x2go-dev

x2go-dev@lists.x2go.org

5399 discussions

Bug#835: x2gobroker-ssh: cannot execute x2gobroker-agent if agent-query-mode is set to LOCAL
by Mike Gabriel 02 Apr '15

02 Apr '15

Package: x2gobroker-ssh Severity: important Version: 0.0.3.0-preview x2gobroker-ssh cannot execute x2gobroker-agent if agent-query-mode is set to LOCAL. Reason: /usr/bin/x2gobroker-ssh is installed with these permissions: -r-sr-x--- 1 x2gobroker <x2gobroker-users> 6168 Apr 1 06:24 /usr/bin/x2gobroker-ssh That means: only users that are members of the POSIX group <x2gobroker-users> (in Debian/Ubuntu, this is configurable via DebConf) can launch a fully featured X2Go Session Broker instance via SSH brokerage. A user that is member of group <x2gobroker-users> launches x2gobroker-ssh and the process permissions are these: real uid: <uidNumber-of-the-user> real gid: <gidNumber-if-the-user> effective uid: x2gobroker effective gid: <gidNumber-if-the-user> So, the setuid flag on /usr/bin/x2gobroker-ssh changes the effective user ID, but not the effective group ID. If agent-query-mode is set to LOCAL, x2gobroker-ssh directly calls /usr/lib/x2go/x2gobroker-agent (via subprocess.Popen) and fails, because of insufficient priveleges: -rwsr-x--- 1 root x2gobroker 6168 Apr 2 06:39 /usr/lib/x2go/x2gobroker-agent Only users that are members of POSIX group "x2gobroker" can launch the x2gobroker-agent script (and gain root priveleges). In a sane environment, no user is member of this group (except the user "x2gobroker"). Solution: --------- (root@medoc) {~} # cat /etc/sudoers.d/x2gobroker-ssh # Allow members of group x2gobroker-users to execute any /usr/lib/x2go/x2gobroker-agent %x2gobroker-users ALL=(:x2gobroker) /usr/lib/x2go/x2gobroker-agent If the user launching x2gobroker-ssh is member of the group <x2gobroker-users>, then the LOCAL query to the x2gobroker-agent is run via sudo. If the evoking user is not a member of the <x2gobroker-users> group, then no sudo gets used (e.g. for executing the x2gobroker-agent via agent-query-mode SSH or via agent-query-mode through the http broker implementation. A patch is in prep and should be committed soon. Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

Bug#834: X2Go issue (in src:x2gobroker) has been marked as pending for release
by Mike Gabriel 02 Apr '15

02 Apr '15

tag #834 pending fixed #834 0.0.3.0 thanks Hello, X2Go issue #834 (src:x2gobroker) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=04a9982 The issue will most likely be fixed in src:x2gobroker (0.0.3.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 04a9982c4a16cdb22a7465930d95461658576993 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Thu Apr 2 06:18:09 2015 +0200 Don't hard-define session DPI value. This allows X2Go Client to auto-detect the client-side DPI value and use that for the X2Go session. (Fixes: #834). diff --git a/debian/changelog b/debian/changelog index b826a6d..ced1bd8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -308,6 +308,9 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low delayed executions of broker agent tasks. This assures that SSH pub keys are removed via the delauthkey broker agent task, if the SSH broker is used. (Fixes: #491). + - Don't hard-define session DPI value. This allows X2Go Client to + auto-detect the client-side DPI value and use that for the X2Go session. + (Fixes: #834). * debian/control: + Provide separate bin:package for SSH brokerage: x2gobroker-ssh. + Replace LDAP support with session brokerage support in LONG_DESCRIPTION.

2 1

Bug#491: X2Go issue (in src:x2gobroker) has been marked as pending for release
by Mike Gabriel 02 Apr '15

02 Apr '15

tag #491 pending fixed #491 0.0.3.0 thanks Hello, X2Go issue #491 (src:x2gobroker) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=f74b487 The issue will most likely be fixed in src:x2gobroker (0.0.3.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit f74b48714caedc16767d543c104e14ed5195aa85 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Thu Apr 2 06:11:59 2015 +0200 agent.py: Use os.fork() instead of threading.Thread() to handle delayed executions of broker agent tasks. This assures that SSH pub keys are removed via the delauthkey broker agent task, if the SSH broker is used. (Fixes: #491). diff --git a/debian/changelog b/debian/changelog index 37715fb..b826a6d 100644 --- a/debian/changelog +++ b/debian/changelog @@ -304,6 +304,10 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low further possible substitutions for deriving the full path of the authorized_keys file where X2Go Broker Agent's deploys public SSH user keys to. (Fixes: #665). + - agent.py: Use os.fork() instead of threading.Thread() to handle + delayed executions of broker agent tasks. This assures that SSH pub keys + are removed via the delauthkey broker agent task, if the SSH broker + is used. (Fixes: #491). * debian/control: + Provide separate bin:package for SSH brokerage: x2gobroker-ssh. + Replace LDAP support with session brokerage support in LONG_DESCRIPTION.

