relayed NX

[Shannon]

Hi There,

I am constructing a "secured" NX environment, and need some help. The
situation is:

1. there are 3 machines, A, B, C, where B is the "gateway" between A
and C, in another word, A and C can never contact each other directly,
which is enforced on network level. A is the user's desktop computer,
and C is the user's virtual desktop where work-related contents are
generated/managed.

2. Each user has their own desktop (A) and virtual desktop (C) where
they have absolute control (root privilege). The only security
control must be done on B.

Now the requirements:

1. No unnecessary tunnels. Files must not be transferable via SSH
tunneling, if that is required by the NX setup.

2. Clipboard transfer could be enabled from A to C, i.e. copy contents
from A and paste to C, but NOT the other way round. If this is kinda
hassle, completely disable clipboard transfer between A and C is also
acceptable.

Any help is greatly appreciated.

Sincerely,
Shannon