean with that are Moritz, Alex, Heinz and Mike. As far as I can see the four of you are all giving your best to do a very good job - but you might generate heavy misunderstandings and lots of extra work if your communication at this point of the developing process is taking place "only" via mail and programming. There are very cheap telephone numbers which you can use for conference calls, I could give some of that numbers to Mike. I think it would not take much time to have a conversation on the phone, but it could take a lot of time if you dont talk alltogether about the next steps necessary to take. I am convinced that it would take a lot of stress out of the process, that it would move forward the whole project and that it would bring the freedom back into the space of the mailing list. And, very important: NOTHING IS WRONG - its all development ;-). Angela Zitat von Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de>: > Hi Moritz, > > On Do 27 Jan 2011 18:55:51 CET Moritz Struebe wrote: > >> Hi Heinz, >> >> don't put too much work into it. We already started at >> https://code.launchpad.net/~siretart/+archive/x2go and it's >> probably not worth doing it twice. >> Basically the code is imported from our git-repo ( >> http://i4git.informatik.uni-erlangen.de/ ) and then built on >> launchpad. >> x2goagent gave us some trouble, but we hope it will build tonight. >> The x2go clients are next on our todo-list. That way we should have >> a minimal system up and running soon. At the moment we are only >> building for lenny as this is the plattform we test on. Once >> everything is running there must be a transition from this >> "private" environment to a more open one, of course. But we want >> to be able to walk, before we start running. :) >> >> Cheers >> Morty > > as I understand your current way of handling things you are actually > forking X2go for a university internal project. I am completely > fine with a fork, but the please: > > (a) state it officially as a fork > (b) name the project differently > > My main point is that you do not at all cooperate, discuss next > steps etc. You are just doing your thing. But maybe I missed part > of the discussion (private correspondence?)... > > Complete disapproval of your communication methods, > Mike > > > > > > > -- > > DAS-NETZWERKTEAM > mike gabriel, dorfstr. 27, 24245 barmissen > fon: +49 (4302) 281418, fax: +49 (4302) 281419 > > GnuPG Key ID 0xB588399B > mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de > > freeBusy: > https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x… > -- Angela Fuß Rothenstein 5a 24214 Neudorf-Bornstein mail: angela.fuss(a)das-netzwerkteam.de fon: +49 (4346) 9392844 mobil: +49 (1577) 4197937

6 10

Errors in DOMAIN\Username behaviour / followup to LDAP problems
by Robert Schumann 07 Feb '11

07 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey guys, first of all - thanks a lot for making this software possible, it's definitely the best NX/Linux-Terminal connection software out there atm so please keep up the good work! My report is a followup to messages from mid december concerning LDAP user problems (e.g. with pulseaudio). I am using winbind authentication on an x2goserver so I have to deal with special characters in usernames as well like DOMAIN\username or username@DOMAIN. There's no workaround for that since I'm in a multi-trusted domain environment, no default possible. When I login as a local user e.g. sysop everything works fine (Ubuntu 10.04 x64, latest x2goserver from heuler repo: 3.0.99 and latest client 3.01-17 under Tinycore Linux, log attached). When I login as an winbind user USER\huhs01868030 miscellaneous files and directories are not created. I'm attaching a $ find .x2go for all cases. Among them are: .pulse-client.conf .pulse-cookie cmdoutput keys under ssh/ link to spool directory It seems that there are problems when functions like ssh_scp_push_file() from libssh are called. Log shows they are called with double quotes for parameters (although IMHO it should be better to call them with single quotes - the difference lies in handling escape sequences as they are interpreted with double quotes and left out with single quotes, but that's a guess from me ;). I'm also attaching changes for sshmasterconnection.cpp which solved the problems to a certain degree by escaping the back slashes again before throwing them over to libssh. However spool directory and cmdoutput are still not created but that seems to be server related too. Another code fragment I don't understand and which causes errors in my case is the definition of dst in onmainwindow_part3.cpp on line 899. dst="~"+uname +"/.x2go/ssh"+dst; According to the log this results in x2goclient trying to create keys in "~USER\huhs01868030/.x2go/ssh", which is surely not working. Attached patch works for me with just letting uname out of dst. I can provide more details and tests if you like to see them. Best regards and greetings from Berlin, Robert - -- |-----------------------------------------------------address-+ | work: jacob-und-wilhelm-grimm-zentrum | geschwister-scholl-str. 1, 10117 berlin | postal: humboldt-universität zu berlin | computer- und medienservice | unter den linden 6 | 10099 berlin |-----------------------------------------------------contact-+ | mail: schumann(a)informatik.hu-berlin.de | icq: 93163687 | xmpp: betulichergutmensch(a)googlemail.com | huchat: schumanr(a)chat.hu-berlin.de | phone: +49(0)30-2093-70133 |-----------------------------------------------------gpg/pgp-+ | key: remembrance.de/gpg/0xA5A5FAA2.asc | fprint: 9220-9732-7390-7A0C-5623-3336-4233-FDF8-A5A5-FAA2 |-------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1QU/4ACgkQQjP9+KWl+qKDkQCgkBnQr6GUsA2vC2/hR2inAqhp ip8An0r7bsv9l1YzOLsxGl8EEdzdZZJd =5TYo -----END PGP SIGNATURE-----

