Chapter 8. Client Platforms
the user to verify the fingerprint of the key. At subsequent connects, this copy is used to verify that the
client is connecting to the correct server.
When running on a diskless Thinstation host, the key can be stored only in volatile memory (on a RAM
disk), so the client will ask the user to verify the fingerprint once each time the client has been rebooted.
Since its normal behaviour to reboot a Thinstation terminal once a day, this will lead to a confusing
situation for users, not to mention that it will decrease security.
To solve this problem, the ThinLinc client package for Thinstation tries to download a file name
ssh_known_hosts from the tftproot. If it exists it will be used as database of known hostkeys on the
client.
To create this file, login with the client to the ThinLinc server, using the same servername as the one that
will be configured on the clients. Then copy the file ~/.thinlinc/known_hosts to
<tftproot>/ssh_known_hosts.
8.7. Web Integration and HTML5 Browser Client
This section includes information about the ThinLinc client types that can be used in conjunction with a
Web Browser. The HTML5 client, and how to launch the Native ThinLinc client from the browser using
the CGI script, are described below.
8.7.1. Launching the Native Client From a Web Page
It is possible to launch the native ThinLinc client from a web page. The process works like this:
1. The CGI script is called with the desired parameters.
2. (optional) A web page containing the Native Client Verification Applet is generated. This applet is
used to verify that the native client is installed. If not, the applet allows the user to install the client.
3. The CGI script generates a "launch file", which is a normal client configuration file. When the
browser recieves this file, it launches the locally installed ThinLinc client.
Note: Only the Windows and Linux client packages configures the system to recognize launch files,
and the Native Client Verification Applet can only verify if the client is installed on Windows and
modern Linux systems.
Note: The Native Client Verification applet requires Java support in the browser. Java 7 contains a
bug: It fails to retrieve the applet if the client’s Server Name Indicator specified a hostname not
supported by the server. To work around this issue, make sure your web server accepts all names in
use. For example, with Apache, you can specify a ServerName and/or ServerAlias directives. The
server can be configured to accept all names by specifying:
<VirtualHost _default_:443>
ServerName catchall.example.com
ServerAlias
*
...
84
Comentarios a estos manuales