Re: X11 server connection
on Sun, Mar 23, 2003 at 11:09:33PM -0800, nate (debian-user@aphroland.org) wrote:
> Karsten M. Self said:
>
> >> #export DISPLAY=localhost:0.0
> >> $xhost +localhost
> >
> > Very bad idea. This opens your X session to any user. If you're using a
> > truly brain-dead configuration, this means any host which can see yours on
> > the network can read or write your X connection.
>
> I don't understand why this is bad.. I mean xhost + is usually a bad
> idea but xhost +some_address should restrict it to that one address.
Hint: how are you authenticating your host(s)? Do you trust DNS or
your local network? You *don't* trust your remote network.
> of course if you have multiple users on the same machine it's a bad
> idea, my systems are generally single user(at least systems with X).
Do they allow remote connections? You don't trust them either now.
> but I still have to resort to using xhost +some_address for systems
> that don't have ssh(it can be a real bitch to get ssh working on
> some platforms(strictly non-linux/bsd speaking).
What platform(s)?
I can pretty much guarantee that there's a client for it:
http://www.linuxmafia.com/pub/linux/security/ssh-clients
In particular, PuTTY for legacy MS Windows has a trivial X11 forwarding
option.
> my former employer makes a popular commercial X server/thin client
> solution, and at least at one point (not sure if they fixed it) the
> system ran by default without any access controls(xhost +), though the
> X server did not listen for TCP connections so you had to be on the
> same machine in order to do anything. I was really suprised when they
> said that, they acted like it wasn't anything bad :/ especially since
> the software was used on thin clients, usually multiple users logged
> in at once. I don't think customers ever noticed/complained even.
Post it to BUGTRAQ. See if they (your former employer) notice.
Peace.
--
Karsten M. Self <kmself@ix.netcom.com> http://kmself.home.netcom.com/
What Part of "Gestalt" don't you understand?
Reform three-strikes: stop jailing nonviolent offenders.
http://www.amend3strikes.org/
Reply to: