x2go-dev

x2go-dev@lists.x2go.org

2 participants
5403 discussions

Bug#261: Wokring on 12.04
by tjohnson＠lic.co.nz 12 Jul '13

12 Jul '13

I have been able to get around the issue with keyboard lockups by running the server on ubuntu 12.04 instead of 10.04. Most likely an issue with the particular install of 10.04 so I'm happy to close this bug. loving x2go Tom Johnson Research Programmer Private Bag 3016 (Cnr Ruakura & Morrinsville Roads, Newstead) Hamilton 3240 NEW ZEALAND Ph: 07 856 6897 Mobile: 022 089 6874 Web: www.lic.co.nz P Please consider the environment before you print this e-mail

1 0

Bug#139: Update?
by Gross, Christopher W. (Chris) 10 Jul '13

10 Jul '13

This app has not been updated since March and this is a fairly glaring bug (especially since sessions seem to auto-terminate fairly regularly, so re-logging is necessary, but painful when you have to keep restarting the client) that is probably fairly simple to fix. Can you please provide an update regarding whether or not this will be released sometime soon? [The Ohio State University] Chris Gross Web Design & Development Specialist Marketing, Communication & Training, Office of the Chief Information Officer 464 Baker Systems Engineering, 1971 Neil Ave, Columbus, OH 43210 614-688-3911 Office gross.364(a)osu.edu<mailto:gross.364@osu.edu> ocio.osu.edu<http://ocio.osu.edu>

1 0

Bug#258: Bug#258: Bug#258: Bug#258: SECURITY: x2goclient allows clipboard sniffing
by Christoph Anton Mitterer 03 Jul '13

03 Jul '13

On Tue, 2013-07-02 at 18:07 +0200, Alexander Wuerstlein wrote: > Well, in that aspect, VNC, RDP and x2go/NX are somewhat different. VNC and RDP > basically started from some dumb kind of framebuffer and keyboard/mouse event > forwarding. I knew (at least the VNC / RDP part)... and I started to realise the difference from NX ;) > X11 has a far larger amount of functionality and a huge system of > extensions on top. Sure... > x2go/NX starts out from X11 and changes some aspects, > pruning things that are slow or unnecessary (e.g. synchronous calls or > uncompressed bitmaps). So while with VNC/RDP you have a very simple starting > point from which you then can add some extensions like clipboards, with > X11/x2go/NX you have everything and need to throw away stuff that might be bad. > People are still in the process of figuring out the bad stuff, and generally its > the far more hazardous direction of development. That's the problem... at least security wise... I mean it's no wonder that no sane person uses ssh -X on other hosts (especially untrusted ones)... the X protocol is so complex especially with all extensions.. and the typical attacks like global event grabbing or a "screen man in the middle attack" where a new full screen window tricks you into something evil... are probably just the simplest ideas of attacking. > > This includes that users don't expect (or at least they shouldn't have > > to) that such connections allow wiretapping, e.g. if such a system > > supports audio forwarding... it shouldn't allow the remote side to > > activate my MIC and listen to what I say/sing/etc. > Well, if you switch on audio forwarding in RDP, the other side can do exactly > that... Sure... but at least you can turn it of (unfortunately many programs don't do so by default, neither do they warn you what switching it on means. > > That this can indeed lead to compromise showed a recent attack we've > > had on one our institutes' machines, where sensitive information was > > caught via an X2go connection and later on used for other attacks. > Do you have any more in-depth writeup of that attack so we maybe can learn from > it and look at certain things more specifically? Well the problem is that I'm not really allowed to give much defaults (as you can see I also write from my private address)... Simply said... an attacker took over root on the remote system... and it seems he did just such sniffing stuff... :/ > > Now for the technical side... admittedly I don't know the details of > > how NX interacts with X... but there must be some way to achieve > > blocking of the clipboard sync. > > Even if the protocol demands to send some content,... well then simply > > hook in an clear it always (per default). > > Yes, that should be possible. Its just that someone has to implement it. AFAIU, one would need to do that on the nxproxy level then? > > Now with NX I understand it's compression at the X protocol level, so > > "no JPEGs being transferred"... but where do remotes X protocol go to? > > Directly into the local X? Or is it taken by NX/X2go and rendered as > > if NX/X2go would be an X server that is displayed in a _single_ > > window of another one (i.e. like Xephyr)? > Some protocol calls are taken as is and passed to the local X, others are > "transformed", e.g. made asynchronous, bitmap-compressed, etc. I see... > Well, the remote can't take over your system afaik. But there are concerns > about the security of ssh -X vs. -Y. Keystroke monitoring is one of those > concerns. Why don't you do the following: Not passing on any X stuff to the local X server... but staring an Xephyr server and sending it there? Admittedly I don't really know how the Xephyr server itself does things (I once tried to ask the developers but got no reply)... and if that would really work like a sandbox ... At least my hope would be (as it was before with VNC/RDP/NX)... that any evil remote... could at least only take over the one single window... and in case of Xephyr... hopefully only the single Xephyr window. First thanks for your answers... I'd propose the following now: As this bug is now cluttered all over with two different issues - clipboard sniffing and the warning when it was activated - security measures and better documentation about what NX/X2go really does I'd close this bug, and open two new ones, one for each issue... referencing that old bug... so that all topics can be discussed (perhaps fixed) in a more simple fashion. Okay? Cheers, Chris.

2 1

Bug#258: SECURITY: x2goclient allows clipboard sniffing
by Christoph Anton Mitterer 02 Jul '13

02 Jul '13

Package: x2goclient Severity: grave Tags: security Hi. From: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=714588 It seems that per default (and I even found no way to disable it) x2goclient (and perhaps other related tools?) transmit the content of the clipboard to the remote host. As this may easily contain passwords or other sensitive information, this is a extremely critical hole. Cheers, Chris.

3 7

x2go plugin for windows
by Dario Zarama 02 Jul '13

02 Jul '13

Good Evening I'm Conducting a setup project of an operating system for the cloud and I have few questions to let them to you 1- There is a version for windows x2go plugin? 2- If there is, as I can get it? thanks, Dario Fernando Zarama.

3 2

Load balancing X2Go with X2Go Session Broker
by Mike Gabriel 02 Jul '13

02 Jul '13

Hi all, I have started a (still quite rough) page explaining how load balancing with X2Go can be set up. http://wiki.x2go.org/doku.php/wiki:advanced:x2gobroker:loadbalancing Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

Bug#255: X2Go issue (in src:x2goclient) has been marked as pending for release
by xypron.glpk＠gmx.de 01 Jul '13

01 Jul '13

Hello Mike +override_dh_strip: + dh_strip --dbg-package=x2goclient-dbg implies debug symbols for all packaged built. I guess additonal parameter -p x2goclient is needed. But this needs to be checked. Best regards Heinrich Schuchardt http://www.xypron.de Am 01.07.13 um 02:14 schrieb Mike Gabriel > tag #255 pending > > fixed #255 4.0.1.1 > > thanks > > > > Hello, > > > > X2Go issue #255 (src:x2goclient) reported by you has been > > fixed in X2Go Git. You can see the changelog below, and you can > > check the diff of the fix at: > > > > http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=2f8cdb2 > > > > The issue will most likely be fixed in src:x2goclient (4.0.1.1). > > > > light+love > > X2Go Git Admin (on behalf of the sender of this mail) > > > > --- > > commit 2f8cdb2dd5778cdd8104c6427c25167f7c0c3bf9 > > Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> > > Date: Mon Jul 1 02:13:33 2013 +0200 > > > > Provide bin:package with debug symbols for X2Go Client. (Fixes: #255). > > > > diff --git a/debian/changelog b/debian/changelog > > index 0ca8369..dd7122b 100644 > > --- a/debian/changelog > > +++ b/debian/changelog > > @@ -30,6 +30,7 @@ x2goclient (4.0.1.1-0~x2go1) UNRELEASED; urgency=low > > just calling free(). Required under MS Windows as documented in libssh2 > > API. (Fixes: #243). (For further details see: > > http://api.libssh.org/master/group__libssh__session.html) > > + * Provide bin:package with debug symbols for X2Go Client. (Fixes: #255). > > > > [ Ezra Bühler ] > > * New upstream version (4.0.1.1):

2 1

build x2GoServer for mandriva 2010.0
by carlos andres perez lopez 01 Jul '13

01 Jul '13

Hi all, i'm following this guide http://wiki.x2go.org/doku.php/wiki:development:build-howto-linux:x2goserver to compile and install x2goServer in mandriva 2010.0, the all dependences i compile and install, when i try to install nx-libraries I used the package full ( http://code.x2go.org/releases/source/nx-libs/) and install but when i do the 12 point, Install x2goserver from git, when i do make command i see this message make[1]: Entering directory `/home/carlinchis/x2goserver/x2goserver-common' mkdir -p .build_man2html/html for man_page in `cd man && find * -type f`; do mkdir -p `dirname .build_man2html/html/$man_page`; done for man_page in `cd man && find * -type f`; do man2html man/$man_page > .build_man2html/html/$man_page.html; done and the make command not stop but noting happend, the comand wait someting, but noting happend. I follow the same guide in a opensuse 12.2 and i have the same problem Can any helpme? if i don't have one package, or other topic. Thanks P.D: Sorry for my English i speak Spanish. Carlos Perez. -- todo se puede mi warrior C.A.P.L

3 7

Bug#255: X2Go issue (in src:x2goclient) has been marked as pending for release
by Mike Gabriel 01 Jul '13

01 Jul '13

tag #255 pending fixed #255 4.0.1.1 thanks Hello, X2Go issue #255 (src:x2goclient) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=2f8cdb2 The issue will most likely be fixed in src:x2goclient (4.0.1.1). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 2f8cdb2dd5778cdd8104c6427c25167f7c0c3bf9 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Mon Jul 1 02:13:33 2013 +0200 Provide bin:package with debug symbols for X2Go Client. (Fixes: #255). diff --git a/debian/changelog b/debian/changelog index 0ca8369..dd7122b 100644 --- a/debian/changelog +++ b/debian/changelog @@ -30,6 +30,7 @@ x2goclient (4.0.1.1-0~x2go1) UNRELEASED; urgency=low just calling free(). Required under MS Windows as documented in libssh2 API. (Fixes: #243). (For further details see: http://api.libssh.org/master/group__libssh__session.html) + * Provide bin:package with debug symbols for X2Go Client. (Fixes: #255). [ Ezra Bühler ] * New upstream version (4.0.1.1):

2 1

Bug#257: Make X2Go Server systemd aware
by Mike Gabriel 30 Jun '13

30 Jun '13

Package: x2goserver Severity: wishlist X2Go Sessions should control session and seat information in systemd if the systemd init system is in use. Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976148 GnuPG Key ID 0x25771B13 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev