-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Am 07.01.2015 um 04:27 schrieb Robert Dinse:

For what it's worth I installed the packages for Ubuntu on Mint and it is working. Have I introduced a grave security problem?

Maybe, maybe not. Read through the bug description, try to reproduce the issue, check for the presence of that /etc/xdg/autostart/mint-xhost-plus.desktop file and its content.

• -Stefan

BAUR-ITCS UG (haftungsbeschränkt) Geschäftsführer: Stefan Baur Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364 Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32)

iQEcBAEBAgAGBQJUrKjhAAoJEG7d9BjNvlEZsn0H/2QCtLChFE1yY1EQ7Fr3t65q bH2+64HLU+30mxpqUiJvU3PC0jKWCuAqitCmujU1C4PTHBG9icOIW4PTYywWT1fm 1o2CRBsDbYBjGmDUsl8DlnCW8/17gHR7uN1BH7PSskxXsxzjpKhlxpV2O8ug12j+ XaNIZQ2vBNZgm4834b690sXHFTxAHxJ6b/uSs4MetqxnZ+gv0Zm1W+3K/R7UAsTA GS7eHTCDzUGBgp0Zs662yWYWuB6ewFMg6xoat08vYToEs8qFGhFulNY5/kW9sT1A 3f0I5WcQQ4Vjsxyy1pK5uFFpqbr9E78YbJxY3bNTp1ItxlmYhpFY7E0gk8XtOds= =LBLT -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Am 07.01.2015 um 04:32 schrieb Stefan Baur:

Am 07.01.2015 um 04:27 schrieb Robert Dinse:

...

For what it's worth I installed the packages for Ubuntu on Mint and it is working. Have I introduced a grave security problem?

Maybe, maybe not. Read through the bug description, try to reproduce the issue, check for the presence of that /etc/xdg/autostart/mint-xhost-plus.desktop file and its content.

Addendum: the easiest way to check whether security is currently enabled is to log on as a regular user, and run "xhost" (without the quotes, and without any parameters) in an xterm.

In my case (Debian Wheezy, not Mint), it replies with:

access control enabled, only authorized clients can connect SI:localuser:MYUSERNAMEHERE

And your output, if you're safe, should look similar.

If the first line, however, reads

access control disabled, clients can connect from any host

then you have an issue. A serious one.

• -Stefan

BAUR-ITCS UG (haftungsbeschränkt) Geschäftsführer: Stefan Baur Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364 Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32)

iQEcBAEBAgAGBQJUrK3UAAoJEG7d9BjNvlEZuNwIAJ64IvgKjPtbehQNKmelfdrq nUcGfI2/FsjSQYecOA7uj0KeeXmToXj7k3jkb4905JQC4jEU+xRvwm0zi/y8MsdI hUcV1YmEWohG61waLnIuS584yDmqmRIgLtAlYvUUocd+YYAnIbyVmLgSSfPzU4tR xGyksZ8/a4Zgv4t4Ep4Zwi42UJ2Tq0QhNwjTmRios9IcCmKmQY4xtddaxjfnyrQZ MxmPLON2bcy1ZpkMKn+KSMH9kkAW4E+epYrdwnQMo52S/XbgsytuKSJxKXsFSCQS rHt3HHWc/BFLGS9Jd6aPASEJg+oTI4adrYgnxPg5ZhgQJ196hbcQGyA9snJzUiE= =s458 -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Am 07.01.2015 um 04:58 schrieb Robert Dinse:

This is what I got:

/home/nanook >xhost access control enabled, only authorized clients can connect SI:localuser:nanook /home/nanook >

Looks good, so at least your particular installation is not affected.

Let's see if we can get feedback from others.

@Peter: What does your current Mint installation say when you log in as a regular user and type "xhost", without the quotes and without any additional parameters, in an xterm on the machine you would like to use as a server?

• -Stefan

BAUR-ITCS UG (haftungsbeschränkt) Geschäftsführer: Stefan Baur Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364 Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32)

iQEcBAEBAgAGBQJUrK/MAAoJEG7d9BjNvlEZUzEH/iBFLMcRvnlx2HEF2gPbivbl TsqKJKQq7TknJhMKgiDna92EAz1O6WEu/cVipf+Juil7LhW+EoW/w25ue/3QgYWD KvF9Wqx4OI4PORb4mraX00OnDXCegLhEhqqOdU1J+J/7MfPN72HWz2CR+DQ1sxOV g1HV+uB9Z1WIlNBNh+dOTTi9KS3HNzwUnVC40qGZeC7RVBvdJpteZ2l29lCUtK5N i3EihE3ywnWINsUpJZMaQIweMQ8baoN2iHR+TN3/4rrpTCKxEqEmv+6VYxEfbQiE JKZd2lq/8gfjcnlwROs2Ycc02SwDEVnZA1eVUhHrGnnb6NmXp/LXg93EuhACfgU= =dGlZ -----END PGP SIGNATURE-----

  The packages for Ubunto 14.04 worked fine on Mint-Mate 17 for me.

-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- Eskimo North Linux Friendly Internet Access, Shell Accounts, and Hosting. Knowledgeable human assistance, not telephone trees or script readers. See our web site: http://www.eskimo.com/ (206) 812-0051 or (800) 246-6874.

On Wed, 7 Jan 2015, Mike Gabriel wrote:

Date: Wed, 07 Jan 2015 08:03:11 +0100 From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de> To: Stefan Baur <X2Go-ML-1@baur-itcs.de>, x2go-user@lists.x2go.org Subject: Re: [X2Go-User] Is x2goserver available?

Hi,

...

@Mike#1: Did we pull x2goserver images for Mint due to that?  Or is there another reason why Peter is seeing this issue?

You normally can use Debian or Ubuntu packages of X2Go (depending on your Mint variant). For Mint 15 (Debian), probably the wheezy packages are appropriate.

I never cared for packaging X2Go for Mint, because Mint is targetting desktop users (and the security concept is loosened here and there in Mint due to this focus on single user workstation usability, e.g. see the already referenced bug#287 in X2Go BTS). For servers (X2Go Servers) I highly recommend using Debian or Ubuntu LTS (or rhel-derived systems).

If you feel that some elements (e.g. Mint Display Manager) from Mint should enter Debian/Ubuntu, please support the Debian project in providing that.

For X2Go on Mint, I guess the absolutely optimal approach is building all X2Go components from source (using debuild -uc -us in each X2Go component).

Greets, Mike

--

DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976148

GnuPG Key ID 0x25771B13 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

---

x2go-user mailing list x2go-user@lists.x2go.org http://lists.x2go.org/listinfo/x2go-user

Wow - Looks like I opened quite a can of worms here.

How I came to be using Mint 15 is a long story, but basically when Ubuntu 10.04 (which I loved) went stale, I started looking at upgrading. Ubuntu 12 was awful, 13 was not much better. I, and several colleagues, despised the interface (Gnome, KDE, didn't matter), especially the loss (or "enhancement") of some very useful simple tools; like Alt-Tab for cycling through windows. Mint/Mate offered the closest look & feel to Ubuntu 10.04, so we started running with it. The fact that I've got 15 is probably bad luck - I started Minting just before its base (Ubuntu 13.04) went stale.

Another fact: The network on which I'd run X2GO is completely private - a mix of perhaps 3 Linux/Windows systems residing on a small submarine. Could not see the wider world even if we wanted to, unless someone figures out how to propagate RF through seawater. So security is not an issue. Originally we looked at XRDB for the display porting, but was directed to X2GO as a better alternative by another colleague. That led to this discussion.

BTW, I did try building X2GO directly from source, per the directions here: http://wiki.x2go.org/doku.php/sources:start But that failed miserably.

Given all the options... I'll look into upgrading to Mint 17. This is tricky given the application (losing our primary control system computer for any length of time is a very bad thing), but perhaps this is the best long-term solution.

At the same time - Mike I'll take you up on your offer to build a Debian package for me. I am familiar with Git, of course, but have not built .deb packages.

Thanks All,

• Pete

Hi Peter,

deb packages of X2Go Server are only available for these versions of Linux Mint: Linux Mint 13 (LTS, based on Ubuntu 12.04) Linux Mint 17 (LTS,based on Ubuntu 14.04) Linux Mint 17.1 (LTS, based on Ubuntu 14.04).

I have recently tested tested 13 and 17.

X2Go Server is no longer available for Linux Mint 15 because Linux Mint 15 is based on Ubuntu 13.04. The PPA no longer contains any packages for Ubuntu 13.04 and Linux Mint 13 because Ubuntu 13.04 is no longer supported. (Neither is Linux Mint 15.) Canonical actually removed the Ubuntu 13.04 packages from the PPA.[1]

The packages you are seeing are packages from Ubuntu 13.04's universe repo.

It should be possible to build X2Go Server, and its nx-libs dependencies, on Ubuntu 13.04 / Linux Mint 15. If you know how to use git and how to build a debian package from source, just build these: Currently 4.0.1.18: http://code.x2go.org/gitweb?p=x2goserver.git;a=shortlog;h=refs/heads/build-m... Currently 3.5.0.28: http://code.x2go.org/gitweb?p=nx-libs.git;a=shortlog;h=refs/heads/build-main

If you do not know how to use git or how to build a Debian package from source, then I can build them for you sometime soon.

-Mike#2

[1] http://ppa.launchpad.net/x2go/stable/ubuntu/pool/main/x/x2goserver/

Sorry to dampen the drama but...

Minisubs have been operating for many years with no computers whatsoever. Or simple laptops running whatever version of Windows is compatible with the sonar display. The important life-support stuff is partitioned away from all that. And Stefan, we can go offline to talk about why losing the display would not impact our ability to exercise control.

Note that by "losing our primary control system" I meant any operational downtime (sitting in a warehouse) while I load a new O.S. (not in the sub itself during a dive).

FYI: AUVs have been using Linux as their primary command/control O.S. for years, the only competition being Windows. The old days of dedicated realtime OS's like VxWorks or custom bare metal apps are over, except for military vehicles or maybe NASA - too expensive, too difficult to maintain.

Anyway - I'm upgrading to Mint 17.1 now, so hopefully that obviates the need to build the .deb package.

For those interested, here's a recent promo about the project: https://www.youtube.com/watch?v=ipAxZoMzFYk

Regards,

• Pete

On 01/07/2015 12:10 PM, Stefan Baur wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Am 07.01.2015 um 17:42 schrieb Peter Brodsky:

[...]

...

The network on which I'd run X2GO is completely private - a mix of perhaps 3 Linux/Windows systems residing on a small submarine. Could not see the wider world even if we wanted to, unless someone figures out how to propagate RF through seawater. So security is not an issue. [...]

...

Given all the options... I'll look into upgrading to Mint 17. This is tricky given the application (losing our primary control system computer for any length of time is a very bad thing), but perhaps this is the best long-term solution. Oh. My. God.

I sure hope you know what you're doing (well, at least http://www.apl.washington.edu/people/profile.php?last_name=Brodsky&first_name=Pete seems to indicate so ;-)) and have some sort of backup/emergency control/failsafe mechanism in place that can make this thing surface automatically if something goes, forgive me the pun, belly-up. Especially if it isn't an AUV but a manned submarine. I'd probably be in for a new pair of pants and underpants if I heard the submarine I'm on is controlled by a plain off-the-shelf computer and not some sophisticated machinery with an trimmed down and hardened RTOS with a watchdog feature and a backup control system based on a different design in place. And that's not because I think X2Go is a crappy piece of software (I'm the X2Go Lead Evangelist after all, I tell people how fantastic X2Go is all the time), it's because I would never trust a regular operating system and off-the-shelf hardware for a task where human lives or some seriously expensive device like an AUV are/is at stake.

That said, if you *do* get X2Go running in that environment, it would make for one heck of an entry on our success stories Wiki-page! So if you do succeed, we'd absolutely love to hear back from you!

So, back to the original problem - what does "xhost" say on your current Mint 15 machines?

And while this isn't exactly X2Go-related - what does the partitioning of these machines look like? If you have unpartitioned disk space, a partition you could spare (that's why I usually have a swap partition large enough to hold a small Linux installation, when changed from swap to ext, on my machines), or you are using LVM and have sufficient free space in there and a boot loader that supports booting from a logical volume, you might want to look into using debootstrap to install a newer version of your operating system into the available space, while your current installation is booted. Or, if debootstrap isn't available for Mint, do a Mint 17 install on another computer, tar the image, transfer it to a new partition/LV on the Mint 15 machine, and see if you can boot into it. That should minimize downtime.

Feel free to contact me off-list for some options/best practices. My company eMail address is kontakt@baur-itcs.de.

I can't claim any previous experience with submarine control systems, but we do have quite a few Linux computers spread across Germany in more or less remote locations (there's even one that, according to the staff that's been on-site once to install the machine, can only be reached via horse drawn sleigh or snowmobile during the wintertime) where we do need to run upgrades with minimum downtime, and having someone on-site to perform the upgrade is usually not an option (and where it is, it tends to get expensive rather quickly), so we've come up with a few things to avoid that.

...

At the same time - Mike I'll take you up on your offer to build a Debian package for me. I am familiar with Git, of course, but have not built .deb packages. Usually, this is the place where I would point out that we do have commercial support offerings for customers with needs like that one (I'm sure someone would usually offer to build you packages even for Mint 15 if you paid for it) - but in your case, I would actually have to check back with our developers if anyone is willing to offer commercial support or if they're all too worried about liability issues in case a bug in the code causes you to lose control over the AUV/submarine ... drowned customers aren't happy customers, if you know what I mean. ;-)

• -Stefan

On Wed, Jan 7, 2015 at 11:42 AM, Peter Brodsky <brodsky@apl.washington.edu> wrote:

Wow - Looks like I opened quite a can of worms here.

How I came to be using Mint 15 is a long story, but basically when Ubuntu 10.04 (which I loved) went stale, I started looking at upgrading. Ubuntu 12 was awful, 13 was not much better. I, and several colleagues, despised the interface (Gnome, KDE, didn't matter), especially the loss (or "enhancement") of some very useful simple tools; like Alt-Tab for cycling through windows. Mint/Mate offered the closest look & feel to Ubuntu 10.04, so we started running with it. The fact that I've got 15 is probably bad luck - I started Minting just before its base (Ubuntu 13.04) went stale.

1st, I need to know. Are you using 32-bit or 64-bit?

2nd, the MATE desktop environment runs great under X2Go. But if you are using the Cinnamon desktop environment, I am not sure if the version of Cinnamon in Linux Mint 15, 1.8, is compatible or not. I think it is, I'll test it before I upload the packages for you. I recently tested 1.4 (Linux Mint 13) successfully and I think that I recently updated the logic in x2goserver to accommodate the filepaths for Cinnamon 1.8.

[...]

BTW, I did try building X2GO directly from source, per the directions here: http://wiki.x2go.org/doku.php/sources:start But that failed miserably.

Those instructions are woefully incomplete. I will update them as I go along building.

Given all the options... I'll look into upgrading to Mint 17. This is tricky given the application (losing our primary control system computer for any length of time is a very bad thing), but perhaps this is the best long-term solution.

In the long run, upgrading to an LTS release is indeed your best solution.

At the same time - Mike I'll take you up on your offer to build a Debian package for me. I am familiar with Git, of course, but have not built .deb packages.

See my 1st question above.

Thanks All,

• Pete

-Mike

On Wed, Jan 7, 2015 at 5:58 PM, Robert Dinse <nanook@eskimo.com> wrote:

...

1st, I need to know. Are you using 32-bit or 64-bit?

2nd, the MATE desktop environment runs great under X2Go. But if you are using the Cinnamon desktop environment, I am not sure if the version of Cinnamon in Linux Mint 15, 1.8, is compatible or not. I think it is, I'll test it before I upload the packages for you. I recently tested 1.4 (Linux Mint 13) successfully and I think that I recently updated the logic in x2goserver to accommodate the filepaths for Cinnamon 1.8.

 I was not able to get Cinnamon to work under Linux Mint-Mate 17 over

x2go. It well may be operator incompetence however.

Nope, that was not your fault: http://wiki.x2go.org/doku.php/doc:de-compat

Ideally, X2Go Server would inform someone when connecting that the (version of the) desktop environment they are trying to run is incompatible.

(It gets messy with things like gnome-flashback and gnome-session. Some old versions of gnome-session are patched, so they are compatible with gnome-flashback and X2Go.)

I added steps to checkout the current "stable" ("build-main") version.

On Thu, Jan 8, 2015 at 4:39 AM, Mike Gabriel <mike.gabriel@das-netzwerkteam.de> wrote:

Hi Peter,

On Mi 07 Jan 2015 17:42:31 CET, Peter Brodsky wrote:

...

At the same time - Mike I'll take you up on your offer to build a Debian package for me. I am familiar with Git, of course, but have not built .deb packages.

It is probably easier, if you build those packages yourself (on the machine where they shall be installed):

# as user root $ apt-get install build-essential devscripts git $ adduser x2go-build [...] $ su - x2go-build

# as user x2go-build $ mkdir x2go $ cd x2go

# building nx-libs $ git clone git://code.x2go.org/nx-libs.git $ cd nx-libs # Currently version 3.5.0.28 $ git checkout build-main $ debuild -uc -us [... check stdout/stderr for missing build-dependencies ...] [... install those missing build-dependencies ...] [... if first build failed, run debuild again ...] $ debuild -uc -us [... takes a while ...]

# building x2goserver $ cd .. $ git git://code.x2go.org/x2goserver.git $ cd x2goserver # Currently version 4.0.1.18 $ git checkout build-main $ debuild -uc -us [... check stdout/stderr for missing build-dependencies ...] [... install those missing build-dependencies ...] [... if first build failed, run debuild again ...] $ debuild -uc -us [... takes a bit...] $ cd ..

$ exit

# again as root $ dpkg -i ~x2go-build/x2go/*.deb $ apt-get install -f

# done

Mike [...]

If you're having trouble installing the build-dependencies, let me know. There are 2 other ways of installing them. (mk-build-deps, or switching the entire build process to using pbuilder)

-Mike#2

Two more things...

On Do 08 Jan 2015 10:39:21 CET, Mike Gabriel wrote:

# building nx-libs $ git clone git://code.x2go.org/nx-libs.git $ cd nx-libs

add this command here:

$ git checkout build-main

$ debuild -uc -us [... check stdout/stderr for missing build-dependencies ...] [... install those missing build-dependencies ...] [... if first build failed, run debuild again ...] $ debuild -uc -us [... takes a while ...]

# building x2goserver $ cd .. $ git git://code.x2go.org/x2goserver.git $ cd x2goserver

and this one here:

$ git checkout release/4.0.1.x

$ debuild -uc -us [... check stdout/stderr for missing build-dependencies ...] [... install those missing build-dependencies ...] [... if first build failed, run debuild again ...] $ debuild -uc -us [... takes a bit...] $ cd ..

$ exit

# again as root $ dpkg -i ~x2go-build/x2go/*.deb $ apt-get install -f

Greets, Mike

--

DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xf...