RFD 51: X11 forwarding

[Joerger]

Current implementation - #9897

[zmb3]

A few minor comments, but LGTM.

[Joerger]

@zmb3 please take another look, I made significant changes to the UX and security sections.

[zmb3]

If this became a problem, we could technically add some code to detect if tsh is aliased and being invoked as ssh, and supporting the ssh flags only in that case.

Right?

[jakule]

@Joerger Do we have any plans to add audit to X11 sessions? I'm not sure if this even possible, but technically having that enabled allows you to run X11 session and do some stuff that goes "under the radar" of our auditing.

[Joerger]

@Joerger Do we have any plans to add audit to X11 sessions? I'm not sure if this even possible, but technically having that enabled allows you to run X11 session and do some stuff that goes "under the radar" of our auditing.

The X11 session is logged in the audit log, but the X11 session is not currently being recorded, I assume that's what you're referring to. It's true that a user could do something like this, such as something simple like opening vscode and deleting/altering files without it being recorded in the session.

This might be possible but hasn't been requested/discussed yet, and we've decided to skip it for the MVP.

But when/if we do it, we'd basically have to tee the byte stream from the X Server Proxy to a session log. Then that byte stream could be sent to the player's $DISPLAY (We may need to add an XServer to the Web UI ??). This step would probably not be so trivial, but I think it would be possible.