Hi Mike,
using deb http://packages.x2go.org/debian wheezy main as source, apt-get install x2gothinclient gives
The following packages have unmet dependencies: x2gothinclient : Depends: x2goclient (>= 4.0.1.2-0~) but 4.0.1.1-0~x2go1+wheezy~main~427~build1 is to be installed
Is that intentional, having a x2gothinclient in the wheezy repo that requires x2goclient from what I guess is heuler?
-Stefan
Hello all,
there are three new commits in X2Go Client project.
- Support for GSSApi (Kerberos 5) authentication.
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=a77d761dbb16d28206e7...
It works on Linux, Windows (MIT Kerberos) and Mac. Unfortunately stable version of libssh not supporting gssapi yet. X2Go Client using OpenSSH client (ssh, scp) on Mac and Linux for GSSApi authentication. On Windows X2Go Client using CLI tools "plink" and "pscp", which are the part of free and OS project PUTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/)
@Windows developers: please note that X2Go Client Windows build should include plink and pscp binaries, this binaries can be found here: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
As soon as gssapi support will be enabled in stable version of libssh, 3d-party ssh clients will be not used by X2Go Client any more.
- Support for ChallengeResponceAuthentication (Google Authenticator)
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=ac14ad24e7a2d3d3fd08...
It works on Linux, Windows and Mac. The Istruction how to setup your system for 2-step authentication and how to configure Google Authenticator, can be found here: http://www.linux.org/threads/google-authenticator-for-ssh.4590/
- Bug fix for #139 - x2goclient OS X: password input not working on second connect or in broker-mode
http://bugs.x2go.org/cgi-bin/bugreport.cgi?bug=139
commit: http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=c0e8c20c773b36e33094...
The new features are sponsored by IMMOBILIEN SCOUT 24: http://www.immobilienscout24.de
regards, Alex
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
Am 12.12.2013 14:20, schrieb Oleksandr Shneyder:
- Support for GSSApi (Kerberos 5) authentication.
Care to explain what that can be used for, to the non-initiated? :-)
- Support for ChallengeResponceAuthentication (Google Authenticator)
Neat. :) Not something my customers would need, but possibly something I might use for my own, personal setup.
The new features are sponsored by IMMOBILIEN SCOUT 24: http://www.immobilienscout24.de
So that's why & where you've been hiding for the last few months. ;-)
-Stefan
On 13-12-12 14:44, Stefan Baur <newsgroups.mail2@stefanbaur.de> wrote:
Am 12.12.2013 14:20, schrieb Oleksandr Shneyder:
- Support for GSSApi (Kerberos 5) authentication.
Care to explain what that can be used for, to the non-initiated? :-)
Single-Sign-On done right. You log on with your Kerberos password, which creates an ephemeral "ticket" that allows password-less login to other services. Services might be e.g. ssh, but also websites, SMTP/IMAP/POP3 and quite a lot more.
Hypothetical scenario: You log in to your thin client running x2go with your username and password (smartcard would also be possible theoretically). Thats the only time you need to type a password. You then connect to the x2go session broker, authenticated by your ticket, which assigns you to a server. On that server you log in with your ticket. You start a web browser and open your IMAP webclient, authenticated by your ticket wich is forwarded from your thinclient over the ssh/x2go connection to your browser. The IMAP webclient also authenticates via a forwarded ticket to the IMAP server where you read your Email.
Of course this is somewhat hypothetical still because not every piece of software supports ticket forwarding and I'm not sure if x2go already does all that. Also, services like the x2go session broker would have to be extended to support this kind of authentication I guess. But what should generally work is passwordless x2go in places where passwordless ssh already works via Kerberos.
Ciao,
Alexander Wuerstlein.
On Thu, Dec 12, 2013 at 8:20 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
- Support for GSSApi (Kerberos 5) authentication.
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=a77d761dbb16d28206e7...
