2

Question

What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using X, RDP, or (more importantly in our environment) Wayland?

Context

  1. Multiple Computers, and Devices, (Phones, Tablets, etc), with X Servers and X Clients, (Wayland and RDP too)
  2. Internet VPN connections utilizing IPSec
  3. Some local IPSec implemented in the local LAN, (some connections are just transparent GB Ethernet in the server room, developer's private LANs in their offices, etc)
  4. Wireless Access Points with WPA2 - AES/TKIP
  5. Full SSH Deployment

Encrypting the entirety of each session, including Video Display, is overly redundant for us and consumes significant bandwidth.

Exporting X through SSH tunnels adds another layer of encryption that is unnecessary for us, though added keyboard and mouse encryption is desirable.

Clarification: Setting aside the potential risks, (assuming they are acceptable risks), what are the possibilities to encrypt just the keyboard / mouse data?

  • Use separate remote control software which itself is encrypted, or use two SSH tunnels in parallel where one provides the video with encryption set to null and another regular one you control it with – Natanael Oct 27 '15 at 11:01
  • @Natanael Thanks for the help. How would you configure X11, or Wayland, to NOT send keyboard and mouse data, but to allow that data through a Virtual KVM of some sort? If I use a virtual KVM switch, I am sure I can send that data through an SSH tunnel. But even so, would is there still a need to modify the X/Wayland Session to disable keyboard and mouse through the X Session, while allowing keyboard and mouse use for a local user, while allowing keyboard and mouse connections through the virtual KVM switch? – elika kohen Oct 28 '15 at 0:17
  • Perhaps you should ask some sysadmins that – Natanael Oct 29 '15 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.