Fedora has issued an advisory on March 6: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JSPXW5WCJM4QIBQVMB3FWB7BP2LWAL45/ Mageia 5 and Mageia 6 are also affected.
Whiteboard: (none) => MGA6TOO
Status comment: (none) => Patch available from Fedora
Assigning to all packagers collectively, since there is no registered maintainer for this package.
CC: (none) => ghibomgx, marja11Assignee: bugsquad => pkg-bugs
CC: (none) => smelrorAssignee: pkg-bugs => smelror
Advisory ======== The nx package has been updated to fix a security issue. CVE-2017-2624: Timing attack against MIT Cookie References ========== https://security-tracker.debian.org/tracker/CVE-2017-2624 Files ===== Uploaded to core/updates_testing: nxagent-3.5.0.33-1.mga6 nxproxy-3.5.0.33-1.mga6 x2goagent-3.5.0.33-1.mga6 lib64nxX11_0-3.5.0.33-1.mga6 lib64xcomp3-3.5.0.33-1.mga6 lib64xcompext3-3.5.0.33-1.mga6 from nxagent-3.5.0.33-1.mga6.src.rpm
Version: Cauldron => 6CVE: (none) => CVE-2017-2624Assignee: smelror => qa-bugsStatus comment: Patch available from Fedora => (none)Whiteboard: MGA6TOO => (none)
Cauldron has also been updated.
Been working all day on this without any progress. If I cannot get it working in another couple of hours shall pass it over to somebody else.
CC: (none) => tarazed25
Still trying to get this to work. nomachine is not an option so I am concentrating on x2go. x2goserver is running on machine difda. $ systemctl status x2goserver ● x2goserver.service - X2Go session cleanup Loaded: loaded (/usr/lib/systemd/system/x2goserver.service; enabled; vendor p Active: active (running) since Sat 2018-03-17 09:51:31 GMT; 2 days ago Process: 18177 ExecStart=/usr/sbin/x2gocleansessions (code=exited, status=0/SU Main PID: 18387 (x2gocleansessio) CGroup: /system.slice/x2goserver.service └─18387 /usr/bin/perl /usr/sbin/x2gocleansessions Warning: Journal has been rotated since unit was started. Log output is incomple x2goclient is running on machine belexeuli. Tried setting up sessions several times but the login always fails. But this always works from belexeuli: $ ssh lcl@difda and the login works in the other direction also. One puzzle is the 'path' field in session properties; it is always / and cannot be changed. What should that be? My inclination would be to point it to the home directory but it cannot be set - the entry field is greyed out. There are no messages in the journal. Trying to find some kind of session log.
All I could find was this, an extract from /var/log/auth.log around the time the connection was attempted. Mar 19 18:46:13 difda sshd[31774]: Accepted keyboard-interactive/pam for lcl from 192.168.1.156 port 50878 ssh2 Mar 19 18:46:13 difda systemd-logind[18179]: New session c9 of user lcl. Mar 19 18:46:13 difda sshd[31774]: pam_unix(sshd:session): session opened for user lcl by (uid=0) Mar 19 18:46:36 difda sshd[31958]: rexec line 118: Deprecated option UsePrivilegeSeparation Mar 19 18:46:36 difda sshd[31958]: error: key_load_private: invalid format Mar 19 18:46:36 difda sshd[31958]: error: key_load_public: invalid format Mar 19 18:46:36 difda sshd[31958]: error: Could not load host key: /etc/ssh/ssh_host_key Mar 19 18:46:54 difda sshd[31777]: Received disconnect from 192.168.1.156 port 50878:11: Bye Bye Mar 19 18:46:54 difda sshd[31777]: Disconnected from user lcl 192.168.1.156 port 50878 Mar 19 18:46:54 difda systemd-logind[18179]: Removed session c9. Mar 19 18:46:54 difda sshd[31774]: pam_unix(sshd:session): session closed for user lcl It is referring to /etc/ssh/ private and public keys, which seem to be encrypted.
Attempted to open a client session on belexeuli and noted the precise time. On difda the tail of auth.log shows: Mar 19 19:24:32 difda sshd[12744]: rexec line 118: Deprecated option UsePrivilegeSeparation Mar 19 19:24:32 difda sshd[12744]: error: key_load_private: invalid format Mar 19 19:24:32 difda sshd[12744]: error: key_load_public: invalid format Mar 19 19:24:32 difda sshd[12744]: error: Could not load host key: /etc/ssh/ssh_host_key Mar 19 19:24:32 difda sshd[12744]: Accepted keyboard-interactive/pam for lcl from 192.168.1.156 port 51206 ssh2 Mar 19 19:24:32 difda systemd-logind[18179]: New session c12 of user lcl. Mar 19 19:24:32 difda sshd[12744]: pam_unix(sshd:session): session opened for user lcl by (uid=0) On belexeuli the connection failed immediately. On difda: $ ps aux | grep 12744 root 12744 0.0 0.0 82808 6440 ? Ss 19:24 0:00 sshd: lcl [priv] So does this mean that the problem is at the client end?
No auth.log on the client end. The journal contains this section at the time of the connection attempt: Mar 19 19:24:11 belexeuli pkexec[21152]: pam_systemd(polkit-1:session): Cannot create session: Already running in a session Mar 19 19:24:11 belexeuli pkexec[21152]: pam_unix(polkit-1:session): session opened for user root by (uid=1000) Mar 19 19:24:12 belexeuli pkexec[21166]: pam_systemd(polkit-1:session): Cannot create session: Already running in a session Mar 19 19:24:12 belexeuli pkexec[21166]: pam_unix(polkit-1:session): session opened for user root by (uid=1000) Mar 19 19:24:12 belexeuli pkexec[21173]: pam_systemd(polkit-1:session): Cannot create session: Already running in a session Mar 19 19:24:12 belexeuli pkexec[21173]: pam_unix(polkit-1:session): session opened for user root by (uid=1000) Mar 19 19:24:12 belexeuli pkexec[21180]: pam_systemd(polkit-1:session): Cannot create session: Already running in a session Mar 19 19:24:12 belexeuli pkexec[21180]: pam_unix(polkit-1:session): session opened for user root by (uid=1000)
MGA6-32 on Dell Latitude D600 Mate Installing packages from Comment 2 is OK, but that's not a complete environment to test. Found https://wiki.x2go.org/doku.php/wiki:repositories:start and trying to make sense of it. Will report later on any progress.
CC: (none) => herman.viaene
It seems you need to install x2goserver and x2goclient. And have sshd running on the server side. I've been able to run x2goclient, define a connection to the server (on the same laptop) and connect. That works up to a certain level where i get an error saying that the server side cannot find a sqlite-perl item. Investigating further, but that won't be today anymore.
Tried the same experiment as Herman on x86_64. The connection failed immediately with exactly the same error as before: "Cannot connect to X server". So this does not seem to be a networking problem at all - it looks more like a privilege or permissions problem. The user is a member of the x2gouser group. And, even though the server is running on the same machine there is no /var/log/auth.log. $ x2goclient --debug Tried the localhost connection and failed to connect as usual. Debug messages: $ x2go-INFO-1> "Starting X2Go Client..." x2go-WARNING-1> "English language requested, not loading translator." x2go-WARNING-1> "English language requested, not loading translator." x2go-INFO-3> "Started X2Go Client." x2go-DEBUG-../src/onmainwindow.cpp:517> "$HOME=/home/lcl" x2go-DEBUG-../src/onmainwindow.cpp:2206> Reading 2 sessions from config file. x2go-DEBUG-../src/sessionbutton.cpp:325> Creating QPixmap with session icon: "//home/lcl/icons/apple-red.png". x2go-DEBUG-../src/sessionbutton.cpp:325> Creating QPixmap with session icon: "//home/lcl/icons/apple-green.png". x2go-DEBUG-../src/onmainwindow.cpp:2686> Creating QPixmap with session icon: '"//home/lcl/icons/apple-green.png"'. x2go-INFO-8> "Starting connection to server: belexeuli:22" x2go-DEBUG-../src/onmainwindow.cpp:2787> Starting new ssh connection to server:"belexeuli":"22" krbLogin: false x2go-DEBUG-../src/sshmasterconnection.cpp:174> SshMasterConnection, host "belexeuli"port 22user "lcl"useproxy falseproxyserver ""proxyport 22 x2go-DEBUG-../src/sshmasterconnection.cpp:211> Starting SSH connection without Kerberos authentication. x2go-DEBUG-../src/sshmasterconnection.cpp:215> SshMasterConnection, instance SshMasterConnection(0xfac520) created. x2go-DEBUG-../src/sshmasterconnection.cpp:451> SshMasterConnection, instance SshMasterConnection(0xfac520) entering thread. x2go-DEBUG-../src/sshmasterconnection.cpp:487> libssh not initialized yet. Initializing. x2go-DEBUG-../src/sshmasterconnection.cpp:798> cserverAuth x2go-DEBUG-../src/sshmasterconnection.cpp:813> state: 1 x2go-DEBUG-../src/sshmasterconnection.cpp:988> Challenge authentication requested. x2go-DEBUG-../src/sshmasterconnection.cpp:866> Have prompts: 1 x2go-DEBUG-../src/sshmasterconnection.cpp:872> Prompt[0]: |Password: | x2go-DEBUG-../src/sshmasterconnection.cpp:878> Password request x2go-DEBUG-../src/sshmasterconnection.cpp:866> Have prompts: 0 x2go-DEBUG-../src/sshmasterconnection.cpp:949> Challenge authentication OK. x2go-DEBUG-../src/sshmasterconnection.cpp:663> User authentication OK. x2go-DEBUG-../src/onmainwindow.cpp:2884> SSH connection established. x2go-DEBUG-../src/onmainwindow.cpp:3193> Continue normal X2Go session x2go-DEBUG-../src/sshprocess.cpp:199> Executing remote command via SshProcess object 0: "export HOSTNAME && x2golistsessions" x2go-DEBUG-../src/sshprocess.cpp:204> this=SshProcess(0xfb2ec0) Running masterCon->addChannelConnection(this, ' "67db5b9f-6bb2-4870-93e3-2fb5d290bcc2" ', ' "bash -l -c 'echo "X2GODATABEGIN:67db5b9f-6bb2-4870-93e3-2fb5d290bcc2"; export PATH="/usr/local/bin:/usr/bin:/bin"; export TERM="dumb"; export HOSTNAME && x2golistsessions; echo "X2GODATAEND:67db5b9f-6" '); x2go-DEBUG-../src/sshmasterconnection.cpp:1324> Locking SSH channel connection MUTEX. x2go-DEBUG-../src/sshmasterconnection.cpp:1326> Passing new channel conenction object to channelConnections. x2go-DEBUG-../src/sshmasterconnection.cpp:1328> Unlocking SSH channel connection MUTEX. x2go-DEBUG-../src/sshmasterconnection.cpp:1516> Creating new channel. x2go-DEBUG-../src/sshmasterconnection.cpp:1520> New channel:0x7fee5800e300 x2go-DEBUG-../src/sshmasterconnection.cpp:1551> Executing remote: "bash -l -c 'echo "X2GODATABEGIN:67db5b9f-6bb2-4870-93e3-2fb5d290bcc2"; export PATH="/usr/local/bin:/usr/bin:/bin"; export TERM="dumb"; export HOSTNAME && x2golistsessions; echo "X2GODATAEND:67db5b9f-6bb2-4870-93e3-2fb5d290bcc2";'" x2go-DEBUG-../src/sshmasterconnection.cpp:1574> New exec channel created. x2go-DEBUG-../src/sshmasterconnection.cpp:1623> EOF on channel 0x7fee5800e300; SshProcess object: 0 x2go-DEBUG-../src/sshmasterconnection.cpp:1746> EOF sent. x2go-DEBUG-../src/sshmasterconnection.cpp:1750> Channel closed. x2go-DEBUG-../src/sshprocess.cpp:517> SSH finished: raw output (stdout): "X2GODATABEGIN:67db5b9f-6bb2-4870-93e3-2fb5d290bcc2 X2GODATAEND:67db5b9f-6bb2-4870-93e3-2fb5d290bcc2 " x2go-DEBUG-../src/sshprocess.cpp:523> Have stderr only, something must be wrong. x2go-DEBUG-../src/sshprocess.cpp:528> SSH finished: false - "Unable to connect to X server " (0). x2go-DEBUG-../src/onmainwindow.cpp:3582> "Unable to connect to X server " "something must be wrong" it says. "Have stderr only" probably refers to the debug stream in the terminal. Completely opaque. So how did you do it Herman?
I did try defining a new session with the SSH RSA key field filled in but did not really know what to put there. Copy/pasted a line from the known_hosts file and tried again. SSH asked if the key was to be trusted - said yes and the whole thing crashed.
Deleted that session and defined another using the RSA key or fingerprint, not sure what it is. It starts with the AAAA string. Tried to login and the gui vanished. No enquiry about trust. After that simply selecting the session causes the gui to crash immediately - no login dialogue. The debug trace ends with: x2go-DEBUG-../src/sshmasterconnection.cpp:798> cserverAuth x2go-DEBUG-../src/sshmasterconnection.cpp:813> state: 1 x2go-DEBUG-../src/sshmasterconnection.cpp:1077> Trying to authenticate user with private key. *** Error in `x2goclient': free(): invalid pointer: 0x00007f259aa4a190 *** Aborted (core dumped)
The same thing happens when I try to connect across the LAN as well after adding the RSA key - an immediate Abort and no login dialogue.
I finally figured out that the program is looking for a file, not the actual key value so pointed it at known_hosts. On entering the user password I was prompted for a passphrase. That did not make sense because there is no passphrase associated with my normal remote logins. All I use is my login password. So I have no idea what is going on. I had deleted my authorized keys and authorized hosts files because I was always forgetting the passphrases. There must be some relics in the known_hosts file so I shall have to delete all my known_hosts files and recreate them - six machines and ten vboxes.
This has got me beat. Removed known_hosts and regenerated keypairs for difda and belexeuli - this time without passphrases. Rebuilt known_hosts by logging in remotely both ways. Tried x2go again on belexeuli, client end and told it to look in known_hosts. As soon as the session is invoked a prompt comes up for a passphrase and since there is none I click or hit return. x2go tried three times then reverted to normal login but simply went through the triple passphrase business again and again. This just does not make sense.
And now a new thing. It is possible to login remotely from a terminal but there is always this message now: sign_and_send_pubkey: signing failed: agent refused operation Password:
Re comment 17. Ahem, working now after sshd restart. No progress with nx / x2go though.
@ Len You should have a working ssh environment before you try x2go, this is nowhere mentioned. I got the first time I defined a session and tried to connect, a question "Do you want to accept this key?" of course! The problem i'm researching now is that apparently on the server side it expects to store/retrieve some info in a Sqlite table, but that isn't there. This seems to be new, I failed up to now to find guidance for that, but I am not ready to give up.
@Herman Yes I always have ssh up and running with .ssh/known_hosts configured and now have added authorized_hosts. All that stuff works without any problem. I tried a completely new nx update on a Plasma partition just now but even starting from scratch have not been able to connect to a localhost session - connection refused every time. The setup procedure was: Install nx update packages Install x2goserver and x2goclient Add user to the x2gouser group Start x2goserver and check status Run x2goclient from the system menus Configure a session in x2goclient server = localhost login = lcl SSH port = 22 Use RSA key = /home/lcl/.ssh/known_hosts session type = KDE Nothing else checked/ticked
Me 2 I tried through two machines with no luck. It claims it is running on the server, but I can't get anything to talk to it. yes SSH is working, I can connect through ssh with a password. yes I set up a pubic/private rsa key yes I tried remmina NX connections yes I tried the No-Machines client Even tried dropping firewall. The only thing next to try is setting up the actual nomachines software and see if I can make that work on a server then client into it. I suspect somewhere there is a config file needing a tweak.
CC: (none) => brtians1
Haven't tried recently because my cauldron doesn't start anymore after a massive upgrade of packages, but in mga6 the x2goserver must have a FQDN, so for instance "localhost.localdomain" as hostname works, but just "localhost" won't. Apart that problem, in some configurations the authentication prompts first for the desktop password, then just followed by the passphrase of the ssh key (an authentication without the ssh key won't work). Other side effects of common interests: on HiDPI screens, e.g. 4k, connecting to a standard remote desktop (e.g. 1024x768) would result in a almost unreadable screen because the characters are too tiny and, to my knowledge there is no magnification function. This because the x2goclient is built against QT4 libraries, and QT5 support is still uncomplete, at least last time I checked (there is also a report here https://bugs.x2go.org/cgi-bin/bugreport.cgi?bug=864, seem shortage of manpower). Another side effect I haven't figure out where it comes from (whether from sound card or elsewhere), is that you get something like "coil whining" during the ethernet connection to remote desktops. Pretty weird.
Tried the degenerate case with localhost.localdomain but at login still get "cannot connect to localhost.localdomain:22" and "connection refused". That was with .ssh/known_hosts specified. However, that file does not contain any reference to localhost.localdomain. Shall experiment with that.
Modified known_hosts by copying the workstation's key to a new entry entitled localhost.localdomain,127.0.0.1 and added localhost.localdomain as an alias for localhost in /etc/hosts. Restarted sshd. This time the there was a dialogue about the host key having been changed - possible man-in-the-middle attack... and there was an offer to replace the key, which I accepted. Failure on login attempt. Edited known_hosts to remove the old entry and tried again. This time it looked as if the key had been accepted but it asked for a passphrase for decryption - which did not exist and eventually defaulted to the normal login, which failed. So, it looks like x2go will not accept unprotected keys. I am abandoning this update.
One more go: Generated a new key-pair with a passphrase and specified id_rsa to x2go. Tried autologin as well and went straight to the input passphrase. It was not accepted, so even if the key is protected x2go will not deal. Could this be a bug?
I've tried a variety of ways. I established to nomachine entities and was able to connect. I stepped back and then took the server back to nxagent and tried to set up the keys per instructions in https://www.nomachine.com/AR02L00785 No which way, these two machines don't want to talk using nxagent and SSH. yes I'm using nomachine SSH mode and private keys set up. stumped.
Using Brian's suggestion of remmina tried remote and local connections but got no further than a terminal connection. In both cases "Unable to connect to X server".
Part of the difference between my setup and Len and Brian is that I try to test this in one machine (but using its FQDN resolved by my DNS server in my network). Due to the message I got I presumed I needed to still install the x2goserver-sqlite package, but to na avail. The error I get is ¨Verbinding mislukt. DBD::SQLite::db prepare failed: no such table: sessions at /usr/lib/x2go/x2gosqlitewrapper.pl line 476. Can't call method "execute" on an undefined value at /usr/lib/x2go/x2gosqlitewrapper.pl line 484. ¨ (connection failed) I´ve up to now found anything that refers to the usage of sqlite in x2go,but apparently it does.
YESSSSS!!!!! Googling with this error learned me that I still needed to run as root: # x2godbadmin --createdb # systemctl restart x2goserver Then as normal user (apart from some warning about nl_BE not found0 I could run x2goclient, connect to my session and I got a working desktop in an x2go window. Well working in a sense that after waiting long enough I could open the MATE menus, I didn´t dare to go any further, this laptop was already severely overloaded. If no one objects up the ladder, I OK this for 32-bit.
Whiteboard: (none) => MGA6-32-OK
@Herman: congratulations on a long & hard win. I am willing to have a go if possible. I have a stand-alone machine, an SSH setup for SVN: $ tree -a .ssh .ssh ├── config ├── known_hosts ├── local ├── local.pub ├── mageia └── mageia.pub and these programs to go with it: lib64ssh4-0.7.5-1.mga6 lib64ssh2_1-1.7.0-2.mga6 openssh-clients-7.5p1-2.1.mga6 openssh-7.5p1-2.1.mga6 openssh-server-7.5p1-2.1.mga6 openssh-askpass-common-7.5p1-2.1.mga6 libssh2_1-1.7.0-2.mga6 php-ssh2-0.12-10.1.mga6 openssh-askpass-qt5-2.0.3-1.mga6 The problem of a FQDN always stumps me. Would you care to summarise what you found necessary to do to make this fly? (Trying to get the essential from the comments is difficult). Perhaps not possible on a single machine.
CC: (none) => lewyssmithKeywords: (none) => advisory
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
@ Lewis Well, I did not do anything particular for this update in the way, that I always have an internal DNS server (my desktop machine) running. All instances of MGA (and Win as well) on the laptops point as first DNS server to this desktop machine and have a full FDQN that is resolved by this DNS server. So, up to now that setup seems to have saved me from all hostname issues.
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0200.html
Status: NEW => RESOLVEDResolution: (none) => FIXED