Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Introduction to Linux - A Hands on Guide
This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.
Click Here to receive this Complete Guide absolutely free.
I just installed x11vnc and tightvnc-java. I set up a cool .x11vncrc in my home directory to keep the vnc session open, to look for a password I had generated with x11vnc -storepasswd, and so on. Pretty darn useful to connect to an already extant X desktop (like winders VNC) rather than creating some new one from scratch. I typed `x11vnc` and it started up according to my .x11vncrc configuration, then I connect to my computer from work --
I then realized that the X desktop it hooked me up to was not my own. It was another user I had created and left logged in to X. I never had to enter that user's password; it only checked the password in the password file I told it to generate in one of my directories. So, on a system where x11vnc is installed, could you not gain access to any other user's running X desktop? How could I make this more secure?
in order for the users desktop to be made accessible without using a password then they will have needed to run x11vnc with options to not require one. i don't see a security hole other than stupid users.
But that other user did not run x11vnc, I did. In other words, x11vnc just hooked onto display :0, regardless that it was not my X desktop! That user whose X desktop I can have access to may be stupid, they may be smart, who can say? There was nothing that other user did to configure anything one way or another, all defaults so far as I know. Should some user, me, be able to access their desktop via x11vnc? Whether or not I "stupidly" ran x11vnc isn't going to make the other user feel better when I steal all their embarassing holiday photos or send incriminating emails, etc etc etc.
i'm not a position to test this but I would assume that your default xhosts configuration is less than ideal. by deafult only the server owner on local host should be able to connect to the server instance. if you run "xhost +localhost" then that would explicitly allow any local user to connec to the server, and allow things like x11vnc to be run. what is configured for that user if you run "xhost"?
If this is the default behavior, isn't that pretty unsafe? I wouldn't know to change anything to keep someone gaining access to my desktop through VNC. I only noticed this by accident...
If I run `xhost` I get: