LTSP thin client login through LightDM or GDM

There has been some discussion on the LTSP developer mailing list
about adding supporting for other login display managers than LDM.

Opinsys commissioned me to research the issue, and I came up with a
(hackish and still incomplete) solution that works with LightDM
and GDM (and quite possibly is configurable for other DMs as well).

First, let me recap my understanding of the LDM login mechanism,
please correct me if I got something wrong:

 * screen.d/ldm script is launched during the bootup process; it
   - creates a new Xauthority file
   - creates a magic cookie and adds it with xauth
   - sets some environment variables
   - starts xinit and sources xinitrc.d scripts
   - fires up LDM

 * LDM reads environment variables (some of which come from lts.conf,
   some from the screen.d script), runs ldm rc.d P* pressh and
   I* init scripts, spawns the greeter and waits for user login

 * when user enters login credentials, LDM (using ssh backend) opens
   a "control socket" ssh tunnel to the server, making the ssh
   connection reusable (in the process list this is the one that says
   LTSPROCKS ;) - this connection is used to open the user session
   and trigger LTSPFS mounts (socket naming is strict)

 * LDM then runs the X* xsession rc.d scripts, of which
   X95-run-x-session starts the user's session over a ssh tunnel
   using the same control socket opened earlier

 * all of the previous is executed with root privileges

 * LTSPROCKS - user has a desktop session with working sound,
   USB drives etc ;)


I based this solution on the example ltsp-session script in
libpam-sshauth module. Essentially, I added functions that emulate
LDM functionality within a pam_exec script. The LDM package is still a
requirement; none of the rc.d scripts need any modifications.
These are the most essential files:

/usr/share/ltsp/ltsp-session
/usr/share/ltsp/xsession-stub
/etc/pam.d/common-ltsp-auth
/etc/pam.d/common-ltsp-session

Logging in from LightDM requires some additional files:

/etc/lightdm/lightdm.conf
/etc/pam.d/lightdm
/usr/share/ltsp/screen.d/lightdm
/usr/share/xsessions/ltsp-session.desktop

And a few others for GDM:

/etc/pam.d/gdm
/usr/share/ltsp/screen.d/gdm
/etc/gdm/custom.conf (for LDM_DIRECTX)

The ltsp-session script is called twice during the login process.
First, during the "auth" phase, the password is exposed and copied
to POSIX shared memory using shm_askpass. In the "open_session" phase,
the ssh tunnels are opened and the remote desktop is launched.

The session that the DM launches ("xsession-stub") is a dummy process
that remains alive for the lifetime of the main session ssh tunnel.
This enables proper session closure upon logging out.

Some lts.conf settings are honored, many are not yet tested.
Sound and LTSPFS do work, scanners and printers are untested,
and LDM_DIRECTX works when X server is configured to allow TCP
connections. LDM autologin is not implemented.

The source repository:
https://github.com/opinsys/ltsp-lightdm

See the README in the repo for more details. The license, where not
explicitly mentioned, is "same as LTSP upstream". This is an immature
hack that (at the moment) requires that the user exists in both the
chroot and on the server. Sorry about that.

Any comments?


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net