Re: [X2go-dev] sudo permissions?

[Rob Lemley]

Hey John,

I double-triple checked again, and tried a session myself that mounted
my desktop with my changes. No issues.

The only script that gets called with sudo is x2gopgwrapper. It's the
only script that can get called as it's the only entry added to the
sudoers file.

x2gopgwrapper calls one of x2pgwrapper_local, x2pgwrapper_sqlite, or
x2pgwrapper_net. That's all it does. Those scripts are a giant case
blocks that only runs sql queries against a database.  In the case of
sqlite you need to assume the id of the sqlite database file owner. (I
thought about making the file group-writable, but chose not to go that
direction. With the sudoers entry and the script there's some level of
protection from average-joe user mangling the database.) As for
postgres, it's the same idea. It can authenticate by userid with the
right entry in pg_hba.conf (?? right filename??)

The mounting and unmounting seems to be done through fuse so the only
privilege needed is to be a member of the fuse group.  The
x2gocleansessions process started by init will unmount a fuse mounted
directory if it finds a stale session, but that is running as root so
there's no issue there.

Enjoy the rest of your getaway!

-rob



On Sat, Oct 2, 2010 at 9:56 AM, John A. Sullivan III
 wrote:
> 
> Hi, Rob.  I'm on a getaway with the family and "sneaking" this in so I
> may be remembering the details incorrectly :)
>
> You may want to trace all the other scripts which are invoked as part of
> the process, especially x2gomount_sessions and x2goumount_sessions.
> These may need root access - I'm not sure - John
>

Hey John,
___
X2go-dev mailing list
X2go-dev@lists.berlios.de
https://lists.berlios.de/mailman/listinfo/x2go-dev

Re: [X2go-dev] sudo permissions?

[John A. Sullivan III]

On Sat, 2010-10-02 at 01:52 -0700, Rob Lemley wrote:
> Hey folks,
> 
> I've been toying around with x2go a bit, and I'm really liking it.
> From what I've seen, the overall architecture is cleaner than freenx
> and even neatx. Certainly none of that insanity of netcat's and
> fdcopy's.
> 
> I was a rather disturbed by the x2goserver package adding a line in my
> sudoers file to allow anyone in the x2gousers group to run
> x2gopgwrapper as root. I checked out that script and the three scripts
> it can potentially call, x2gopgwrapper_{local,net,sqlite}. Other than
> the _net script I see no reason why root access is required. All these
> scripts do is access a database and run queries. The _net script as
> written probably needs root access, but there's no reason why with
> some permission adjustments on the postgres database server that it
> can't run unprivileged as well.
> 
> As I'm just using sqlite on a single system, I did a little experiment
> and made some changes to run that script as an unprivileged user.
> 
> I created an unprivileged x2go user with no password:  (The defaults
> with this particular invocation of useradd are adequate, but the
> account can be restricted some more)
> useradd -r x2go
> 
> So the sudoers entry becomes:
>  X2GO section
> %x2gousers ALL=(x2go) NOPASSWD: /usr/bin/x2gopgwrapper
> 
> Then permissions on the sqlite database need changing so our x2go user
> can run its queries:
> cd /var/db
> sudo chown -R x2go.x2go x2go
> 
> Finally, the scripts in /usr/bin need to be changed so that
> x2gopgwrapper runs at x2go:
> for i in x2go*; do sed -ibak -e 's/sudo x2gopgwrapper/sudo -u x2go
> x2gopgwrapper/' $i; done
> 
> I made these changes on my system and have not had any issues
> connecting. I am only using the x2goserver package at the moment; it's
> just this one script that gets executed as root, I don't know about
> any of the other packages.
> 
> There's also the matter of the x2gocleansessions cleanup script...
> There's a couple of sudo calls in there as well, I didn't change that
> just yet as I've just disabled it altogether to prevent the spam it
> sends to my syslog.
> 
> I apologize if this topic has been brought up before or is discussed
> in the documentation someplace; I looked around and didn't see
> anything. I simply bring this up in the interest of system security.
> The fewer things that run as root the better.
> 
> The changes I describe above are my quick hack-n-fix. If I get a
> chance in the next few days I can throw together a proper fix and
> submit a patch. (And please add my vote to the yes-please git
> repository crowd.)
> 
> 
> X2go seems to have a lot of possibilities and potential. Thanks to
> Heinz and Alex for their hard work.

Hi, Rob.  I'm on a getaway with the family and "sneaking" this in so I
may be remembering the details incorrectly :)

You may want to trace all the other scripts which are invoked as part of
the process, especially x2gomount_sessions and x2goumount_sessions.
These may need root access - I'm not sure - John

___
X2go-dev mailing list
X2go-dev@lists.berlios.de
https://lists.berlios.de/mailman/listinfo/x2go-dev

[X2go-dev] WebP enhancement in X2go (was: Re: X2go-dev Digest, Vol 21, Issue 36)

[Mike Gabriel]

Dear Brian,

Thanks a lot for your hint on WebP technology.

On Sa 02 Okt 2010 14:29:24 CEST brian mullan wrote:


I just read about this.

Google has introduced and open sourced  a new image format to help speed up
the performance of websites called W*ebP*.


it would be great if you could start using mail subjects that describe  
the content of your contribution on this list. After some time may  
have passed, descriptive mail subjects make it much easier for all of  
us to re-find your postings.


Thanks in advance,
Mike

--

DAS-NETZWERKTEAM
mike gabriel, dorfstr. 27, 24245 barmissen
fon: +49 (4302) 281418, fax: +49 (4302) 281419

mail: m.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb
___
X2go-dev mailing list
X2go-dev@lists.berlios.de
https://lists.berlios.de/mailman/listinfo/x2go-dev

Re: [X2go-dev] X2go-dev Digest, Vol 21, Issue 36

[brian mullan]

I just read about this.

Google has introduced and open sourced  a new image format to help speed up
the performance of websites called W*ebP*.

   - *WebP has a 40% improvement over JPEG and WebP was designed to improve
   the compression offered by JPEG*.
   - Google has created a
sitefor Web developers
and users to assess the performance of WebP.
   - The images presented at the site show WebP side-by-side with JPEG
  images. The WebP images are 40 to 50 percent trimmer in bytes
but look the
  same to the human eye.
  - *WebP is based on Google's VP8 codec that they also open-sourced
  recently.  * VP8 is part of the heart of HTML 5's video capability.
  - To trim down file size for WebP, Google used an image compressor
  based on the VP8 codec that Google open-sourced in May 2010.

My question for x2go developers is

 Could WebP (or VP8 codec itself) be implemented
at both the x2go-server and the x2go-client and *possibly get a substantial
improvement* in video performance ??

Currently x2go as most NX oriented solutions (Freenx, NoMachine NX)
typically use JPEG for compression.

But it seems to me that WebP could be implemented and as it is reported to
be 40% more efficient than JPEG...

less bytes means less network traffic and
usually better/faster performance.


Brian Mullan
___
X2go-dev mailing list
X2go-dev@lists.berlios.de
https://lists.berlios.de/mailman/listinfo/x2go-dev

[X2go-dev] sudo permissions?

[Rob Lemley]

Hey folks,

I've been toying around with x2go a bit, and I'm really liking it.
>From what I've seen, the overall architecture is cleaner than freenx
and even neatx. Certainly none of that insanity of netcat's and
fdcopy's.

I was a rather disturbed by the x2goserver package adding a line in my
sudoers file to allow anyone in the x2gousers group to run
x2gopgwrapper as root. I checked out that script and the three scripts
it can potentially call, x2gopgwrapper_{local,net,sqlite}. Other than
the _net script I see no reason why root access is required. All these
scripts do is access a database and run queries. The _net script as
written probably needs root access, but there's no reason why with
some permission adjustments on the postgres database server that it
can't run unprivileged as well.

As I'm just using sqlite on a single system, I did a little experiment
and made some changes to run that script as an unprivileged user.

I created an unprivileged x2go user with no password:  (The defaults
with this particular invocation of useradd are adequate, but the
account can be restricted some more)
useradd -r x2go

So the sudoers entry becomes:
 X2GO section
%x2gousers ALL=(x2go) NOPASSWD: /usr/bin/x2gopgwrapper

Then permissions on the sqlite database need changing so our x2go user
can run its queries:
cd /var/db
sudo chown -R x2go.x2go x2go

Finally, the scripts in /usr/bin need to be changed so that
x2gopgwrapper runs at x2go:
for i in x2go*; do sed -ibak -e 's/sudo x2gopgwrapper/sudo -u x2go
x2gopgwrapper/' $i; done

I made these changes on my system and have not had any issues
connecting. I am only using the x2goserver package at the moment; it's
just this one script that gets executed as root, I don't know about
any of the other packages.

There's also the matter of the x2gocleansessions cleanup script...
There's a couple of sudo calls in there as well, I didn't change that
just yet as I've just disabled it altogether to prevent the spam it
sends to my syslog.

I apologize if this topic has been brought up before or is discussed
in the documentation someplace; I looked around and didn't see
anything. I simply bring this up in the interest of system security.
The fewer things that run as root the better.

The changes I describe above are my quick hack-n-fix. If I get a
chance in the next few days I can throw together a proper fix and
submit a patch. (And please add my vote to the yes-please git
repository crowd.)


X2go seems to have a lot of possibilities and potential. Thanks to
Heinz and Alex for their hard work.

^_^ rob
___
X2go-dev mailing list
X2go-dev@lists.berlios.de
https://lists.berlios.de/mailman/listinfo/x2go-dev