Subject: Bug#666: point out that x2gobroker is not a security feature

From: Stefan Baur <[email-masked]>
Date: Fri, 07 Nov 2014 00:50:55 +0100

Package: x2gobroker
Severity: wishlist

Please add a prominent note to x2gobroker's man page that it is *not*
intended as a security feature - a user can still launch x2goclient
without the broker parameter and set it to run any executable the user
has exec permission for on the server.

As always, group membership and file permissions *MUST* (MUST as
defined in RFC2119 https://www.ietf.org/rfc/rfc2119.txt) be used to
limit a user's access to executables on the server.

- -Stefan

- -- 
BAUR-ITCS UG (haftungsbeschränkt)
Geschäftsführer: Stefan Baur
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243

---

From: Mike Gabriel <[email-masked]>
Date: Thu, 08 Jan 2015 23:44:24 +0000

Hi Stefan,

> limit a user's access to executables on the server.

Do you think you could write down such an additional note for the man  
page and send it back to this bug (in plain text)?

I will work that text into the man page then.

Thanks,
Mike

PS: if you will, tag this bug with "patch" once you have sent that  
text passage...

-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: [email-masked], http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

---

From: Stefan Baur <[email-masked]>
Date: Fri, 09 Jan 2015 11:24:14 +0100

Control: tag -1 patch
Control: clone -1 -2
Control: retitle -2 point out that X2GoServer's Published Application
Mode is not a security feature
Control: tag -2 patch
Control: severity -2 wishlist
Control: package -2 x2goserver

> Do you think you could write down such an additional note for the
> man page and send it back to this bug (in plain text)?

> PS: if you will, tag this bug with "patch" once you have sent that 

@Mike#1, I tried to clone and retitle this bug for X2GoServer's
Published Application Mode.  Please verify that this worked.

- -Stefan

This is the notice for X2GoBroker. For X2GoServer's PAM, see below.

SECURITY NOTICE

Users are advised to not misinterpret X2GoBroker's capabilites as a
security feature.  Even when using X2GoBroker, it is still possible
for users to locally configure an X2GoClient with any setting they
want, and use that to connect.  So if you're trying to keep users from
running a certain application on the host, using X2GoBroker to "lock"
the configuration is the *wrong* way.  The users will still be able to
run that application by creating their own, local configuration file
and using that.  To keep users from running an application on the
server, you have to use *filesystem permissions*.  In the simplest
case, this means setting chmod 750 or 550 on the particular
application on the host, and making sure the users in question are not
the owner and also not a member of the group specified for the
application.

Notice for X2GoServer's PAM (Published Application Mode) is here:

SECURITY NOTICE

Users are advised to not misinterpret X2GoServer's Published
Application Mode as a security feature.  Even when using Published
Application Mode, it is still possible for users to locally configure
an X2GoClient with any setting they want, and use that to connect.  So
if you're trying to keep users from running a certain application on
the host, using Published Application Mode to "lock" the configuration
is the *wrong* way.  The users will still be able to run that
application by creating their own, local configuration file and using
that.  To keep users from running an application on the server, you
have to use *filesystem permissions*.  In the simplest case, this
means setting chmod 750 or 550 on the particular application on the
host, and making sure the users in question are not the owner and also
not a member of the group specified for the application.

- --