2 1

Bug#834: defaults.py X2GOBROKER_SESSIONPROFILE_DEFAULTS dpi prevents client from using autodetected dpi
by Jason Alavaliant 01 Apr '15

01 Apr '15

Package: python-x2gobroker Version: 0.0.2.3 Tags: patch It was noted by my users that their x2go sessions started via the broker always got the default dpi setting of 96 instead of the dpi value native to their machine. Tracing through the code as far as I can see the problem is that if the /etc/x2go/broker/x2gobroker-sessionprofiles.conf file doesn't have a dpi= setting defined in it the default one is provided by the value in the /usr/lib/python2.7/dist-packages/x2gobroker/defaults.py file under X2GOBROKER_SESSIONPROFILE_DEFAULTS that's not ideal since it stops the client from supplying it's autodetected one which matches the actual dpi on the user's machine. I'd suggest updating the /usr/lib/python2.7/dist-packages/x2gobroker/defaults.py file to remove the line "u'dpi': 96," from the X2GOBROKER_SESSIONPROFILE_DEFAULTS section (as per the attached patch). In my testing with that default value gone (assuming that setdpi=1 is set); * If a dpi=num value is set in x2gobroker-sessionprofiles.conf (which is the default provided in the sample config file), then that sessionprofile set dpi value is used by the session. * If there is no dpi=num value set in x2gobroker-sessionprofiles.conf then that the x2goclient provides it's own value which is either the autodetected value matching the dpi of the machine that is being connected from or the client falls back to it's default value which is also 96 So as far is I can see in default cases having that default value removed shouldn't change behavior and it would allow people optionally configure their sessionprofiles to have no dpi value set so broker sessions would be free to use the native dpi value provided by the client (which doesn't seem to be possible currently due to the default overriding the client providing it's own value). Thanks Jason

1 0

Bug#665: security improvement for x2gobroker
by Stefan Baur 01 Apr '15

01 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Package: x2gobroker Severity: wishlist Feature Request: Save temporary x2goclient_authorized_key to a tmpfs to ensure safe removal/destruction of file in case of system crash. Note: This may require a SELINUX config change. (Bug filed on behalf of Mike#1) - -- BAUR-ITCS UG (haftungsbeschränkt) Geschäftsführer: Stefan Baur Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364 Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJUXAhaAAoJEG7d9BjNvlEZZFQH/i/gq1/GdTwjw+VRk1Ufev1B abje8Q4zV6gnMjeBAj2panHr8l6xfTBU8Xhi7qQ9XxBrPY3TRpnI/L5dMD/Sfrrp /cb3Cq8D9mFKdi+C7o+hbRy7OJCiTXacPvV2Z/sJlS+0IhuaFQYDGtVKCzpYCn/+ R4bCmmSwEujVUIg++4/KT2I4W01SWKYhvK80QFc3ZXQlRv+NfHBkOKpxBiEO7XZD 0LXmNTQVznPPBLzSEjYeCcz5Jn2rkX5zAaItneJ31iJxib3VkN2LR9V0F/iFgq7o JGBuqI3lXBtkzs1gxdYZR9LR5w+6JRiC/8cuoBAPzUOdbq8XvT2M3M8bacFSGI8= =iCAu -----END PGP SIGNATURE-----

2 1

Bug#665: X2Go issue (in src:x2gobroker) has been marked as pending for release
by Mike Gabriel 01 Apr '15

01 Apr '15

tag #665 pending fixed #665 0.0.3.0 thanks Hello, X2Go issue #665 (src:x2gobroker) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=80b1acb The issue will most likely be fixed in src:x2gobroker (0.0.3.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 80b1acb82639467ff85737cdfc5500535ad92afc Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Apr 1 16:51:49 2015 +0200 x2gobroker-agent.pl: Add %U (uidNumber) and %G (primary gidNumber) as further possible substitutions for deriving the full path to X2Go Broker Agent's public SSH key deployment. (Fixes: #665). diff --git a/debian/changelog b/debian/changelog index 0f5d81f..215d700 100644 --- a/debian/changelog +++ b/debian/changelog @@ -300,6 +300,9 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low load-balanced server farm is unavailable. - x2gobroker-pubkeyauthorizer: Handle replacement of SSH pubkeys with wrong/ old SSH options. + - x2gobroker-agent.pl: Add %U (uidNumber) and %G (primary gidNumber) as + further possible substitutions for deriving the full path to X2Go Broker + Agent's public SSH key deployment. (Fixes: #665). * debian/control: + Provide separate bin:package for SSH brokerage: x2gobroker-ssh. + Replace LDAP support with session brokerage support in LONG_DESCRIPTION.

