[CentOS] freenx

[Maciej Żenczykowski]

> copied the above key (that which was between the ----BEGIN and -----END
> but not including those lines) and pasted into the key section and that

why without the --begin-- --end-- lines?  I always copy with'em.

> 1 - there is no /etc/nxserver/node.conf #only node.conf.sample

well, you should probably make a node.conf and allow all users to login...

my /etc/nxserver/node.conf has:
ENABLE_USERMODE_AUTHENTICATION="1"
ENABLE_FORCE_ENCRYPTION="1"
SSHD_CHECK_IP="1"
DISPLAY_BASE=20
SESSION_LIMIT=50
SESSION_USER_LIMIT=10
NX_LOG_LEVEL=7
NX_LOG_SECURE=0
DEFAULT_X_WM="twm"
EXPORT_USERIP="1"
EXPORT_SESSIONID="1"
ENABLE_USESSION="1"
COMMAND_SESSREG="/usr/X11R6/bin/sessreg"
APPLICATION_LIBRARY_PATH="/usr/lib/NX/lib"

> 2 - the pub key I listed above apparently is the one distributed with
> the binary and that would seem to be a security issue

Agreed and that's why I don't use it.

I generate keys using ssh-keygen, and stick them into:
/var/lib/nxserver/home/.ssh/authorized_keys2
(or without the '2' depends on sshd server setup)
[in one line] and the entire private key into the client.

Basically:

# ssh-keygen -t dsa -f key
<enter: empty passphrase>
<enter again>
# cat key.pub >> /var/lib/nxserver/home/.ssh/authorized_keys2
{ you might want to actually prefix the key with from="ip.ip.ip.ip" or 
from="fully.qualified.domain.name" to further restrict logins to valid IPs 
only but do this only once everything is working... }
< copy "key" into the client >

# cat /etc/passwd | grep nx
nx:x:110:110:NX Remote Access:/var/lib/nxserver/home:/usr/bin/nxserver
# cat /etc/shadow | grep nx
nx:!!:13002::::::
# cat /etc/group | grep nx
utmp:x:22:nx
nx:x:110:
# cat /etc/gshadow | grep nx
utmp:x::nx
nx:!::

Make sure that sshd is configured to let in user NX via pubkey from all 
important IP addresses
(ssh -i key nx at serverip)

Make sure that sshd is configured to let in other users with password from 
localhost
(ssh craig at serverip
<type in password>)


Might still be missing something, but any other problems should show up as 
errors in /var/log/secure or /var/log/messages or the nx logs.

Oh, make sure bash-completion is _NOT_ installed.

Cheers,
MaZe.