Differences

This shows you the differences between two versions of the page.

--- wiki:security:start [2011/10/17 19:34]
h1 Page moved from security to wiki:security
+++ wiki:security:start [2014/01/08 10:20] (current)
sunweaver [SQLite]
@@ Line 1: / Line 1: @@
+~~NOTOC~~
+====== Thoughts on Security ======
+===== Session Database Backends =====
+==== PostgreSQL ====
-====== Database Access ======
-===== Postgres =====
-<note>No known exploits</note>
-Security on database Level
-===== SQLite =====
+  * In X2Go Server versions prior to 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013.
-<note>No known exploits</note>
-  - Change to x2go-user using suid-perl. This is needed as there is a common database.
-  - Prepared statements should make things safe.
-====== x2goprint ======
+==== SQLite ====
+  * In X2Go Server versions prior to 4.0.1.12 (or 4.0.0.10 for the Baikal LTS release branch), there used to be a [[http://www.cvedetails.com/cve/CVE-2013-7261|root exploit]] that got reported and fixed around X-mas 2013.
+====== X2Go client-side Printing ======
 <note important>Might be exploited if someone becomes x2goprint-user</note>
@@ Line 46: / Line 49: @@
   * Currently Pulse-Audio authentication using a cookie-file is used.
   * No option of encryption, but can be tunneled via SSH.
-  * When using the TCE the client has only one user. Therefore the following user may get sounds from the previous, suspended user.
+  * When using the TCE the client has only one user. Therefore the following user may get sounds from the previous, suspended user, if not tunneling pulseaudio.
 ===== Solution for privacy =====
@@ Line 55: / Line 58: @@
   * This also solves issues if the client get disconnected unexpectedly.
-====== x2goagent ======
+Morty: I looked into this recently (End of 2011). Unfortunately, due to the buffering done on the server, this might start to "swing" (playback getting faster and slower again and again).
-<note>Needs review</note>
-  * Is it possible to hijack an x2go-session? If yes, how? What can we do about it?
+====== X2Go Agent ======
+  * [[http://code.x2go.org/gitweb?p=x2goserver.git;a=commitdiff;h=147d22c44167b9b2d4afbdaf17262555a7af713b|This issue has been fixed]]: x2goagent/nxagent opens a port 6050+ and binds to all network interfaces. This should be tweaked so that x2goagent/nxagent binds to localhost only. Refer to: http://article.gmane.org/gmane.linux.terminal-server.x2go.user/430
+  * Now, only for XDMCP session the listening port 6050+ is opened (otherwise XDMCP queries do fail)
+  * If people need x2goagent listening on TCP, it can also be re-enabled in ''/etc/x2go/x2goagent.options''.

X2Go - everywhere@home

User Tools

Site Tools

Differences

Page Tools