Subject: Bug#68: X2goclient & OTP

From: Pascal Vibet - ADACIS <[email-masked]>
Date: Sat, 1 Dec 2012 13:40:53 +0100

Package: x2goclient
Version: lucid - precise: amd64/i386 (ppa.launchpad), precise 3.99.0.5-1:
amd64/i386

I should use OTM authentification (One Time Password) like google
authentificator on my X2go server but it's impossible to mount shared
folder and/or local printer.

If i don't use OTP, i can see x2goclient connect twice to my server. First
time to login and second time, to shared folder and/or local printer
Dec  1 10:33:22 my_serveur sshd[22271]: Accepted password for pascal from
AAA.BBB.CCC.DDD port 36053 ssh2
Dec  1 10:33:22 my_serveur sshd[22271]: pam_unix(sshd:session): session
opened for user pascal by (uid=0)
Dec  1 10:33:36 my_serveur sshd[22707]: Accepted password for pascal from
AAA.BBB.CCC.DDD port 36057 ssh2
Dec  1 10:33:36 my_serveur sshd[22707]: pam_unix(sshd:session): session
opened for user pascal by (uid=0)

I i use OTP, password is valide one time. So, i can login on x2goserver but
i can not reuse the same password to shared folder:
Dec  1 10:37:26 my_serveur sshd[28415]: Accepted password for pascal from
AAA.BBB.CCC.DDD port 36062 ssh2
Dec  1 10:37:26 my_serveur sshd[28415]: pam_unix(sshd:session): session
opened for user pascal by (uid=0)
Dec  1 10:37:36 my_serveur sshd(pam_google_authenticator)[28839]: Trying to
reuse a previously used time-based code. Retry again in 30 seconds.
Warning! This might mean, you are currently subject to a man-in-the-middle
attack.
Dec  1 10:37:36 my_serveur sshd(pam_google_authenticator)[28839]: Invalid
verification code
Dec  1 10:37:36 my_serveur sshd[28839]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=toto.tata.titi.fr
user=pascal
Dec  1 10:37:39 my_serveur sshd[28839]: Failed password for pascal from
AAA.BBB.CCC.DDD port 36067 ssh2
Dec  1 10:37:39 my_serveur sshd[28839]: Received disconnect from
AAA.BBB.CCC.DDD: Bye Bye [preauth]

If X2goclient use multiplex ssh client option:
Host *
    ControlMaster auto
    ControlPath ~/.ssh/%r@%h:%p
First connection use password and create SSH socket file.
The second connection reuse first one and it can connect whithout
authentification.

In my test, X2goclient don't use some ssh client option.

Regards

Pascal Vibet