X2Go Bug report logs - #832
X2Go Client in broker mode wiath autologin enabled expects transmission of private SSH key file

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: submit@bugs.x2go.org

Subject: X2Go Client in broker mode wiath autologin enabled expects transmission of private SSH key file

Date: Mon, 30 Mar 2015 04:28:28 +0000

[Message part 1 (text/plain, inline)]

Package: x2goclient
Severity: important
Version: 4.0.4.0

If brokerage with autologin is in use (a very common broker setup),  
the current client<->broker communication design in X2Go Client is  
that the broker creates a SSH pubkey/privkey pair and transmits the  
private key to the client.

Never should we transmit private key files over the wire!!!

The X2Go Session Broker is already able to accept pubkey files from  
the client side and deploy those pubkeys appropriately. In Python  
X2Go, this is already used.

X2Go Client should switch here: create pubkey/privkey pair on  
client-side, push the pubkey to the broker and have it temporarily  
deployed from there to the X2Go Server where the next session login is  
scheduled by the broker.

Mike
-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.