From unknown Thu Mar 28 10:27:07 2024 X-Loop: owner@bugs.x2go.org Subject: Bug#372: [X2Go-Dev] Bug#372: Bug#372: x2goadmin writes to users homes Reply-To: Alexander Wuerstlein , 372@bugs.x2go.org Resent-From: Alexander Wuerstlein Resent-To: x2go-dev@lists.berlios.de Resent-CC: X2Go Developers X-Loop: owner@bugs.x2go.org Resent-Date: Mon, 16 Dec 2013 14:48:01 +0000 Resent-Message-ID: Resent-Sender: owner@bugs.x2go.org X-X2Go-PR-Message: followup 372 X-X2Go-PR-Package: x2goserver X-X2Go-PR-Keywords: Received: via spool by 372-submit@bugs.x2go.org id=B372.13872048272722 (code B ref 372); Mon, 16 Dec 2013 14:48:01 +0000 Received: (at 372) by bugs.x2go.org; 16 Dec 2013 14:40:27 +0000 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ymir.das-netzwerkteam.de X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_BLOCKED,URIBL_BLOCKED autolearn=ham version=3.3.2 Received: from faui03.informatik.uni-erlangen.de (faui03.informatik.uni-erlangen.de [131.188.30.103]) by ymir (Postfix) with ESMTPS id A79565DB16 for <372@bugs.x2go.org>; Mon, 16 Dec 2013 15:40:26 +0100 (CET) Received: from faui0sr0.informatik.uni-erlangen.de (faui0sr0.informatik.uni-erlangen.de [131.188.30.90]) by faui03.informatik.uni-erlangen.de (Postfix) with ESMTP id 794C768057D; Mon, 16 Dec 2013 15:40:26 +0100 (CET) Received: by faui0sr0.informatik.uni-erlangen.de (Postfix, from userid 31763) id 720EA2BC0D6; Mon, 16 Dec 2013 15:40:26 +0100 (CET) Date: Mon, 16 Dec 2013 15:40:26 +0100 From: Alexander Wuerstlein To: Reinhard Tartler Cc: 372@bugs.x2go.org, o.schneyder@phoca-gmbh.de, Mike Gabriel , x2go-dev@lists.berlios.de Message-ID: <20131216144026.GG24005@cip.informatik.uni-erlangen.de> References: <20131216073434.Horde.PERNE-ga0mmuL2Mohe-6VA2@mail.das-netzwerkteam.de> <20131216135940.GF24005@cip.informatik.uni-erlangen.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Echelon-Scan: plutonium bomb osama revenge dirty allah satan iran victory dimona cocaine guantanamo centrifuge holy war pigs mossad nsa X-Echelon-Result: Belligerent User-Agent: Mutt/1.5.21 (2010-09-15) On 13-12-16 15:33, Reinhard Tartler wrote: > On Dec 16, 2013 8:59 AM, "Alexander Wuerstlein" < > snalwuer@cip.informatik.uni-erlangen.de> wrote: > > > > On 13-12-16 08:49, Mike Gabriel wrote: > > > Hi Reinhard, > > > > > > On So 15 Dez 2013 01:13:35 CET, Reinhard Tartler wrote: > > > > > > >Package: x2goserver > > > >Severity: serious > > > > > > > >Hi, > > > > > > > >my understanding of the x2goadmin code [code], end of sub add_user, is > > > >that the code tries to write the sql password in users homes. This > > > >will fail for installations that have the user homes on NFS with the > > > >option "rootsquash" mounted. > > > > > > > >I set the severity to "serious" because I imagine that this is a > > > >rather common scenario. > > > > > > > >Also, this approach has another problem: Imagine you want to give > > > >access to the unix group "staff"? According to the documentation, you > > > >can use the options "--addgroup" and "--rmgroup" for this. What if a > > > >new employee joins the company later and wants to use x2go? In this > > > >case you need to call x2godbadmin for this new user again, which is > > > >suboptimal. > > > > > > > >Is there really no way to get around generated user passwords? > > > > There is a way that could work: If configured correctly, postgresql can > > use GSSAPI (Kerberos) Authentication. That way, the user is > > authenticated using his login ticket cache which is created anyways. > > If necessary, one could also provide a keyfile for the cleanup-cronjob > > so that it can at least access the database with sufficient permissions. > > That would be an option if you are OK to break passwordless ssh key > authentication logins. > > If you really wanted to go the kerberos route, you would have to create > special db principals that can only access the db, and stash a passwordless > keyfile in the users home. Yes, that is correct. One more thing that could also work, but is ugly, would be 'ident' authentication in postgresql. But that would of course mean that one needs a sufficiently trustable identd on all machines. Ciao, Alexander Wuerstlein.