I am constructing a "secured" NX environment, and need some help. The situation is:
there are 3 machines, A, B, C, where B is the "gateway" between A and C, in another word, A and C can never contact each other directly, which is enforced on network level. A is the user's desktop computer, and C is the user's virtual desktop where work-related contents are generated/managed.
Each user has their own desktop (A) and virtual desktop (C) where they have absolute control (root privilege). The only security control must be done on B, which is shared by the entire group.
Now the requirements:
No unnecessary tunnels. Files must not be transferable via SSH tunneling, if that is required by the NX setup.
Clipboard transfer could be enabled from A to C, i.e. copy contents from A and paste to C, but NOT the other way round. If this is kinda hassle, completely disable clipboard transfer between A and C is also acceptable.
Any help is greatly appreciated.