Tunnelling X2go on Windows to resolve Duo issues

Current versions (as of July 2021) of X2go on Windows do not handle Duo MFA well - sessions just revert to the password screen when Duo is successfully navigated.

This document presents a workaround for this using SSH tunnels which have been configured and started in another application.

The most robust workaround for the Duo/X2go issues is probably the use of an SSH Tunnel through remote-access.leeds.ac.uk.

The following articles show how to set up and start such a tunnel using the Windows SSH Clients, MobaXterm or PuTTY.

This article will use the fictitious system 'LinuX2go.leeds.ac.uk' as the final endpoint computer, the example client 'YourUserID' and the example port 19661 as the local port - please change these values to match your details and requirements.

(1) Setup and/or START your SSH Tunnel.

(a) For MobaXterm see KB Article KB0015723

(b) For PuTTY see KB Article KB0015728

(2) Launch the X2go client on Windows and ensure that your session is configured to use the tunnel or create a completely new session. The first tab will look something like the figure below and you should complete the four sections shown (Session name, Host, Login and SSH port) - the Host MUST be localhost, the remainder should be set to your requirements:

(3) You can configure the other tabs to your requirements and then click 'OK' - you will then be presented with a screen which contains your new item. Click on the title of the session as shown below:

(4) Enter your password in the section indicated below:

(5) You may get a Host Verification warning - you should check and then trust the host key as shown:

(6) Your X2go session should then connect. If you select the 'Show details' option you may see text similar to that shown below:

(7) When you have finished and closed your X2go session do not forget to shutdown the application which is maintaining the SSH tunnel through remote-access