Package: x2goclient Severity: important Version: 4.0.4.0

If brokerage with autologin is in use (a very common broker setup),
the current client<->broker communication design in X2Go Client is
that the broker creates a SSH pubkey/privkey pair and transmits the
private key to the client.

Never should we transmit private key files over the wire!!!

The X2Go Session Broker is already able to accept pubkey files from
the client side and deploy those pubkeys appropriately. In Python
X2Go, this is already used.

X2Go Client should switch here: create pubkey/privkey pair on
client-side, push the pubkey to the broker and have it temporarily
deployed from there to the X2Go Server where the next session login is
scheduled by the broker.

Mike

DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xf...