securing XFree86

OK everyone...
Its noob time!

My goal is to secure X so that no one can use it unless they are actually sitting at the server. I'm not sure how X can be exploited so some guidance would be great. I've tried to RTFM but the how-to and man pages for XFree86 don't quite cover it.

When I do netstat -tuapn it shows that X is listening on 0.0.0.0:6000. That means that if it isn't firewalled anyone can get to it right? And even if it is firewalled, someone could possibly get through with a stealth port scanner???

I'm using iptables to filter packets but to be honest, I'm not sure what everything means yet.

I am not sure if my X server is secure b/c I can telnet into port 6000 from within my network. I read something about a "-nolisten tcp" option but I can't figure out how to implement it. I am not even sure if that will secure my X server or not.

I guess the bottom line is how can I tell if my X server is secure and how can I secure it (or where to find out)?

well o do that nolisten jobby you'd say

startx -- -nolisten tcp

you may want to set an alias to it to save typing in.

on a console, or edit your kdm/gdm/xdm config file if you get in that way, replacing calls to "/usr/X11R6/bin/X" to "/blah/X -nolisten tcp". i think that the login manager will probably try to connect to a port tho, so you'll need to stop that somehow... not something i've tried to do.

a couple of handy pages:

http://www.oneeyedcrow.net/tech/securex.html
http://www.math.clemson.edu/~bmoss/l...t/security.htm

Good links...
Thx dood


[edit]

For anyone reading this in the future. I resolved the problem by changing the file:

/etc/X11/xdm/Xservers


...where it says:

":0 local /usr/X11R6/bin/X"


...change it to:

":0 local /usr/X11R6/bin/X -nolisten tcp"


...then restart X.

[/edit]