XPRA PAM encryption

[ianblum4]

Hello, I have tried this command xpra start --start=xterm -d auth --bind-tcp=0.0.0.0:14505,auth=pam. When using an SSH tunnel PAM works correctly, however but when the username is different and the password is correct, the PAM ignores it and does not check the username. In other words, a user could input a fake username to the XPRA client and the correct password and it incorrectly authenticates them. Futhermore, when using the XPRA client with the command run on the Ubuntu Server, it gets an "ENCRYPTION" error, and I am unable to run PAM with AES Encryption.

I tried this command
xpra start :100 --bind-tcp=0.0.0.0:14511 --tcp-auth=pam --tcp-encryption=AES --tcp-encryption-keyfile=aes_keyfile
Also the command
xpra start :100 --bind-tcp=0.0.0.0:14511,auth=pam --tcp-encryption=AES --tcp-encryption-keyfile=aes_keyfile

ERROR in LOG:

2024-07-01 22:28:38,986 sending challenge "password for user 'joe"
2024-07-01 22:28:39,006 client has requested disconnection: invalid digest

[totaam]

There seems to be a lot of confusion.
PAM is used for authentication, not encryption.

If you're using an SSH tunnel, then you're likely not using the TCP socket at all.

[totaam]

You're using the wrong syntax, again.
Please use the syntax from the documentation.

[ianblum4]

I just copied and passed the syntax from the documentation.

xpra start --start=xterm --bind-tcp=0.0.0.0:10000,encryption=AES,keyfile=key.txt

client:

xpra attach "tcp://localhost:10000/?encryption=AES&keyfile=./key.txt"

This is directly from your website.

Here is for PAM:

xpra start --start=xterm -d auth --bind-tcp=0.0.0.0:10000,auth=pam

Please inform me how to tie them both together so I have a working XPRA program. Thanks.

[totaam]

Sorry, but that's just too many messages to read, not enough responses and some fairly wild claims of "bugs" everywhere.
So I'm taking a break, I will get back to this later.

[ianblum4]

Sure, thanks for helping.

[ianblum4]

Hey Antoine hope you had a nice holiday and weekend. Any updates on this? Your help is greatly appreciated

[totaam]

First things first:

but when the username is different and the password is correct, the PAM ignores it and does not check the username

That's correct and working as intended.
With the default settings, some authentication modules do not allow remote users to try any username they like and restrict authentication to the currently logged in username only:

xpra/xpra/server/auth/sys_auth_base.py

Lines 77 to 80 in 39527ec

	self.username = kwargs.get("username", get_username())
	if str(kwargs.get("client-username", self.CLIENT_USERNAME)).lower() in TRUE_OPTIONS:
	# allow the client to specify the username to authenticate with:
	self.username = kwargs.get("remote", {}).get("username", self.username)

This is the case for pam (aka sys).
To override this behaviour, use auth=pam,client-username=true.
But that's generally not what you want unless you are running a proxy server.

This is directly from your website.

This is not my website, it is the project's documentation.

Please do not paste pictures of text, paste text so that it remains searchable.

I just copied and passed the syntax from the documentation.

The AES example works for me.

Adding auth=sys (or pam) works just as well, except I have to provide my system password to authenticate with the session.

Please note that the syntax in the documentation has been updated for v6.x: 39527ec
(this should not make any difference to pam or sys since you were not using extra attributes in your command lines)

---

If you are still having problems, please read https://github.com/Xpra-org/xpra/wiki/Reporting-Bugs before replying.

[ianblum4]

The AES example is giving me issues. Where should I have the aes_key stored on my windows machine to ensure that it works properly? I got an invalid "AES" error with the attach command.

[totaam]

You haven't read the link, have you?
No command line pasted, no exact error message, no OS or version information, ...

[ianblum4]

Hi I have read the link. Sorry for not including the specific information. Thank you for your help.
I am using a windows machine to use the client and I used the AES example and it is working now.
However I want to use PAM with AES and I am getting the following error, I am running XPRA on a ubuntu machine and get the same error on versions 5.0.9 and 6.1 beta

2024-07-10 12:43:07,381 sending data using AES-CBC encryption
2024-07-10 12:43:07,384 receiving data using AES-CBC encryption
2024-07-10 12:43:07,384 Authentication required by PAM authenticator module
2024-07-10 12:43:07,384  sending challenge using 'xor' digest over tcp connection
2024-07-10 12:43:07,392 Disconnecting client ip address:portnumber
2024-07-10 12:43:07,392  unencrypted packet dropped

This is the command I am using xpra start --start=code --bind-tcp=0.0.0.0:portnumber,encryption=AES,keyfile=keyfile.txt,auth=pam,client-username=true on the Ubuntu Server.
This is the command I am using on my windows machine to launch the tool:
xpra attach tcp://username:password@severipaddress:portnumber/?encryption=AES&keyfile="aes_keyfile.txt"

I can confirm this is working:
xpra start --start=xterm --bind-tcp=0.0.0.0:10000,encryption=AES,keyfile=key.txt

Thank you again for your help.

[totaam]

On MS Windows, use "Xpra_cmd.exe" to see the command output easily, otherwise you have to open the log file afterwards to see the messages.
My guess is that aes_keyfile.txt is not in the directory where xpra is installed (EXE installer? ZIP? version?), so you would need to use a full path instead.
Have you tried from a Linux machine, for example the server itself?
xpra info 'tcp://username:password@127.0.0.1:portnumber/?encryption=AES&keyfile=aes_keyfile.txt'

[ianblum4]

Hey, just to reiterate the AES encryption example is working correctly but when used with PAM it is not working. Used this command on my Linux Machine: xpra start --start=code --bind-tcp=0.0.0.0:port,encryption=AES,keyfile=/home/ianblum1/aes_keyfile.txt,auth=pam,client-username=true

C:\Program Files\Xpra>xpra_cmd.exe attach "tcp://user:password@ip:portnumber/?encryption=AES&keyfile="aes_keyfile.txt"

2024-07-11 23:07:26,645 Xpra GTK3 client version 6.0.1-r0
2024-07-11 23:07:27,355  running on Microsoft Windows Microsoft Windows 11 Home
2024-07-11 23:07:27,363  cpython 3.11
2024-07-11 23:07:32,329 GStreamer version 1.24.3
2024-07-11 23:07:32,355 created named pipe 'Xpra\41652'
2024-07-11 23:07:32,800 keyboard layout 'United States - English' : 'us' (0x409)
2024-07-11 23:07:34,071 OpenGL accelerate missing: numpy_formathandler
2024-07-11 23:07:34,100 OpenGL enabled on 'Intel(R) Iris(R) Xe Graphics'
2024-07-11 23:07:34,482 receiving data using AES encryption
2024-07-11 23:07:34,545 Error: authentication failed:
2024-07-11 23:07:34,545  server requested 'xor' digest, cowardly refusing to use it without encryption

Is my syntax correct for PAM?

[totaam]

With git master 6.2 beta as of b16a48f:

xpra start --start=xterm --bind-tcp=0.0.0.0:10000,encryption=AES,keyfile=key.txt,auth=allow --no-daemon

xpra info 'tcp://foo:bar@127.0.0.1:10000/?encryption=AES&keyfile=key.txt'

Works and the server shows: sending data using AES-CBC encryption and receiving data using AES-CBC encryption

Changing auth=allow to auth=pam - but without using the correct password with xpra info, as expected:

Warning: pam authentication failed: AUTH_ERR
 Authentication failure

Using the correct password for the user running the xpra start command:

pam_authenticate: SUCCESS

And the command succeeds, showing that the username foo is being ignored.

Adding client-username=true, the authentication fails again as foo is not a valid username.
Specifying the correct username, succeeds.

Running the seamless server as root (dangerous!) and adding verify-username=false, I can authenticate using any valid username + password combination.

Note: b16a48f is probably the correct fix for xor.