It works on Linux, Windows (MIT Kerberos) and Mac. Unfortunately stable version of libssh not supporting gssapi yet. X2Go Client using OpenSSH client (ssh, scp) on Mac and Linux for GSSApi authentication. On Windows X2Go Client using CLI tools "plink" and "pscp", which are the part of free and OS project PUTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/)
@Windows developers: please note that X2Go Client Windows build should include plink and pscp binaries, this binaries can be found here: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
As soon as gssapi support will be enabled in stable version of libssh, 3d-party ssh clients will be not used by X2Go Client any more.
Oleksandr,
1st of all, thank you very much for implementing this! As someone with a windows AD domain at home and at work, this feature is extremely useful when it does work.
2nd, as the new windows package maintainer, I uploaded x2goclient-4.0.1.2-pre03 (and x2goclient-4.0.1.2.interims-pre03) with the current plink.exe and pscp.exe (versions 0.63) to the x2go server. Mike Gabriel will most likely make this pre03 version available to publicly download tomorrow (he just went to bed.)
3rd, it appears as if whenever plink has any sort of error, having GSSAPI auth enabled for the session crashes the Windows x2goclient. It took me a bunch of effort to make plink's GSSAPI authentication work, I intend to document this work on the wiki. Note that my setup is a Windows Server 2012 AD domain controller, x2goserver 4.0.1.9 from EPEL running on centos 6.4 64-bit with Samba 3.6's winbind for domain membership, and a Windows 8.1 64-bit domain member client (I also tested the x2goclient on my Windows Server 2012 DC also). But the bottom line is that I expect LOTS of Windows users to run into x2goclient crashes whenever they enable GSSAPI. They can avoid these crashes by disabling GSSAPI for the session (so it's not as severe a problem as bug #109), but I would strongly prefer if you could fix the crashes before we launch 4.0.1.2. If you can't make Windows x2goclient easily fall back to password auth when GSSAPI auth fails, at least give the user a message to disable GSSAPI auth.
-Mike
On Fr 13 Dez 2013 02:25:30 CET, Michael DePaulo wrote:
2nd, as the new windows package maintainer, I uploaded x2goclient-4.0.1.2-pre03 (and x2goclient-4.0.1.2.interims-pre03) with the current plink.exe and pscp.exe (versions 0.63) to the x2go server. Mike Gabriel will most likely make this pre03 version available to publicly download tomorrow (he just went to bed.)
Done [1].
Mike
[1]
http://code.x2go.org/releases/binary-win32/x2goclient/previews/4.0.1.2/x2goc...
--
DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148
GnuPG Key ID 0x25771B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de
freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xf...
Hello Mike,
this patch:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=6f9ead7cf9184799...
should fix the issue.
regards, Alex
Am 13.12.2013 02:25, schrieb Michael DePaulo:
On Thu, Dec 12, 2013 at 8:20 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
- Support for GSSApi (Kerberos 5) authentication.
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=a77d761dbb16d28206e7...
It works on Linux, Windows (MIT Kerberos) and Mac. Unfortunately stable version of libssh not supporting gssapi yet. X2Go Client using OpenSSH client (ssh, scp) on Mac and Linux for GSSApi authentication. On Windows X2Go Client using CLI tools "plink" and "pscp", which are the part of free and OS project PUTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/)
@Windows developers: please note that X2Go Client Windows build should include plink and pscp binaries, this binaries can be found here: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
As soon as gssapi support will be enabled in stable version of libssh, 3d-party ssh clients will be not used by X2Go Client any more.
Oleksandr,
1st of all, thank you very much for implementing this! As someone with a windows AD domain at home and at work, this feature is extremely useful when it does work.
2nd, as the new windows package maintainer, I uploaded x2goclient-4.0.1.2-pre03 (and x2goclient-4.0.1.2.interims-pre03) with the current plink.exe and pscp.exe (versions 0.63) to the x2go server. Mike Gabriel will most likely make this pre03 version available to publicly download tomorrow (he just went to bed.)
3rd, it appears as if whenever plink has any sort of error, having GSSAPI auth enabled for the session crashes the Windows x2goclient. It took me a bunch of effort to make plink's GSSAPI authentication work, I intend to document this work on the wiki. Note that my setup is a Windows Server 2012 AD domain controller, x2goserver 4.0.1.9 from EPEL running on centos 6.4 64-bit with Samba 3.6's winbind for domain membership, and a Windows 8.1 64-bit domain member client (I also tested the x2goclient on my Windows Server 2012 DC also). But the bottom line is that I expect LOTS of Windows users to run into x2goclient crashes whenever they enable GSSAPI. They can avoid these crashes by disabling GSSAPI for the session (so it's not as severe a problem as bug #109), but I would strongly prefer if you could fix the crashes before we launch 4.0.1.2. If you can't make Windows x2goclient easily fall back to password auth when GSSAPI auth fails, at least give the user a message to disable GSSAPI auth.
-Mike
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
On Fri, Dec 13, 2013 at 7:07 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
Hello Mike,
this patch:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=6f9ead7cf9184799...
should fix the issue.
regards, Alex
Hi Alex,
That appears to partially fix the issue.
When I enter an invalid username (e.g. "a"), I get the error message "Check your GSSApi configuration or choose another authentication method". So that's a good improvement.
But if the username field is left blank, the x2goclient still crashes.
regards, -Mike
Also, I should mention that my testing was only done on windows.
And I uploaded pre04 win32 builds based on this commit to the server under /home/x2go/test-of-6f9ead7cf9184799f0b6ae9ff1efd0c7b879d0c6/ , in case you need them or Mike Gabriel decides to post them to the web.
On Fri, Dec 13, 2013 at 8:59 AM, Michael DePaulo <mikedep333@gmail.com> wrote:
On Fri, Dec 13, 2013 at 7:07 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
Hello Mike,
this patch:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=6f9ead7cf9184799...
should fix the issue.
regards, Alex
Hi Alex,
That appears to partially fix the issue.
When I enter an invalid username (e.g. "a"), I get the error message "Check your GSSApi configuration or choose another authentication method". So that's a good improvement.
But if the username field is left blank, the x2goclient still crashes.
regards, -Mike
Hi Mike,
I newer sought, that some one will try to open connection without specifying a username. But ok, this patch make x2go client to use default user name if no username is specified.
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=b69329589121f2476a11...
regards, Alex
Am 13.12.2013 14:59, schrieb Michael DePaulo:
On Fri, Dec 13, 2013 at 7:07 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
Hello Mike,
this patch:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=6f9ead7cf9184799...
should fix the issue.
regards, Alex
Hi Alex,
That appears to partially fix the issue.
When I enter an invalid username (e.g. "a"), I get the error message "Check your GSSApi configuration or choose another authentication method". So that's a good improvement.
But if the username field is left blank, the x2goclient still crashes.
regards, -Mike
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
I will test it when I get home in about 7 hours. I will not be able to build until then also.
FYI, if you leave the username blank when using password auth, x2goclient prompts you for both the username and password. That's why the username field is likely left blank.
Regards, Mike On Dec 13, 2013 9:57 AM, "Oleksandr Shneyder" <o.shneyder@phoca-gmbh.de> wrote:
Hi Mike,
I newer sought, that some one will try to open connection without specifying a username. But ok, this patch make x2go client to use default user name if no username is specified.
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=b69329589121f2476a11...
regards, Alex
Am 13.12.2013 14:59, schrieb Michael DePaulo:
On Fri, Dec 13, 2013 at 7:07 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
Hello Mike,
this patch:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=6f9ead7cf9184799...
should fix the issue.
regards, Alex
Hi Alex,
That appears to partially fix the issue.
When I enter an invalid username (e.g. "a"), I get the error message "Check your GSSApi configuration or choose another authentication method". So that's a good improvement.
But if the username field is left blank, the x2goclient still crashes.
regards, -Mike
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
Alex,
Your patch successfully fixed the problem of X2goClient crashing when a username is not entered. Good job on that.
And I tested it on my Windows XP SP3 32-bit VM (in addition to my desktop with Win 8.1 64-bit), the GSSAPI / Kerberos auth works there too.
