X2Go Bug report logs - #685
user x2gobroker can evoke any command on X2Go Servers

version graph

Package: python-x2gobroker; Maintainer for python-x2gobroker is (unknown); Source for python-x2gobroker is src:x2gobroker.

Reported by: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

Date: Tue, 2 Dec 2014 16:15:02 UTC

Severity: important

Tags: pending

Found in version 0.0.3.0-preview

Fixed in version 0.0.3.0

Done: X2Go Release Manager <git-admin@x2go.org>

Bug is archived. No further changes may be made.

Full log


Message #12 received at control@bugs.x2go.org (full text, mbox, reply):

Received: (at control) by bugs.x2go.org; 31 Mar 2015 04:01:18 +0000
From x2go@ymir.das-netzwerkteam.de  Tue Mar 31 06:01:08 2015
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,NO_RELAYS,
	URIBL_BLOCKED autolearn=unavailable version=3.3.2
Received: by ymir.das-netzwerkteam.de (Postfix, from userid 1005)
	id 13F235DAC8; Tue, 31 Mar 2015 06:01:07 +0200 (CEST)
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
To: 685-submitter@bugs.x2go.org
Cc: control@bugs.x2go.org, 685@bugs.x2go.org
Subject: X2Go issue (in src:x2gobroker) has been marked as pending for release
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
X-Mailer: http://snipr.com/post-receive-tag-pending
Message-Id: <20150331040108.13F235DAC8@ymir.das-netzwerkteam.de>
Date: Tue, 31 Mar 2015 06:01:07 +0200 (CEST)
tag #685 pending
fixed #685 0.0.3.0
thanks

Hello,

X2Go issue #685 (src:x2gobroker) reported by you has been
fixed in X2Go Git. You can see the changelog below, and you can
check the diff of the fix at:

    http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=7b98c05

The issue will most likely be fixed in src:x2gobroker (0.0.3.0).

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
commit 7b98c0514eaae794ce5880f86bab12f3a2bf9766
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date:   Tue Mar 31 06:00:59 2015 +0200

    Provide x2gobroker system user public keys to broker agents with SSH options--strongly restricting the key usage--now. Modify x2gobroker- pubkeyauthorizer in a way that it replaces non-option keys with the newly provided optionized/restricted pubkeys. (Fixes: #685).

diff --git a/debian/changelog b/debian/changelog
index a0640e5..d13ad72 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -285,6 +285,10 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low
       hand-back the system's hostname to X2Go Client / Python X2Go.
     - Add security notice / disclaimer to x2gbroker.1 man page as suggested
       by Stefan Baur. (Fixes: #666).
+    - Provide x2gobroker system user public keys to broker agents with SSH
+      options--strongly restricting the key usage--now. Modify x2gobroker-
+      pubkeyauthorizer in a way that it replaces non-option keys with the
+      newly provided optionized/restricted pubkeys. (Fixes: #685).
   * debian/control:
     + Provide separate bin:package for SSH brokerage: x2gobroker-ssh.
     + Replace LDAP support with session brokerage support in LONG_DESCRIPTION.


Send a report that this bug log contains spam.


X2Go Developers <owner@bugs.x2go.org>. Last modified: Fri Mar 29 01:18:11 2024; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.