x2gobroker(1)

💖 NAME 💖

x2gobroker{,-daemon,-ssh} — Session Broker for X2Go

---

✨ SYNOPSIS ✨

x2gobroker [ options ]

x2gobroker-daemon [ options ]

x2gobroker-ssh [ options ]

---

🦋 DESCRIPTION 🦋

okay bestie so x2gobroker (and also x2gobroker-daemon, they're like the same girlie) is a Python Tornado based implementation of the X2Go Session Broker API. And x2gobroker-ssh? Same application, just built for usage via SSH, like as a command line tool. two outfits, one queen 💅

The HTTP(S) implementation of x2gobroker is normally executed either through the host's init system or via the WSGI module in your httpd server. The SSH implementation gets executed by X2Go clients through SSH. slay.

See the included README and TODO for further information on x2gobroker. (yes they're literally just sitting there waiting for you, go look 📖)

---

🌸 GENERAL OPTIONS 🌸

x2gobroker{,-daemon,-ssh} accepts the following common options:

• -M, --mode {HTTP|SSH} — sets the X2Go Session Broker into HTTP or SSH mode. If you omit this option, SSH is the default mode. BUT if x2gobroker-daemon is used as the executable name, then the default mode is HTTP(S). ikyk. 🎀
• -C, --config FILENAME — specify an alternative configuration file name. default is: /etc/x2go/x2gobroker.conf.
• -d, --debug — enable debugging code. this also makes http's POST method available as GET method, which then allows it to test the broker API through a normal web browser. testing era fr 🧪
• -h, --help — display a help with all available command line options and exit. (and then it's gone, bye 👋)

---

💜 SSH MODE COMMAND LINE OPTIONS 💜

x2gobroker-ssh, i.e., when run from the command line or via SSH, accepts/requires these additional options:

• --task {listsessions, selectsession, setpass, testcon} — specify the either of the known broker tasks (listsessions, selectsession, setpass, testcon). This parameter is compulsory, the command execution will fail if it is omitted. no skipping bestie, this one is mandatory 💀
• --user USERNAME — if x2gobroker is run by the magic user (the x2gobroker account by default), then the x2gobroker is allowed to change its user context and do queries on behalf of the user specified with this parameter. main character energy, switching POVs 🪄
• --auth-cookie, --auth-id AUTHENTICATION_COOKIE — it is possible to enforce a stronger authentication via an additional pre-shared authentication cookie. This authentication cookie must be stored in a client-side file so that X2Go Client can access it and then pass it on to the X2Go Session Broker (via the X2Go Client option --auth-id=<fullpath-to-file>) while authenticating against the broker.

The server-side cookie hash can be set in /etc/x2go/x2gobroker.conf (option: my-cookie). You have to set the option require-cookie-auth to true to enable the additional cookie comparison in the X2Go Session Broker. 🍪 (not me making it literally a cookie, but that's what it's called)

• --profile-id, --sid SESSION_PROFILE_ID — for the selectsession task the session profile ID has to be given as an additional parameter.
• --backend BACKEND_NAME — query another than the default broker backend. switching up the backend like it's a whole new aesthetic ✨

---

🌈 HTTP(S) DAEMON OPTIONS 🌈

x2gobroker-daemon in standalone HTTP(S) daemon mode accepts these additional options:

• -b, --bind ADDRESS:PORT — the [address:]port that the Tornado http-engine will bind to (default: 127.0.0.1:8080).
• -D, --daemonize — fork this application to background and detach from the running terminal. girl is leaving the chat 🫡
• -P, --pidfile — custom PID file location when daemonizing (default: <RUNDIR>/x2gobroker/x2gobroker-daemon.pid).
• -L, --logdir — directory where stdout/stderr will be redirected after having daemonized (default: /var/log/x2gobroker/).
• -D, --drop-privileges — if started as root, drop privileges to uid X2GO_DAEMON_USER and gid X2GO_DAEMON_GROUP (as configured in /etc/x2go/broker/defaults.conf on systemd systems or /etc/defaults/python-x2gobroker on SystemV systems).

👀 not me pointing out that -D is listed twice, for two different options — --daemonize and --drop-privileges. that's what the page says, so that's what you get. stay safe out there 💅

---

🎀 SECURITY NOTICE / DISCLAIMER 🎀

bestie, listen. Users are advised to not misinterpret X2Go Session Broker's capabilities as a security feature. Even when using X2Go Session Broker, it is still possible for users to locally configure an X2Go Client with any settings they want, and use that to connect. So if you're trying to keep users from running a certain application on the host, using X2Go Session Broker to "lock" the configuration is the *wrong* way. The users will still be able to run that application by creating their own, local configuration file and using that. it's giving "locking the front door but the window is wide open" 😭

To keep users from running an application on the server, you have to use filesystem permissions on the X2Go Server. In the simplest case, this means setting chmod 750 or chmod 550 on the particular application on the host, and making sure the users in question are not the owner and also not a member of the group specified for the application. that's the actual lock, periodt 🔐

---

🍓 FILES 🍓

/etc/x2go/x2gobroker.conf, /etc/x2go/broker/* (configuration files)

/etc/default/python-x2gobroker, /etc/default/x2gobroker-daemon (environment for X2Go Session Broker when run as a standalone daemon via SystemV or upstart)

/var/log/x2gobroker/* (log files of X2Go Session Broker)

---

⭐ SEE ALSO ⭐

/usr/share/doc/x2gobroker

---

👑 AUTHOR 👑

This manual has been written for the X2Go project by Mike Gabriel <mike.gabriel@das-netzwerkteam.de>.

---

okay that's the whole thing bestie, you ate that 💅 this little masterpiece is Version 0.0.4.x, dated Apr 2020 — go forth and broker some sessions, love u, bye 🦋💖✨