However, I still managed to produce one more crash on Windows, albeit an obscure one.
If GSSAPI authentication is enabled, and you connect through an SSH proxy, that SSH proxy must also use GSSAPI. It prompts you for a password, but it seems to ignore it. I've entered an incorrect password and still connects. This is not that bad of a bug and I think we can launch 4.0.1.2 despite it.
If that proxy does successfully authenticate using GSSAPI, and you successfully connect to the x2goserver via GSSAPI, the session opens and works as far as I've tested it. However, on disconnect, the x2goclient crashes.
I do not know if this crash would be realistically produced. After all, if the entire point of the proxy is to connect through a firewall, would you really be using Kerberos auth to both the proxy and the x2goserver? I do not think this crash bug has to be fixed before 4.0.1.2, but I thought I'd mention it and the former bug. (I will put them in the bug tracker if we do launch with these bugs.)
-Mike
On Fri, Dec 13, 2013 at 10:57 AM, Michael DePaulo <mikedep333@gmail.com> wrote:
I will test it when I get home in about 7 hours. I will not be able to build until then also.
FYI, if you leave the username blank when using password auth, x2goclient prompts you for both the username and password. That's why the username field is likely left blank.
Regards, Mike
On Dec 13, 2013 9:57 AM, "Oleksandr Shneyder" <o.shneyder@phoca-gmbh.de> wrote:
Hi Mike,
I newer sought, that some one will try to open connection without specifying a username. But ok, this patch make x2go client to use default user name if no username is specified.
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=b69329589121f2476a11...
regards, Alex
Am 13.12.2013 14:59, schrieb Michael DePaulo:
On Fri, Dec 13, 2013 at 7:07 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
Hello Mike,
this patch:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=6f9ead7cf9184799...
should fix the issue.
regards, Alex
Hi Alex,
That appears to partially fix the issue.
When I enter an invalid username (e.g. "a"), I get the error message "Check your GSSApi configuration or choose another authentication method". So that's a good improvement.
But if the username field is left blank, the x2goclient still crashes.
regards, -Mike
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
Hi Michael,
On Sa 14 Dez 2013 03:47:12 CET, Michael DePaulo wrote:
Alex,
Your patch successfully fixed the problem of X2goClient crashing when a username is not entered. Good job on that.
And I tested it on my Windows XP SP3 32-bit VM (in addition to my desktop with Win 8.1 64-bit), the GSSAPI / Kerberos auth works there too.
However, I still managed to produce one more crash on Windows, albeit an obscure one.
If GSSAPI authentication is enabled, and you connect through an SSH proxy, that SSH proxy must also use GSSAPI. It prompts you for a password, but it seems to ignore it. I've entered an incorrect password and still connects. This is not that bad of a bug and I think we can launch 4.0.1.2 despite it.
If that proxy does successfully authenticate using GSSAPI, and you successfully connect to the x2goserver via GSSAPI, the session opens and works as far as I've tested it. However, on disconnect, the x2goclient crashes.
I do not know if this crash would be realistically produced. After all, if the entire point of the proxy is to connect through a firewall, would you really be using Kerberos auth to both the proxy and the x2goserver? I do not think this crash bug has to be fixed before 4.0.1.2, but I thought I'd mention it and the former bug. (I will put them in the bug tracker if we do launch with these bugs.)
-Mike
Put the above bug description in the bug tracker anyway. Even if we
fix it for 4.0.1.2, it is good to have it officially documented.
Mike
DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148
GnuPG Key ID 0x25771B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de
freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xf...
Hello Mike,
please test if commit http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=6290a9f307423210fdb7... fixed issue you have described.
regards, Alex
Am 14.12.2013 03:47, schrieb Michael DePaulo:
Alex,
Your patch successfully fixed the problem of X2goClient crashing when a username is not entered. Good job on that.
And I tested it on my Windows XP SP3 32-bit VM (in addition to my desktop with Win 8.1 64-bit), the GSSAPI / Kerberos auth works there too.
However, I still managed to produce one more crash on Windows, albeit an obscure one.
If GSSAPI authentication is enabled, and you connect through an SSH proxy, that SSH proxy must also use GSSAPI. It prompts you for a password, but it seems to ignore it. I've entered an incorrect password and still connects. This is not that bad of a bug and I think we can launch 4.0.1.2 despite it.
If that proxy does successfully authenticate using GSSAPI, and you successfully connect to the x2goserver via GSSAPI, the session opens and works as far as I've tested it. However, on disconnect, the x2goclient crashes.
I do not know if this crash would be realistically produced. After all, if the entire point of the proxy is to connect through a firewall, would you really be using Kerberos auth to both the proxy and the x2goserver? I do not think this crash bug has to be fixed before 4.0.1.2, but I thought I'd mention it and the former bug. (I will put them in the bug tracker if we do launch with these bugs.)
-Mike
On Fri, Dec 13, 2013 at 10:57 AM, Michael DePaulo <mikedep333@gmail.com> wrote:
I will test it when I get home in about 7 hours. I will not be able to build until then also.
FYI, if you leave the username blank when using password auth, x2goclient prompts you for both the username and password. That's why the username field is likely left blank.
Regards, Mike
On Dec 13, 2013 9:57 AM, "Oleksandr Shneyder" <o.shneyder@phoca-gmbh.de> wrote:
Hi Mike,
I newer sought, that some one will try to open connection without specifying a username. But ok, this patch make x2go client to use default user name if no username is specified.
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=b69329589121f2476a11...
regards, Alex
Am 13.12.2013 14:59, schrieb Michael DePaulo:
On Fri, Dec 13, 2013 at 7:07 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
Hello Mike,
this patch:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=6f9ead7cf9184799...
should fix the issue.
regards, Alex
Hi Alex,
That appears to partially fix the issue.
When I enter an invalid username (e.g. "a"), I get the error message "Check your GSSApi configuration or choose another authentication method". So that's a good improvement.
But if the username field is left blank, the x2goclient still crashes.
regards, -Mike
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
Alex,
As always, thank you for your contribution.
However, now GSSAPI authentication appears to no longer work at all on windows.
If I do connect a to machine via GSSAPI (or to a machine via password but with a GSSAPI proxy, or to a machine via GSSAPI via a GSSAPI proxy), the x2go client window stays open and the X server (VcXsrv) never appears.
This bug only seems to happen if GSSAPI auth succeeds. If I purposely misconfigure the x2goserver's kerberos (e.g., I run samba's "net -P ads keytab flush" command to clear the contents of /etc/krb5.keytab), I instead get the erorr message "Check your GSSapi configuration or choose another authentication method."
I am prompted to accept the ssh host id before this happens (if it was not already accepted.)
When this happens, I can close X2Go Client by clicking the X . Other than that and unless I am reconnecting (see the next line), the x2go client window is frozen.
If I close x2go client and reconnect, I am prompted to resume (or suspend/terminate) the session. However, I cannot resume the session because the x2go client freezes like before.
"Show details" never shows any output when this happens.
vcxsrv does appear to be running in the background when this happens.
I tested this on two windows 8.1 64-bit physical machines.
I uploaded this win32 build to the x2go server (accessible only to devs) under /home/x2go/test-of-6290a9f307423210fdb7f8f08f2eb9c52e5ad551/
-Mike
On Mon, Dec 16, 2013 at 5:28 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
Hello Mike,
please test if commit http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=6290a9f307423210fdb7... fixed issue you have described.
regards, Alex
Am 14.12.2013 03:47, schrieb Michael DePaulo:
Alex,
Your patch successfully fixed the problem of X2goClient crashing when a username is not entered. Good job on that.
And I tested it on my Windows XP SP3 32-bit VM (in addition to my desktop with Win 8.1 64-bit), the GSSAPI / Kerberos auth works there too.
However, I still managed to produce one more crash on Windows, albeit an obscure one.
If GSSAPI authentication is enabled, and you connect through an SSH proxy, that SSH proxy must also use GSSAPI. It prompts you for a password, but it seems to ignore it. I've entered an incorrect password and still connects. This is not that bad of a bug and I think we can launch 4.0.1.2 despite it.
