X2Go Bug report logs - #832
X2Go Client in broker mode wiath autologin enabled expects transmission of private SSH key file

version graph

Package: x2goclient; Maintainer for x2goclient is X2Go Developers <x2go-dev@lists.x2go.org>; Source for x2goclient is src:x2goclient.

Reported by: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

Date: Mon, 30 Mar 2015 04:30:01 UTC

Severity: important

Found in version

Full log

🔗 View this message in rfc822 format

X-Loop: owner@bugs.x2go.org
Subject: Bug#832: X2Go Client in broker mode wiath autologin enabled expects transmission of private SSH key file
Reply-To: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>, 832@bugs.x2go.org
Resent-From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Resent-To: x2go-dev@lists.x2go.org
Resent-CC: X2Go Developers <x2go-dev@lists.x2go.org>
X-Loop: owner@bugs.x2go.org
Resent-Date: Mon, 30 Mar 2015 04:30:01 +0000
Resent-Message-ID: <handler.832.B.142768971317720@bugs.x2go.org>
Resent-Sender: owner@bugs.x2go.org
X-X2Go-PR-Message: report 832
X-X2Go-PR-Package: x2goclient
Received: via spool by submit@bugs.x2go.org id=B.142768971317720
          (code B); Mon, 30 Mar 2015 04:30:01 +0000
Received: (at submit) by bugs.x2go.org; 30 Mar 2015 04:28:33 +0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,URIBL_BLOCKED
	autolearn=ham version=3.3.2
Received: from freya.das-netzwerkteam.de (freya.das-netzwerkteam.de [])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id 85C2E5DAC6
	for <submit@bugs.x2go.org>; Mon, 30 Mar 2015 06:28:31 +0200 (CEST)
Received: from grimnir.das-netzwerkteam.de (grimnir.das-netzwerkteam.de [])
	by freya.das-netzwerkteam.de (Postfix) with ESMTPS id 28AD5A78
	for <submit@bugs.x2go.org>; Mon, 30 Mar 2015 06:28:31 +0200 (CEST)
Received: from localhost (localhost [])
	by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id 45C903C05A
	for <submit@bugs.x2go.org>; Mon, 30 Mar 2015 06:28:30 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at grimnir.das-netzwerkteam.de
Received: from grimnir.das-netzwerkteam.de ([])
	by localhost (grimnir.das-netzwerkteam.de []) (amavisd-new, port 10024)
	with ESMTP id PAAC9ElKB1Cl for <submit@bugs.x2go.org>;
	Mon, 30 Mar 2015 06:28:30 +0200 (CEST)
Received: from grimnir.das-netzwerkteam.de (localhost [])
	by grimnir.das-netzwerkteam.de (Postfix) with ESMTPS id 0C8813BD8E
	for <submit@bugs.x2go.org>; Mon, 30 Mar 2015 06:28:28 +0200 (CEST)
Received: from bifrost.das-netzwerkteam.de (bifrost.das-netzwerkteam.de
 []) by mail.das-netzwerkteam.de (Horde Framework) with HTTP;
 Mon, 30 Mar 2015 04:28:28 +0000
Date: Mon, 30 Mar 2015 04:28:28 +0000
Message-ID: <20150330042828.Horde.tSTkDXxv7oTRt-8A7NdwtQ1@mail.das-netzwerkteam.de>
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
To: submit@bugs.x2go.org
User-Agent: Internet Messaging Program (IMP) H5 (6.2.2)
Accept-Language: de,en
X-Remote-Browser: Mozilla/5.0 (X11; Linux x86_64; rv:32.0) Gecko/20100101
 Firefox/32.0 Iceweasel/32.0
Content-Type: multipart/signed; boundary="=_lwNaJfuD7SEZE0_YAz-eGg5";
 protocol="application/pgp-signature"; micalg=pgp-sha1
MIME-Version: 1.0
[Message part 1 (text/plain, inline)]
Package: x2goclient
Severity: important

If brokerage with autologin is in use (a very common broker setup),  
the current client<->broker communication design in X2Go Client is  
that the broker creates a SSH pubkey/privkey pair and transmits the  
private key to the client.

Never should we transmit private key files over the wire!!!

The X2Go Session Broker is already able to accept pubkey files from  
the client side and deploy those pubkeys appropriately. In Python  
X2Go, this is already used.

X2Go Client should switch here: create pubkey/privkey pair on  
client-side, push the pubkey to the broker and have it temporarily  
deployed from there to the X2Go Server where the next session login is  
scheduled by the broker.


mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.

X2Go Developers <owner@bugs.x2go.org>. Last modified: Sun Feb 5 06:46:59 2023; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.