[NTLUG:Discuss] Redhat, xdm, and cooser

[Joel Sinor]

Which is why, by default, sshd uses Xauth amd makes local virtual displays to represent the X11 tunnel.  Under such circumstances, no one on the other machine can truly connect to the X Server on your local machine without having access to your ~/.Xauthority and knowing which virtual local display you are using...  

On Sat, 05 Apr 2003 19:50:39 -0600
Greg Edwards <greg at nas-inet.com> wrote:

> kbrannen at gte.net wrote:
> >> Actually xhost is not the normal way.  It's the way that techy types 
> >> know and also the very-very insecure way.  If most IT upper management 
> >> types knew their engineers were using xhost (and the ramifications) 
> >> they'd flip.
> > 
> > 
> > Well, if I'd said "xhost +" without the machine name (or IP as that's 
> > what the name resolves to), I'd understand your comment.  Can you 
> > elaborate on the insecurity when the machine is specified?
> > 
> > Or are you thinking about the when the "other" machine is a server with 
> > multiple people on it, so someone else could then start a program on his 
> > machine?  That would be a problem and should be avoided, but practically 
> > speaking, I have rarely run into that situation. (though maybe I've just 
> > been lucky :-)
> > 
> >>
> 
> > 
> > Kevin
> > 
> 
> 
>  From "man xhost"
> 
> =======================================================================
> The xhost program is used to add and delete host names or user names to 
> the list allowed to make connections to the X server.  In the  case of 
> hosts, this provides a rudimentary form of privacy control and security. 
>   It is only sufficient for a workstation (single  user) environment, 
> although it does limit the worst abuses.  Environments which require 
> more sophisticated measures should implement the user-based mechanism 
> or use the hooks in the protocol for passing other authentication data 
> to the server.
> =======================================================================
> 
> If you "xhost +" an allowed machine (added to the local host list) and 
> forget to remove it then anyone who logs into the allowed machine can 
> access the host.  Does not matter who the user is since the machine is 
> allowed.  If you "xhost +" without a machine name you might as well be 
> running M$ Windows.  While xhost is a useful tool it's just not a 
> desirable tool if security is of concern.
> 
> The chooser package is a more complete solution IMHO.  With xhost you 
> have to step through the manual process each time you connect while once 
> a chooser is setup it operates just as if you were logged in to the 
> local machine.  The machine to machine protocol is well established and 
> secure.  You are run through normal login on the remote just as if you 
> were sitting at the console.
> 
> The problem has been that Linux hasn't had a good chooser implementation 
> before.  I can't say if the current chooser is any good because I 
> haven't looked at it in over a year.
> 
> -- 
> Greg Edwards
> New Age Software, Inc. - http://www.nas-inet.com
> ======================================================
> Galactic Outlaw        - http://goutlaw.nas-inet.com
>    The ultimate cyberspace adventure!
> 
> 
> _______________________________________________
> https://ntlug.org/mailman/listinfo/discuss