If that proxy does successfully authenticate using GSSAPI, and you successfully connect to the x2goserver via GSSAPI, the session opens and works as far as I've tested it. However, on disconnect, the x2goclient crashes.
I do not know if this crash would be realistically produced. After all, if the entire point of the proxy is to connect through a firewall, would you really be using Kerberos auth to both the proxy and the x2goserver? I do not think this crash bug has to be fixed before 4.0.1.2, but I thought I'd mention it and the former bug. (I will put them in the bug tracker if we do launch with these bugs.)
-Mike
On Fri, Dec 13, 2013 at 10:57 AM, Michael DePaulo <mikedep333@gmail.com> wrote:
I will test it when I get home in about 7 hours. I will not be able to build until then also.
FYI, if you leave the username blank when using password auth, x2goclient prompts you for both the username and password. That's why the username field is likely left blank.
Regards, Mike
On Dec 13, 2013 9:57 AM, "Oleksandr Shneyder" <o.shneyder@phoca-gmbh.de> wrote:
Hi Mike,
I newer sought, that some one will try to open connection without specifying a username. But ok, this patch make x2go client to use default user name if no username is specified.
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=b69329589121f2476a11...
regards, Alex
Am 13.12.2013 14:59, schrieb Michael DePaulo:
On Fri, Dec 13, 2013 at 7:07 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
Hello Mike,
this patch:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=6f9ead7cf9184799...
should fix the issue.
regards, Alex
Hi Alex,
That appears to partially fix the issue.
When I enter an invalid username (e.g. "a"), I get the error message "Check your GSSApi configuration or choose another authentication method". So that's a good improvement.
But if the username field is left blank, the x2goclient still crashes.
regards, -Mike
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
Hi Mike,
I can reproduce the issue. Here is a fix:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=9d714e35d68e68dda9df...
regards, Alex
Am 16.12.2013 15:50, schrieb Michael DePaulo:
Alex,
As always, thank you for your contribution.
However, now GSSAPI authentication appears to no longer work at all on windows.
If I do connect a to machine via GSSAPI (or to a machine via password but with a GSSAPI proxy, or to a machine via GSSAPI via a GSSAPI proxy), the x2go client window stays open and the X server (VcXsrv) never appears.
This bug only seems to happen if GSSAPI auth succeeds. If I purposely misconfigure the x2goserver's kerberos (e.g., I run samba's "net -P ads keytab flush" command to clear the contents of /etc/krb5.keytab), I instead get the erorr message "Check your GSSapi configuration or choose another authentication method."
I am prompted to accept the ssh host id before this happens (if it was not already accepted.)
When this happens, I can close X2Go Client by clicking the X . Other than that and unless I am reconnecting (see the next line), the x2go client window is frozen.
If I close x2go client and reconnect, I am prompted to resume (or suspend/terminate) the session. However, I cannot resume the session because the x2go client freezes like before.
"Show details" never shows any output when this happens.
vcxsrv does appear to be running in the background when this happens.
I tested this on two windows 8.1 64-bit physical machines.
I uploaded this win32 build to the x2go server (accessible only to devs) under /home/x2go/test-of-6290a9f307423210fdb7f8f08f2eb9c52e5ad551/
-Mike
On Mon, Dec 16, 2013 at 5:28 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
Hello Mike,
please test if commit http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=6290a9f307423210fdb7... fixed issue you have described.
regards, Alex
Am 14.12.2013 03:47, schrieb Michael DePaulo:
Alex,
Your patch successfully fixed the problem of X2goClient crashing when a username is not entered. Good job on that.
And I tested it on my Windows XP SP3 32-bit VM (in addition to my desktop with Win 8.1 64-bit), the GSSAPI / Kerberos auth works there too.
However, I still managed to produce one more crash on Windows, albeit an obscure one.
