I'm a new user to Linux, but I"ve been using Windows products for a few years now. I'm running version 3.9 of Knoppix (LiveCD, not HD install). I've read on many places that there is a keylogging security hole in the X Windows session on port 6000. I've tried "xhost -", which is what one of the articles suggested, but I'm not exactly sure if that covered it. Any help would be greatly appreciated.

Note: This is obviously a home box, not a server, and I'm not running any services.

Stony1205

Yes. In general, someone can grab your mouse/keyboard and control your session or log your keys as you say.
For example see progie "xremote".

If you run the "xhost -" then access control is enabled and limited to only the hosts you say.
Nowadays, most distributions run the X server with "-auth" option so even with xhost someone cannot connect to the display.
He needs to have the right key. If you want to read more about it try "man xauth"

So, i guess you are ok, but if you want to close the 6000 port after all, you need to run the X server with "-nolisten tcp" option.
Since you run LiveCD version of Knoppix i don't know to tell you how you do it. (perhaps boot in console mode and run the X
from there ??)

I hope i helped.

Yeah, I just wanted to know if my box was compromisable or not. Thanks.

Stony

I recently noticed that port 6000 was open according to firestarter and my logs. After reading about this port I find this a bit disturbing, I'm not sure what happened or how. Is it possible azureus opened this port? lsof -i seemed to suggest the process using it was java. Since then I used firestarter to block outbound connections via 6000 and 7000, (7000 was also in use according to firestarter). Any help? Should I bee concerned? How would this

Thanks

**happen?....