Subject: Fwd: [X2Go-Dev] Bug#287: x2goserver allows to connect to ALL X server sessions by default

From: Stefan Baur <[email-masked]>
Date: Sat, 17 Aug 2013 17:35:24 +0200

Looks like this info wasn't forwared to the bugtracker, forwarding manually.

-------- Original-Nachricht --------
Betreff: 	[X2Go-Dev] Bug#287: x2goserver allows to connect to ALL X 
server sessions by default
Datum: 	Fri, 16 Aug 2013 14:47:40 +0000 (UTC)
Von: 	Fred Her. <[email-masked]>
Antwort an: 	[email-masked]
An: 	[email-masked]

Actually, this is not an x2go issue, this is a linux mint issue : by
default, there is a "xhost +" command launched at session startup for all
users.

If you type "xhost - ", then you should see the normal behavior again :
userB will get a "no desktop found" message if he try to connect to the x2go
host.

So, the workaround is to remove the "xhost +" command in the Control Panel >
Startup Applications for each user,

or completely remove the /etc/xdg/autostart/mint-xhost-plus.desktop
(but this could come back if the package ubuntu-system-adjustments is
updated)

or change this file to:

[Desktop Entry]
Encoding=UTF-8
Version=1.0
Name=Xhost +
Exec=xhost +
Terminal=false
Type=Application
StartupNotify=false
Terminal=false
X-MATE-Autostart-enabled=false
Hidden=true

note to x2go packages maintainers:
Maybe this should be an option to check/disable when the x2goserver package
is installed?

Or maybe a warning should be issued if "xhost" is set to + when a user
connect?

_______________________________________________
X2Go-Dev mailing list
[email-masked]
https://lists.berlios.de/mailman/listinfo/x2go-dev

---

From: Mike Gabriel <[email-masked]>
Date: Sat, 17 Aug 2013 20:42:55 +0200

title #287 Linux Mint desktops configured too insecurely for multi-user mode
tag #287 confirmed
tag #287 wontfix
close #287
thanks

Hi all,

> X-MATE-Autostart-enabled=false

We (David and I) just figured out the same... (what a race  
condition...). Thanks! What a security leakage if people start using  
Linux Mint in multi-user operation mode (like with X2Go or locally or  
with LTSP).

With xhost + for every user you can launch applications on other  
people's desktops and also read out their clipboards' contents.

/me rarely has to puke at other people's work, but this time... Well, yes.

> Maybe this should be an option to check/disable when the x2goserver package

No! We won't work around such grave issues in distributions or in  
other packages. This needs to be immediately fixed in Linux Mint  
upstream.

> Or maybe a warning should be issued if "xhost" is set to + when a user

Nope! In default setups no other distro evokes xhost + on session  
startup. This is just insane!!! So we ignore this issue in X2Go  
upstream completely.

Stay away from Linux Mint with X2Go (or actually at all) till this has  
been fixed in Mint.

light+love,
Mike

PS: quote me freely if needed...

-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: [email-masked], http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

---

From: [email-masked] (X2Go Bug Tracking System)
Date: Sat, 17 Aug 2013 18:48:02 +0000

This is an automatic notification regarding your Bug report
which was filed against the x2goserver package:

#287: x2goserver allows to connect to ALL X server sessions by default

It has been closed by Mike Gabriel <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Mike Gabriel <[email-masked]> by
replying to this email.

-- 
X2Go Bug Tracking System
Contact [email-masked] with problems

Subject: Re: [X2Go-Dev] Bug#287: x2goserver allows to connect to ALL X server sessions by default
From: Mike Gabriel <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Date: Sat, 17 Aug 2013 20:42:55 +0200

Hi all,

light+love,
Mike

-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy:

Subject: x2goserver allows to connect to ALL X server sessions by default
From: David Fuhrmann <[email-masked]>
To: [email-masked]
Date: Wed, 7 Aug 2013 07:36:18 +0200

Package: x2goserver
Version: 4.0.1.6
Severity: critical

Hi,

I just noticed that x2goserver allows to connect to ALL running X sessions on the target machine, using "connect to local desktop". These might be logged in local users, or NX sessions which were not terminated correctly. This is especially worse in the latter case, as the screen is not locked here, normally.

This is a HUGE security leak, as now all users are able to access data of the other users, and hinder them from working by manipulating current sessions.

Normal remote desktop software should BLOCK such access by default, and only allow it when the user explicitly requested it or configured it so.