Subject: SSH proxy connection doesn't work for tunnel only accounts

From: Arcadie Cracan <[email-masked]>
Date: Tue, 21 Aug 2018 16:38:24 +0300

Package: x2goclient
Version: 4.1.2.1
Tag: patch

I use a ssh proxy server that allows only tunnel connections (i.e. doesn't 
allow the users to use the shell). After upgrading from Ubuntu 16.04 to 
18.04 x2goclient stopped working with my ssh proxy server.

I believe the reason for this is the call to the "checkLogin()" function 
even for ssh proxy connections (which in my opinion is not necessary).

I attach a patch that makes x2goclient skip the checkLogin() call (as it 
does for kerberos connections) for the ssh proxy connection.

Thank you for considering this patch.

Kind regards,
   Arcadie Cracan

>From 8286700d7cde027ba3897de8f177f83ee627de99 Mon Sep 17 00:00:00 2001
From: Arcadie Cracan <[email-masked]>
Date: Tue, 21 Aug 2018 16:26:26 +0300
Subject: [PATCH] Skip checkLogin() for ssh proxy connection.

---
 src/sshmasterconnection.cpp | 10 +++++++++-
 src/sshmasterconnection.h   |  3 +++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/sshmasterconnection.cpp b/src/sshmasterconnection.cpp
index 049bee0..dc9962e 100644
--- a/src/sshmasterconnection.cpp
+++ b/src/sshmasterconnection.cpp
@@ -193,6 +193,7 @@ SshMasterConnection::SshMasterConnection (QObject* parent, QString host, int por
     this->proxyKrbLogin=proxyKrbLogin;
     mainWnd=(ONMainWindow*) parent;
     kerberos=krblogin;
+    isSshProxySession = false;
     challengeAuthVerificationCode=QString::null;
 
 #if LIBSSH_VERSION_INT >= SSH_VERSION_INT (0, 6, 0)
@@ -307,6 +308,12 @@ QString SshMasterConnection::getSourceFile(int pid)
 }

+void SshMasterConnection::setSshProxySession(bool isSshProxySession)
+{
+    this->isSshProxySession = isSshProxySession;
+}
+
+
 void SshMasterConnection::addReverseTunnelConnections()
 {
     reverseTunnelRequestMutex.lock();
@@ -548,6 +555,7 @@ void SshMasterConnection::run()
 //         connect ( interDlg, SIGNAL(textEntered(QString)), con, SLOT(interactionTextEnter(QString)));
 //         connect ( interDlg, SIGNAL(interrupt()), con, SLOT(interactionInterruptSlot()));
 
+        sshProxy->setSshProxySession(true);
         sshProxyReady=false;
         sshProxy->start();
 
@@ -726,7 +734,7 @@ void SshMasterConnection::run()
         x2goDebug<<"User authentication OK.";
 #endif
         // checkLogin() is currently specific to libssh.
-        if(kerberos)
+        if(kerberos || isSshProxySession)
             emit connectionOk(host);
         else
         {
diff --git a/src/sshmasterconnection.h b/src/sshmasterconnection.h
index 69bfa0d..fbaadda 100644
--- a/src/sshmasterconnection.h
+++ b/src/sshmasterconnection.h
@@ -123,6 +123,8 @@ public:
         return kerberos;
     };
 
+    void setSshProxySession(bool isSshProxySession=true);
+
 private:
     bool sshConnect();
     bool userAuthWithPass();
@@ -207,6 +209,7 @@ private:
     bool acceptUnknownServers;
     ONMainWindow* mainWnd;
     bool kerberos;
+    bool isSshProxySession;
     QString sshProcErrString;
     QTcpSocket *tcpProxySocket;
     QNetworkProxy *tcpNetworkProxy;
-- 
2.17.1

---

From: Pajula Juha <[email-masked]>
Date: Tue, 3 Mar 2020 09:57:56 +0000

>    Arcadie Cracan

I can confirm that the bug exists still on latest version 4.1.2.2-2020.02.13.

It prevents using newer versions of X2GO (4.1.x) with Bastion host type of ssh proxies where proxy account is jailed to use only ssh (no shell is allowed).

The connections work fine with version 4.0.5.2-2016.09.20, but not newer.

This is clearly visible on debug messages with latest version:

x2go-DEBUG-../src/sshmasterconnection.cpp:943> state: 1

x2go-DEBUG-../src/sshmasterconnection.cpp:676> Setting SSH directory to C:/xxxxxxx

x2go-DEBUG-../src/sshmasterconnection.cpp:1324> Trying to authenticate user with private key.

x2go-DEBUG-../src/sshmasterconnection.cpp:1507> Authenticating with key: 0

x2go-DEBUG-../src/sshmasterconnection.cpp:687> User authentication OK.

x2go-DEBUG-../src/sshmasterconnection.cpp:1708> LOGIN CHECK:"This account is currently not available.

"

x2go-DEBUG-../src/sshmasterconnection.cpp:1744> LOOP FINISHED

x2go-DEBUG-../src/sshmasterconnection.cpp:1754> Reconnect session

x2go-DEBUG-../src/sshmasterconnection.cpp:707> Login Check - Failed

x2go-DEBUG-../src/onmainwindow.cpp:3051> SSH Session prompt:"This account is currently not available.

"

x2go-DEBUG-../src/onmainwindow.cpp:3054> SSH Session interaction

x2go-DEBUG-../src/sshmasterconnection.cpp:437> SSH proxy interaction finished

Regards,

-Juha Pajula