If GSSAPI authentication is enabled, and you connect through an SSH proxy, that SSH proxy must also use GSSAPI. It prompts you for a password, but it seems to ignore it. I've entered an incorrect password and still connects. This is not that bad of a bug and I think we can launch 4.0.1.2 despite it.
If that proxy does successfully authenticate using GSSAPI, and you successfully connect to the x2goserver via GSSAPI, the session opens and works as far as I've tested it. However, on disconnect, the x2goclient crashes.
I do not know if this crash would be realistically produced. After all, if the entire point of the proxy is to connect through a firewall, would you really be using Kerberos auth to both the proxy and the x2goserver? I do not think this crash bug has to be fixed before 4.0.1.2, but I thought I'd mention it and the former bug. (I will put them in the bug tracker if we do launch with these bugs.)
-Mike
On Fri, Dec 13, 2013 at 10:57 AM, Michael DePaulo <mikedep333@gmail.com> wrote:
I will test it when I get home in about 7 hours. I will not be able to build until then also.
FYI, if you leave the username blank when using password auth, x2goclient prompts you for both the username and password. That's why the username field is likely left blank.
Regards, Mike
On Dec 13, 2013 9:57 AM, "Oleksandr Shneyder" <o.shneyder@phoca-gmbh.de> wrote:
Hi Mike,
I newer sought, that some one will try to open connection without specifying a username. But ok, this patch make x2go client to use default user name if no username is specified.
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=b69329589121f2476a11...
regards, Alex
Am 13.12.2013 14:59, schrieb Michael DePaulo:
On Fri, Dec 13, 2013 at 7:07 AM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote: > Hello Mike, > > this patch: > > > http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=6f9ead7cf9184799... > > should fix the issue. > > regards, > Alex >
Hi Alex,
That appears to partially fix the issue.
When I enter an invalid username (e.g. "a"), I get the error message "Check your GSSApi configuration or choose another authentication method". So that's a good improvement.
But if the username field is left blank, the x2goclient still crashes.
regards, -Mike
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
X2Go-Dev mailing list X2Go-Dev@lists.berlios.de https://lists.berlios.de/mailman/listinfo/x2go-dev
--
Oleksandr Shneyder | Email: o.shneyder@phoca-gmbh.de phoca GmbH | Tel. : 0911 - 14870374 0 Bräuhausgasse 9 | Fax. : 0911 - 14870374 9 D-82205 Gilching | Mobil: 0163 - 49 64 461
Geschäftsführung: Dipl.-Inf. Oleksandr Shneyder
Amtsgericht München | http://www.phoca-gmbh.de HRB 196 658 | http://www.x2go.org USt-IdNr.: DE281977973
On Mon, Dec 16, 2013 at 12:31 PM, Oleksandr Shneyder <o.shneyder@phoca-gmbh.de> wrote:
Hi Mike,
I can reproduce the issue. Here is a fix:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commit;h=9d714e35d68e68dda9df...
regards, Alex
Great! I can confirm that the last two bugs are fixed.
I tested on both Windows XP 32-bit SP3 and Windows 8.1 64-bit.
As the windows package maintainer for X2Go Client, I currently have no objections to launching 4.0.1.2.
regards, -Mike
HI Stefan,
On Do 12 Dez 2013 13:51:10 CET, Stefan Baur wrote:
using deb http://packages.x2go.org/debian wheezy main as source, apt-get install x2gothinclient gives
The following packages have unmet dependencies: x2gothinclient : Depends: x2goclient (>= 4.0.1.2-0~) but
4.0.1.1-0~x2go1+wheezy~main~427~build1 is to be installedIs that intentional, having a x2gothinclient in the wheezy repo that
requires x2goclient from what I guess is heuler?
the release order was the wrong way round. I should have waited with
x2gothinclient until x2goclient 4.0.1.2 is out. Sorry for that. Use
x2goclient from heuler for now till we have released 4.0.1.2 at the
weekend.
Mike
DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148
GnuPG Key ID 0x25771B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de
freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xf...
-
Alexander Wuerstlein -
Michael DePaulo -
Mike Gabriel -
Oleksandr Shneyder -
Stefan Baur