<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<meta name="Generator" content="Zarafa WebAccess v6.05-12338">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<title>RE: Re: [X2go-dev] concept for X2go session lock-down to kiosk-mode (was Re: X2go is insecure)</title>
<style type="text/css">
body
{
font-family: Arial, Verdana, Sans-Serif;
font-size: 12px;
padding: 5px 5px 5px 5px;
margin: 0px;
border-style: none;
background-color: #ffffff;
}
p, ul, li
{
margin-top: 0px;
margin-bottom: 0px;
}
</style>
</head>
<body>
<p>Hi list,</p><p> </p><p>First of all sorry for the somewhat provocative way I entered this discussion.</p><p> </p><p>Now about the use case we have:</p><p> </p><p>We are providing an application over the internet to users. This application should run seamlessly on the desktop of the user. So we do NOT export a complete desktop but only a single application. The users should be able to start this application, but nothing else......</p><p> </p><p>Our users are on the Internet at random places. Some might logon with the nice python client of Mike, some might use an X2go plugin in a browser etc.</p><p> </p><p>As the users should only be able to execute our application and nothing more, security should be done at the server and NOT at the client. The way X2go works is that commands defined in the client are sent to the server and executed there. So if a user starts a desktop, the client sends the command to start the desktop to the server and it is executed there. The screen shows throught nx and he can work. From the moment the desktop is running, only the screens, the mouseclicks and keyboard is sent thru the tunnel. Because the user can change the profiles stored in the X2goclient, he could enter any command there and send it to the server.</p><p> </p><p>So, what I suggest is that on the server there is a file where the allowed user commands are stored per usergroup (Off-course Unix usergroups can be used here). This is not very complicated, because if the user is allowed to start the shell, this is only checked when the connection is made and not afterwards. This should be sufficient.</p><p> </p><p>Example</p><p>---------//-----------</p><p>The group x2gousers on the server is allowed to execute the terminal and kde and a special application (say CVix, our application). So, when the user connects to the server, the server reports to the user, OK, you can start kde, the terminal or CVix.</p><p>If the user chooses the terminal, then the terminal is started and the user can execute any command allowed for him in the terminal.</p><p> </p><p>Now this is a trivial example, because the user is allowed to execute the terminal and can do anything he likes. However if the user is only allowed to execute CVix, there is no way whatsover for him to circumvent this authorization, because the wrapper simply prohibits any command that is not defined in the db.</p><p> </p><p>----------//----------</p><p> </p><p>In the X2go client, commands must be executed on the server to build the session. The number of commands that must be issued by the client is not very high and can be delivered preconfigured with the X2go server in the allowed commands db.</p><p> </p><p>We have developed the wrapper that does exactly what I describe here. Currently it is lacking a screen where an authorized user can change the authorization db, but that will come on short notice.</p><p> </p><p>I hope it is a little clearer now what the problem is and how it can be solved. <br /> </p><p>Dick Kniep</p><p> <br /> -----Oorspronkelijk bericht-----<br /><strong>Van:</strong> John A. Sullivan III <jsullivan@opensourcedevel.com><br /><strong>Verzonden:</strong> wo 30-03-11 11:44:06<br /><strong>Aan:</strong> x2go-dev@lists.berlios.de; <br /><strong>Onderwerp:</strong> Re: [X2go-dev] concept for X2go session lock-down to kiosk-mode (was Re: X2go is insecure)<br /><br />On Wed, 2011-03-30 at 10:58 +0200, Erik Auerswald wrote:<br />> Hi,<br />> <br />> On Tue, Mar 29, 2011 at 06:31:07PM +0200, Mike Gabriel wrote:<br />> > On Di 29 Mär 2011 16:55:50 CEST Alexander Wuerstlein wrote:<br />> >> On 11-03-29 15:36, Dick Kniep <dick.kniep@lindix.nl> wrote:<br />> ><br />> >> An authorized user running commands over ssh is not a security problem<br />> >> at all. It works as intended. ssh provides shells.<br />> ><br />> > As Reinhard has mentioned in another post: Dicks setup requires a <br />> > complete lock-down-kiosk-mode-kind-of-thing. He wants a user to be able <br />> > to run a small set of commands only (i.e. the rootless applications he <br />> > wants to provide to his customers). From his perspective AFAIK a user <br />> > logged in via SSH is a security issue. May it be so.<br />> ><br />> >>> The $SSH_ORIGINAL_COMMAND contains the original command that the<br />> >>> client wants to execute on the server. This command is checked against<br />> >>> the allowed commands for the user within the wrapper.<br />> >><br />> >> From the invocation I infer, that the intended language for the<br />> >> wrapper is shellskript. This is extremely dangerous if intended as a<br />> >> security measure like you claim. Also please note that it is very hard<br />> >> to write such wrappers in a secure way, such that stuff like e.g.<br />> >> 'allowed_command foo bar ; evil_command' is not possible.<br />> ><br />> > This is a very worthy remark!!! I also think that it needs quite an <br />> > effort to script such a wrapper (and have it accepted in X2go <br />> > upstream!!!)<br />> <br />> An example for rsync via SSH can be found at:<br />> http://troy.jdmz.net/rsync/index.html<br />> <br />> The validate-rsync script there can be used as a starting point.<br />> <br />> Regards,<br />> Erik<br />I admit I have not thought this issue through thoroughly as I'm under a<br />brutal deadline right now but I would think the problem is that one can<br />use X2Go for application publishing and not just complete desktops. Do<br />we know in advance every possible application one might want to publish<br />via X2Go? If we did (and I can't imagine we would), would we want to<br />identify those via X2Go or some other mechanism built more for the task?<br />My guess is, since we are an application publishing application, we<br />should leave restriction of applications to the sysadmin using the tools<br />already at their disposal. Again, that is only a half baked thought but<br />I think it has some merit - John<br /><br />_______________________________________________<br />X2go-dev mailing list<br />X2go-dev@lists.berlios.de<br />https://lists.berlios.de/mailman/listinfo/x2go-dev<br /><br />!DSPAM:4d92fb66203787818312239!<br /> </p>
</body>
</html>