2 1

FYI: I updated the Fedora Rawhide mock files onjenkins
by Michael DePaulo 31 Mar '15

31 Mar '15

On Japsand, which Jenkins builds on, I updated the mock files (/etc/mock/*.cfg) for Fedora Rawhide to their mock 1.2.7-1 versions: https://apps.fedoraproject.org/packages/mock/changelog/ One of the differences is that the rawhide RPMs now have "fc23" instead of "fc22" in their names. I started rebuilding the Rawhide packages through the Jenkins WebGUI. I intend to finish doing so tonight. -Mike#2

2 6

Bug#829: Further information
by Florian Wicke - Hetzner Online AG 31 Mar '15

31 Mar '15

As Ionic stated in IRC adding -nopersistent to x2goagent.options stops the shortkey ctrl+alt+r from suspending the session after switching the resize-mode But by adding this option i am no longer able to suspend my session even with the 'x2gosuspend-session'-command -- Kind regards Florian Wicke Hetzner Online AG Industriestr. 25 91710 Gunzenhausen / Germany Tel: +49 9831 505-0 Fax: +49 9831 505-3 florian.wicke(a)hetzner.de www.hetzner.com Register Court: Registergericht Ansbach, HRB 3204 Management Board: Dipl. Ing. (FH) Martin Hetzner Chairwoman of the Supervisory Board: Diana Rothhan

1 0

Bug#686: X2Go issue (in src:x2gobroker) has been marked as pending for release
by Mike Gabriel 31 Mar '15

31 Mar '15

tag #686 pending fixed #686 0.0.3.0 thanks Hello, X2Go issue #686 (src:x2gobroker) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=f7e9e1e The issue will most likely be fixed in src:x2gobroker (0.0.3.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit f7e9e1edf659473e4917d6c0649c6a432fb73c3d Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Tue Mar 31 06:04:25 2015 +0200 add closure for #686 diff --git a/debian/changelog b/debian/changelog index d13ad72..df87b67 100644 --- a/debian/changelog +++ b/debian/changelog @@ -233,7 +233,7 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low - Makefile: Add installation rules for x2gobroker-loadchecker. - x2gobroker.1: Since systemd there are not only init scripts. Rephrasing man page. - - New feature: x2gobroker-loadchecker daemon. + - New feature: x2gobroker-loadchecker daemon. (Fixes: #686). - x2gobroker-agent.pl: Use var name server_usage instead of server_load. Reflects better what that var denotes. - agent.py: Completion of several __doc__ strings (missing @return:,

2 1

Bug#685: X2Go issue (in src:x2gobroker) has been marked as pending for release
by Mike Gabriel 31 Mar '15

31 Mar '15

tag #685 pending fixed #685 0.0.3.0 thanks Hello, X2Go issue #685 (src:x2gobroker) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=7b98c05 The issue will most likely be fixed in src:x2gobroker (0.0.3.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 7b98c0514eaae794ce5880f86bab12f3a2bf9766 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Tue Mar 31 06:00:59 2015 +0200 Provide x2gobroker system user public keys to broker agents with SSH options--strongly restricting the key usage--now. Modify x2gobroker- pubkeyauthorizer in a way that it replaces non-option keys with the newly provided optionized/restricted pubkeys. (Fixes: #685). diff --git a/debian/changelog b/debian/changelog index a0640e5..d13ad72 100644 --- a/debian/changelog +++ b/debian/changelog @@ -285,6 +285,10 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low hand-back the system's hostname to X2Go Client / Python X2Go. - Add security notice / disclaimer to x2gbroker.1 man page as suggested by Stefan Baur. (Fixes: #666). + - Provide x2gobroker system user public keys to broker agents with SSH + options--strongly restricting the key usage--now. Modify x2gobroker- + pubkeyauthorizer in a way that it replaces non-option keys with the + newly provided optionized/restricted pubkeys. (Fixes: #685). * debian/control: + Provide separate bin:package for SSH brokerage: x2gobroker-ssh. + Replace LDAP support with session brokerage support in LONG_DESCRIPTION.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev