xpra icon
Bug tracker and wiki

Version 5 (modified by Antoine Martin, 6 years ago) (diff)

--

Proxy Server

Introduction

This new feature in version 0.11 (see #426) allows a single xpra server to provide access to many xpra sessions through a single entry point, without using SSH for transport/authentication.

This can be very useful for hosts that have a limited number of publicly accessible ports, or for clients accessing servers through firewalls with outbound port filtering. (ie: you can put the server on port 80 or 443)

Depending on the Authentication module configured, the proxy server can expose:

  • all local xpra sessions after user authentication
  • a custom list of sessions configured through the "file-auth" mechanism

Usage

To start the proxy server, simply run:

xpra proxy :20 --auth=sys --bind-tcp=0.0.0.0:443

Note: if you run this command as root, all the user sessions will be exposed. If you run it a normal user, only this user's session will be exposed. Once authenticated, the proxy server spawns a new process and no longer runs as root.

When attaching, the client usually needs to specify its password using the --password-file switch, and if there is more than one live session for that user, it will also need to specify which display it wishes to connect to, using one of those two switches:

  • the "--display=:N" switch
  • the attach syntax: "tcp:SERVER:PORT:DISPLAY

ie:

xpra attach tcp:127.0.0.1:443 --password-file=./password.txt --display=:100

File Authentication Extras

When used with the proxy server, the password file (see Authentication Modules) should contain one user per line using the format:

USERNAME|PASSWORD|UID|GID|SESSION_URI|ENV_VARS|SESSION_OPTIONS

Details:

  • USERNAME and PASSWORD are used for authentication
  • UID and GID are used for the new proxy process (and can be set to nobody)
  • SESSION_URI is the usual xpra connection string of the actual target session, ie:
    tcp:HOST:PORT
    
    or
    ssh:HOST:DISPLAY
    
  • ENV_VARS is an optional attribute which can contain ";" separated name-value pairs which will affect the environment of the new process spawned after authentication.
  • SESSION_OPTIONS is an optional attribute which can contain ";" separated name-value pairs which will override the client's connection settings and apply to the connection between the proxy and the real server only.

Attachments (1)

Download all attachments as: .zip