on Sun, Jun 16, 2002, Osamu Aoki (debian@aokiconsulting.com) wrote:
> On Sat, Jun 15, 2002 at 11:44:33PM -0700, Karsten M. Self wrote:
> > on Fri, Jun 14, 2002, Ron Johnson (ron.l.johnson@cox.net) wrote:
> > > On Fri, 2002-06-14 at 11:11, Ron Johnson wrote:
<...>
> > > > Any ideas? Colin Watson says to remove '-nolisten tcp' from the
> > > > script that starts the local X. I'm going to try that now.
> > >
> > > Progress!! After removing '-nolisten tcp' from
> > > /etc/X11/xinit/xserverrc
> >
> > Restore it. You were given bad advice whose implications you don't
> > understand.
>
> I do understand benefit of SSH but insecure xhost with '-nolisten tcp'
> has advantage if you are behind firewall with slow machines. So do
> not be so harsh like "You were given bad advice" :) Colin Watson has
> been good to me like Karsten M. Self was.
>
> All the discussion about how to set system is really environment
> dependent.
This is true. However, I see far too many people advocating "xhost +"
and disabling "-nolisten tcp", when the first attempt should be an "ssh
-X". If this turns out to be too slow for the necessary task (unlikely
for any business/system need), then other options can be explored. And
again, there are SSH clients (most free) for all significant, and most
insignificant, platforms:
http://www.linuxmafia.com/pub/linux/security/ssh-clients
Telling people to facilitate remote X11 connections by dropping all
security precautions is like telling someone who's complaining of heat
to strip naked. Though effective, there are other options which might
be attempted first -- turning on a fan, closing blinds, upping the A/C,
or trading the slacks, button-down, and tie for shorts, T-shirt, and
sandals. The proper solution depends on circumstances and resources,
but there are some alternatives which should be strongly deprecated.
Peace.
--
Karsten M. Self <kmself@ix.netcom.com> http://kmself.home.netcom.com/
What Part of "Gestalt" don't you understand?
KQED FM: The bright spot on the dial: http://www.kqed.org/fm/
Attachment:
pgpqsi_FgDHQl.pgp
Description: PGP signature