This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
wiki:security:start [2011/09/09 07:26] sunweaver |
wiki:security:start [2014/01/08 10:20] (current) sunweaver [SQLite] |
||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ~~NOTOC~~ | ||
+ | ====== Thoughts on Security ====== | ||
+ | ===== Session Database Backends ===== | ||
+ | ==== PostgreSQL ==== | ||
- | ====== Database Access ====== | ||
- | ===== Postgres ===== | ||
- | < | ||
- | Security on database Level | ||
- | ===== SQLite ===== | + | * In X2Go Server versions prior to 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), |
- | < | + | |
- | - Change | + | |
- | | + | |
- | ====== | + | ==== SQLite |
+ | |||
+ | * In X2Go Server versions prior to 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http:// | ||
+ | |||
+ | |||
+ | |||
+ | ====== X2Go client-side Printing | ||
<note important> | <note important> | ||
Line 19: | Line 22: | ||
- x2goprint script changes owner ship of PDF file and pushes it into SSHFS share towards the X2go client. | - x2goprint script changes owner ship of PDF file and pushes it into SSHFS share towards the X2go client. | ||
* using X2go printing locally (X2go server == CUPS server) then security (sudo) is not an issue any more(?) | * using X2go printing locally (X2go server == CUPS server) then security (sudo) is not an issue any more(?) | ||
+ | * Nope still is (not a big one, though): Using CUPS the user can easily be faked, allowing to fill someone else's quota or print at their home printer. | ||
- X2goServer != CUPS Server: | - X2goServer != CUPS Server: | ||
- The Cups-server connects the x2go-Server as x2goprint-user using ssh-key auth. | - The Cups-server connects the x2go-Server as x2goprint-user using ssh-key auth. | ||
Line 46: | Line 49: | ||
* Currently Pulse-Audio authentication using a cookie-file is used. | * Currently Pulse-Audio authentication using a cookie-file is used. | ||
* No option of encryption, but can be tunneled via SSH. | * No option of encryption, but can be tunneled via SSH. | ||
- | * When using the TCE the client has only one user. Therefore the following user may get sounds from the previous, suspended user. | + | * When using the TCE the client has only one user. Therefore the following user may get sounds from the previous, suspended user, if not tunneling pulseaudio. |
===== Solution for privacy ===== | ===== Solution for privacy ===== | ||
Line 55: | Line 58: | ||
* This also solves issues if the client get disconnected unexpectedly. | * This also solves issues if the client get disconnected unexpectedly. | ||
- | ====== x2goagent ====== | + | Morty: I looked into this recently (End of 2011). Unfortunately, |
- | < | + | |
- | * Is it possible | + | |
+ | ====== X2Go Agent ====== | ||
+ | * [[http:// | ||
+ | * Now, only for XDMCP session the listening port 6050+ is opened (otherwise XDMCP queries do fail) | ||
+ | * If people need x2goagent listening on TCP, it can also be re-enabled in ''/ | ||
+ | |