[95122] in RedHat Linux List
Re: xclients connecting to xserver
daemon@ATHENA.MIT.EDU (Greg Fall)
Thu Oct 15 10:03:36 1998
Date: Thu, 15 Oct 1998 09:52:54 GMT
From: Greg Fall <gmf@dweezil.dyn.ml.org>
To: redhat-list@redhat.com
In-Reply-To: <3.0.5.32.19981015091120.0080eeb0@fmol.5sigcmd.army.mil>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
>> type xhost + on your term
>
> This will open your Linux box up to anyone that wants to display X apps
> there. It's better to specify the IP or Hostname of the machine you want to
> allow to access your display.
>
> xhost +aaa.bbb.ccc.ddd
People everywhere having the ability to display X apps to your screen is
kooky, but it is the least of your worries when you use "xhost +". The
host-specifying solution above is better, and there's one more thing to
consider. If there is the possibility that not-nice users have access to
the remote machine (aaa.bbb.ccc.ddd) - and you should probably assume
there is - then you should at least move up to magic-cookie
authorization. This is not difficult to figure out. Here's a site that
has some discussion and instructions:
http://dslab.csie.ncu.edu.tw/~lucas/security.html
Some of their recipes for generating cookies don't quite work as written,
but if you use runlevel 5 and xdm, xdm handles this part. Even better,
if you have something generating cookies and you use ssh/slogin to make
your remote connection, ssh does the job of sharing the X authorization
stuff without even being told, and the entire process is out of your
hands. So...
Get ssh from http://www.replay.org, set it up, and replace rlogin and
telnet with slogin.
If you're too lazy to use ssh (or if the administrator of the remote
computer is too lazy to install it there) and you're using telnet or
rlogin, you should get into the practice of doing something like this:
(locally, in e.g. an xterm, preferably with 'secure keyboard' set):
% xauth list (should output at least a line that looks like:
my.com.pu.ter:0 MIT-MAGIC-COOKIE-1 <the authorization key>
% telnet aaa.bbb.ccc.ddd
(on aaa.bbb.ccc.ddd)
% xauth add my.com.pu.ter:0 . <the authorization key>
You may think you don't have the time to bother with all this, but it is
a small investment that may pay off without you ever knowing it.
--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--
Greg Fall
gmfall@engin.umich.edu, gmf@dweezil.dyn.ml.org
http://www-personal.engin.umich.edu/~gmfall
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com http://archive.redhat.com
To unsubscribe: mail redhat-list-request@redhat.com with
"unsubscribe" as the Subject.