1 0

remote proxy closed the connection
by Gerry Reno 06 Feb '11

06 Feb '11

I'm seeing the following errors trying to connect to a new machine running server version 3.0.99 using the browser client: Feb 3 02:20:33 newmachine su[16393]: pam_unix(su:session): session opened for user ubuntu by (uid=0) Feb 3 02:20:33 newmachine sudo: ubuntu : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/touch /root/firstlogin_done Feb 3 02:20:33 newmachine sshd[16319]: Accepted publickey for ubuntu from XXX.XXX.XXX.XXX port 51610 ssh2 Feb 3 02:20:33 newmachine sshd[16319]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0) Feb 3 02:20:33 newmachine sshd[16320]: Accepted publickey for ubuntu from XXX.XXX.XXX.XXX port 51609 ssh2 Feb 3 02:20:33 newmachine sshd[16320]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0) Feb 3 02:20:33 newmachine sshd[16441]: error: bind: Address already in use Feb 3 02:20:33 newmachine sshd[16441]: error: channel_setup_fwd_listener: cannot listen to port: 30008 Feb 3 02:20:33 newmachine sshd[16234]: pam_unix(sshd:session): session closed for user ubuntu Feb 3 02:20:33 newmachine su[16393]: pam_unix(su:session): session closed for user ubuntu Feb 3 02:20:33 newmachine sshd[16524]: error: connect_to localhost port 30007: failed. Feb 3 02:20:33 newmachine sshd[16232]: pam_unix(sshd:session): session closed for user ubuntu Feb 3 02:20:33 newmachine sshd[29561]: channel 2: open failed: connect failed: Connection refused Feb 3 02:20:33 newmachine sudo: ubuntu : TTY=unknown ; PWD=/home/ubuntu ; USER=root ; COMMAND=/usr/bin/touch /root/firstlogin_done Feb 3 02:20:33 newmachine sudo: ubuntu : TTY=unknown ; PWD=/home/ubuntu ; USER=root ; COMMAND=/usr/bin/touch /root/firstlogin_done Feb 3 02:20:33 newmachine sshd[16233]: pam_unix(sshd:session): session closed for user ubuntu The client reports: Resuming Aborting Error message appears: The remote proxy closed the connection while negotiating the session. This may be due to the wrong authentication credentials passed to the server. Finished I ran a check for sessions and there is only one existing session. I've triple-checked the credentials and logged in on command line using them. Regards, Gerry

3 15

x2goserver 3.0.99: cannot terminate session from command line
by Gerry Reno 04 Feb '11

04 Feb '11

I upgraded the server to 3.0.99 and configured postgresql. But when I try to terminate a session from the command line I see these errors: # sudo /usr/bin/x2goterminate-session ubuntu-51-1296672519_stDGNOME_dp24 DBD::Pg::st execute failed: ERROR: permission denied for relation sessions_view at /usr/lib/x2go/x2godbwrapper.pm line 449. Died at /usr/lib/x2go/x2godbwrapper.pm line 449. DBD::Pg::st execute failed: ERROR: permission denied for relation sessions_view at /usr/lib/x2go/x2godbwrapper.pm line 348. Died at /usr/lib/x2go/x2godbwrapper.pm line 348. kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec] DBD::Pg::st execute failed: ERROR: permission denied for relation sessions_view at /usr/lib/x2go/x2godbwrapper.pm line 476. Died at /usr/lib/x2go/x2godbwrapper.pm line 476. What is wrong here? Regards, Gerry

3 3

wayland remote desktop comment by
by brian mullan 03 Feb '11

03 Feb '11

Per Wayland FAQ: Is Wayland network transparent / does it support remote rendering? <http://wayland.freedesktop.org/faq.html#heading_toc_j_8> No, that is outside the scope of Wayland. To support remote rendering you need to define a rendering API, which is something I've been very careful to avoid doing. The reason Wayland is so simple and feasible at all is that I'm sidestepping this big task and pushing it to the clients. It's an interesting challenge, a very big task and it's hard to get right, but essentially orthogonal to what Wayland tries to acheive. This doesn't mean that remote rendering won't be possible with Wayland, it just means that you will have to put a remote rendering server on top of Wayland. One such server could be the X.org server, but other options include an RDP server, a VNC server or somebody could even invent their own new remote rendering model. Which is a feature when you think about it; layering X.org on top of Wayland has very little overhead, but the other types of remote rendering servers no longer requires X.org, and experimenting with new protocols is easier. It is also possible to put a remoting protocol into a wayland compositor, either a standalone remoting compositor or as a part of a full desktop compositor. This will let us forward native Wayland applications. The standalone compositor could let you log into a server and run an application back on your desktop. Building the fowarding into the desktop compositor, could let you export or share a window on the fly with a remote wayland compositor, for example a friends desktop.

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev