A page in your DokuWiki was added or changed. Here are the details:
Date : 2017/10/26 13:19
Browser : Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:56.0) Gecko/20100101
Firefox/56.0
IP-Address : 78.43.91.217
Hostname : HSI-KBW-078-043-091-217.hsi4.kabel-badenwuerttemberg.de
Old Revision: https://wiki.x2go.org/doku.php/doc:howto:tce?rev=1509023729
New Revision: https://wiki.x2go.org/doku.php/doc:howto:tce
Edit Summary: alpha-sorted items
User : stefanbaur
@@ -728,32 +728,32 @@
* Options containing "tftp|rsync|https|http|ftp://your-http-server-ip-here";
should be replaced with the proper HTTP, HTTPS, FTP, or, where mentioned as an
alternative, TFTP or rsync URL for your server. HTTPS is always preferred for security
reasons. Be sure to use only the IP, not a DNS name.
* Options containing
"tftp|rsync|https|http|ftp://your-http-server-ip-or-dns-here"; should be
replaced with the proper HTTP, HTTPS, FTP, or, where mentioned as an alternative, TFTP or
rsync URL
for your server. HTTPS is always preferred for security reasons. IP or DNS name
may be used.
=== These two are mutually exclusive, i.e. never put both of them in the same config ===
- *
''sessionsurl=https|http|ftp://your-http-server-ip-or-dns-here/x2go-tce/x2go-tce.sessions''
- use this to specify a sessions file. You need this unless you are using a
session broker. See below for how to add this file to your HTTP, HTTPS, or FTP
server. Note that whoever manages to spoof the server name can inject rogue
session config files into your ThinClients. To mitigate this risk, use HTTPS,
where the attacker would have to spoof both server name and matching
certificate.
* ''broker-url=ssh:<nowiki>//</nowiki>your-broker-address-here'' - this
allows you to specify an X2Go Session Broker instead of a sessions file (not limited to an
ssh-based broker, works with an http-based broker as well)
+ *
''sessionsurl=https|http|ftp://your-http-server-ip-or-dns-here/x2go-tce/x2go-tce.sessions''
- use this to specify a sessions file. You need this unless you are using a
session broker. See below for how to add this file to your HTTP, HTTPS, or FTP
server. Note that whoever manages to spoof the server name can inject rogue
session config files into your ThinClients. To mitigate this risk, use HTTPS,
where the attacker would have to spoof both server name and matching
certificate.
=== These are entirely optional ===
- * ''xorg-resolution=HRESxVRES'' - will force the horizontal resolution to
HRES and the vertical resolution to VRES, e.g. ''xorg-resolution=1280x1024'',
useful if autodetection for the correct screen size fails, but you do get as
far as seeing the X2Go GUI
- *
''xorgconfurl=tftp|http|https|ftp://your-http-server-ip-or-dns-here/x2go-tce/x2go-tce.xorg.conf''
- when a client outright refuses to boot into the graphical X2Go login screen,
but gets stuck at the console
or a black screen instead, yet you can get the GUI to work using a regular
Linux on the same hardware, you can disable the X Server's autodetection and
force it to use the xorg.conf specified here. Note that you should use a more
descriptive name for the file, as described below. Also note that whoever
manages to spoof the server name can inject rogue xorg config files into your
ThinClients. To mitigate this risk, use HTTPS, where the attacker would have
to spoof both server name and matching certificate.
- *
''pubkey=tftp|http|https|ftp://your-http-server-ip-or-dns-here/x2go-tce/x2go-tce.authorized_keys''
- Allows you to add an ssh public key file to the ThinClient, so your
administrators can log in remotely using SSH. Note that this file needs to be
chmodded 644, not 600, on the web server. **Attention: Whoever manages to
spoof this server name will have root access to your ThinClients. Using HTTPS
will mitigate this - an attacker would not only have to spoof the server name,
but also the matching certificate.**
- * ''bg=https|http|ftp://your-http-server-ip-or-dns-here/x2go-tce/x2go-tce-bg.svg'' -
use this to specify an SVG file to "brand" your X2Go-TCE with. It will replace
theblue background theme of the login screen. See below for how to add this file to your
HTTP, HTTPS, or FTP server. Note that whoever manages to spoof the server name can
inject rogue images into your ThinClients. To mitigate this risk, use HTTPS, where the
attacker would have to spoof both server name and matching certificate.
- *
''branding=https|http|ftp://your-http-server-ip-or-dns-here/x2go-tce/x2go-tce-branding.svg''
- use this to specify an SVG file to "brand" your X2Go-TCE with. It will
replace the seal icon in the lower left of the login screen. See below for how to add
this file to your HTTP, HTTPS, or FTP server. Note that whoever manages to spoof the
server name can inject rogue images into your ThinClients. To mitigate this risk, use
HTTPS, where the attacker
would have to spoof both server name and matching certificate.
- * ''session=sessionname'' - use this to specify a session by name that
should be pre-selected on startup. The name must be listed in the sessions file
and may only contain characters from the following charset: //a-zA-Z0-9.:/ _-//
(We suggest naming the default session ''default'' and using
''session=default''.) As of 2017-10-26, this feature is only available in
builds created from the linuxhaus github repository. The official repository
will follow soon.
- * ''xinerama=left-of|right-of|above|below|same-as'' - Allows you to specify how
multiple screens are handled (same-as clones the primary screen to all secondary screens,
the other commands will cascade and thus expand the screen). Note that the current
implementation will enforce "same-as" if it detects a touch screen driver
(wacom) and no other pointing device. This is so you won't get stuck being unable to log
off, for example, due to your touch device being
limited to one screen.
+ * ''bg=https|http|ftp://your-http-server-ip-or-dns-here/x2go-tce/x2go-tce-bg.svg'' -
use this to specify an SVG file to "brand" your X2Go-TCE with. It will replace
theblue background theme of the login screen. See below for how to add this file to your
HTTP, HTTPS, or FTP server. Note that whoever manages to spoof the server name can
inject rogue images into your ThinClients. To mitigate this risk, use HTTPS, where the
attacker would have to spoof both server name and matching certificate.
+ * ''blank=n|n:n:n'' - Will disable (''blank=0'') or set screensaver
timeout. Use ''blank=n:n:n'' to set DPMS Standby/Suspend/Off values. Standby
value equals screensaver timeout value. All values are given in seconds.
+ *
''branding=https|http|ftp://your-http-server-ip-or-dns-here/x2go-tce/x2go-tce-branding.svg''
- use this to specify an SVG file to "brand" your X2Go-TCE with. It will
replace the seal icon in the lower left of the login screen. See below for how to
add this file to your HTTP, HTTPS, or FTP server. Note that whoever manages to
spoof the server name can inject rogue images into your ThinClients. To
mitigate this risk, use HTTPS, where the attacker would have to spoof both
server name and matching certificate.
* ''ldap=ldap.example.com:389:cn=cngoeshere,dc=example,dc=com'' - this
allows you to specify an LDAP server to connect to - note that this is not
needed for LDAP-based authentication, only when you intend to store entire
session profiles in LDAP. You should really consider using the X2Go Session
Broker instead.
* ''ldap1=ldap-backupserver-1.example.com:389'' - this allows you to specify
the first of up to two LDAP backup servers when using LDAP authentication
* ''ldap2=ldap-backupserver-2.example.com:389'' - this allows you to specify the second of up to two LDAP backup servers when using LDAP authentication
- * ''blank=n|n:n:n'' - Will disable (''blank=0'') or set screensaver timeout. Use ''blank=n:n:n'' to
set DPMS Standby/Suspend/Off values. Standby value equals screensaver timeout
value. All values are given in seconds.
* ''nodpms'' - Will not touch DPMS settings at all (by default, ''blank=0''
does both ''xset s off'' and ''xset -dpms''). Use this along with ''blank=n''
if you do want to blank the screen, but your screen is confused by DPMS
settings.
+ *
''pubkey=tftp|http|https|ftp://your-http-server-ip-or-dns-here/x2go-tce/x2go-tce.authorized_keys''
- Allows you to add an ssh public key file to the ThinClient, so your
administrators can log in remotely using SSH. Note that this file needs to be
chmodded 644, not 600, on the web server. **Attention: Whoever manages to
spoof this server name will have root access to your ThinClients. Using HTTPS
will mitigate this - an attacker would not only have to spoof the server name,
but also the matching certificate.**
+ * ''session=sessionname'' - use this to specify a session by name that
should be pre-selected on startup. The
name must be listed in the sessions file and may only contain characters from
the following charset: //a-zA-Z0-9.:/ _-// (We suggest naming the default
session ''default'' and using ''session=default''.) As of 2017-10-26, this
feature is only available in builds created from the linuxhaus github
repository. The official repository will follow soon.
* ''tcpprint'' - Will allow you to use local LPT/USB printers like "dumb" network
printers (listening to port 9100 and above). Requires MAC->IP mapping in DHCP server (and
optionally, DNS->IP mapping), or static IPs - else your print jobs will end up on random
devices. This setup is preferred over the X2GoClient's built-in printing for locally attached
printers if X2GoServer and ThinClients are on the same network. It is not recommended when your
X2Go connection goes across the internet or when the ThinClient is actually a laptop roaming
between different networks. **Attention:** When used without ''tcpprintonlyfrom'' (see below),
this
means anyone that can reach your thin client via e.g. ping can also send print jobs to it!
* ''tcpprintonlyfrom=x.x.x.x'' - Will allow you to specify which IP address may connect to Port 9100 and above for printing to a locally attached LPT/USB printer. This should be the IP of your CUPS server or whatever print server system you use. Understands the same syntax as xinetd's ''only_from''.
+ * ''xinerama=left-of|right-of|above|below|same-as'' - Allows you to specify how multiple screens are handled (same-as clones the primary screen to all secondary screens, the other commands will cascade and thus expand the screen). Note that the current implementation will enforce "same-as" if it detects a touch screen driver (wacom) and no other pointing device. This is so you won't get stuck being unable to log off, for example, due to your touch device being limited to one screen.
+ * ''xorg-resolution=HRESxVRES'' - will force the horizontal resolution to
HRES and the vertical
resolution to VRES, e.g. ''xorg-resolution=1280x1024'', useful if autodetection
for the correct screen size fails, but you do get as far as seeing the X2Go GUI
+ *
''xorgconfurl=tftp|http|https|ftp://your-http-server-ip-or-dns-here/x2go-tce/x2go-tce.xorg.conf''
- when a client outright refuses to boot into the graphical X2Go login screen,
but gets stuck at the console or a black screen instead, yet you can get the
GUI to work using a regular Linux on the same hardware, you can disable the X
Server's autodetection and force it to use the xorg.conf specified here. Note
that you should use a more descriptive name for the file, as described below.
Also note that whoever manages to spoof the server name can inject rogue xorg
config files into your ThinClients. To mitigate this risk, use HTTPS, where
the attacker would have to spoof both server name and matching certificate.
=== These are only intended to be used with TCE images stored on local media ===
- *
''updateurl=rsync|https|http|ftp://your-http-server-ip-or-dns-here/path-to-update-files'' - Will allow you to update an image in the background when using local storage instead of PXE. Download task will start at a randomized interval to avoid unintentional dDOSing of the update server/network infrastructure. The updater will even work when using NTFS for local storage, but only if the //toram// boot option is used. Regardless of NTFS or not, the updater requires three directories: ''/boot/X2Go-live1, /boot/X2Go-live2, /boot/X2Go-live-download'' **Attention:** Whoever manages to spoof the server name can deploy rogue images to your ThinClients. Even though it is slower, using an HTTPS web server is the safer way of doing this. Be sure that your web server delivers a last-modified header for all files.
- * ''updatesleep=nnnnn'' - Will allow you to specify the upper limit (in seconds) of the update timer's randomizer. Allowed range for upper limit: 240-32767. Will default to 900
if unset or set to an out-of-range value. Lower limit is fixed at 120 seconds.
* ''bwlimit=nnn'' - Will allow you to specify a bandwidth limit (valid
values: 1-100) in percent for the backgrounded update task.
* ''ntfs-uuid='' - Will be required for updating images stored on NTFS filesystems.
Full UUID as shown under /dev/disk/by-uuid/ is preferred, but can work with the volume
serial number shown in the output of "vol c:" as well.
+ * ''updatesleep=nnnnn'' - Will allow you to specify the upper limit (in
seconds) of the update timer's randomizer. Allowed range for upper limit:
240-32767. Will default to 900 if unset or set to an out-of-range value. Lower
limit is fixed at 120 seconds.
+ *
''updateurl=rsync|https|http|ftp://your-http-server-ip-or-dns-here/path-to-update-files''
- Will allow you to update an image in the background when using local storage
instead of PXE. Download task will start at a randomized interval to avoid
unintentional dDOSing of the update
server/network infrastructure. The updater will even work when using NTFS for local storage, but only if the //toram// boot option is used. Regardless of NTFS or not, the updater requires three directories: ''/boot/X2Go-live1, /boot/X2Go-live2, /boot/X2Go-live-download'' **Attention:** Whoever manages to spoof the server name can deploy rogue images to your ThinClients. Even though it is slower, using an HTTPS web server is the safer way of doing this. Be sure that your web server delivers a last-modified header for all files.
===== Querying X2Go-TCE version info =====
images built using the https://github.com/LinuxHaus/live-build-x2go::feature/openbox repository/branch after 2017-07-27 10:50 UTC will create a file ''/var/run/x2go-timestamps''.
--
This mail was generated by DokuWiki at
https://wiki.x2go.org/
_______________________________________________
x2go-commits mailing list
[email protected]
https://lists.x2go.org/listinfo/x2go-commits
