Subject: Bug#739: "Connection failed" errors when using GSSAPI on Windows (PuTTY+Krb5)

From: Michael DePaulo <[email-masked]>
Date: Sun, 11 Jan 2015 12:15:50 -0500

Package: x2goclient
Version: 4.0.3.1

Client OS: Windows 8.1 64-bit with all available updates

Server OS: Fedora 21 64-bit with most available updates
Server krb5 client: samba winbind 4.1.14-1.fc21
x2goagent: 3.5.0.28
x2goserver: 4.0.1.18
x2goserver-extensions: 4.0.1.18
x2goserver-xsession: 4.0.1.18 (with fix for #632 applied)

When I attempt to use GSSAPI authentication on Windows, with either
x2goclient 4.0.3.1-20141214 or x2goclient 4.0.3.2 development build
(2015-01-11 9363860), I see 2 error messages come up when I start a
new session on the aforementioned host:

Message 1:

Connection failed : cp: missing destination file operand after
'/home/DEPAULO/mike/.x2go/C-mike-50-1420995172_stDMATE_dp32/krb5cc'
Try 'cp --help' for more information

Message 2:

Connection failed pscp: unable to open
/home/mike/.x2go/ssh/key.Hp6896: no such file or directory

Message 1 is on top of message 2.

If I reconnect to a session, I only receive message #2.

Under both versions of x2goclient, the X2go Session appears to start
successfully. e.g., I see my mate desktop launch. And I can actually
interact with it.

However, whenever I connect with 4.0.3.1-20141214, as soon as I
dismiss error message #2, x2goclient terminates entirely.

On 4.0.3.2, these error messages are harmless (but annoying.)

I've attached the log from the 4.0.3.2 development build (2015-01-11 9363860).

I've also attached the server's samba configuration.

---

From: Mike Gabriel <[email-masked]>
Date: Mon, 12 Jan 2015 04:25:06 +0000

Control: tag -1 build-win32
Control: retitle -1 Kerberos cred delegation fails on Windows
Control: retitle #731 Kerbers cred delegation fails on Linux

HI Michael,

> I've also attached the server's samba configuration.

This (for Windows version of X2Go Client) seems like the pendant to  
#731 (Linux version of X2Go Client).

Your observed error means that Kerberos credentials delegation fails  
on Windows.

Mike

-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: [email-masked], http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

---

From: Frank Lenaerts <[email-masked]>
Date: Mon, 19 Aug 2019 16:28:43 +0200

Hi

I also encountered this issue and found out that Windows' GSSAPI
library checks if the target server can be trusted before delegating
tickets to it. If you trust the target system, tickets can be
forwarded to it and things work as expected. Note that ssh(1) on Linux
doesn't do this check i.o.w. using ssh(1)'s -K option just works.

To configure this:

"AD Users and Computers" > search the target host > properties >
Delegation tab > Trust...

-- 
Kind regards

Frank Lenaerts