xhost security

green_t · 03-02-2001, 02:14 AM

I sometimes telnet into another *nix workstation (usually sun unix) and do "setenv DISPLAY my.ip.ad.dr:0.0" so that I can run Xapplications from that computer that display on my computer. I've run "xhost +ot.he.r.ip" on my computer so that the remote computer is allowed to connect to me. I wanted to know if there's any security risk I should be concerned about. Also, is there any way to do it encrypted?

green_t

mathi · 03-02-2001, 03:09 AM

I don't know whether there's a way to encrypt the X-protocol, but it might be a good idea to use ssh instead of telnet.

jeremy · 03-05-2001, 09:05 PM

As long as you trust other.ip you should be OK. If I were you I would use SSH. You can set it up to automatically forward X11 packets.

This is from the OpenSSH man page

Quote:

X11 and TCP forwarding

If the user is using X11 (the DISPLAY environment variable is set), the
connection to the X11 display is automatically forwarded to the remote
side in such a way that any X11 programs started from the shell (or com*
mand) will go through the encrypted channel, and the connection to the
real X server will be made from the local machine. The user should not
manually set DISPLAY. Forwarding of X11 connections can be configured on
the command line or in configuration files.

The DISPLAY value set by ssh will point to the server machine, but with a
display number greater than zero. This is normal, and happens because
ssh creates a ``proxy'' X server on the server machine for forwarding the
connections over the encrypted channel.

ssh will also automatically set up Xauthority data on the server machine.
For this purpose, it will generate a random authorization cookie, store
it in Xauthority on the server, and verify that any forwarded connections
carry this cookie and replace it by the real cookie when the connection
is opened. The real authentication cookie is never sent to the server
machine (and no cookies are sent in the plain).

If the user is using an authentication agent, the connection to the agent
is automatically forwarded to the remote side unless disabled on command
line or in a configuration file.

Forwarding of arbitrary TCP/IP connections over the secure channel can be
specified either on command line or in a configuration file. One possi*
ble application of TCP/IP forwarding is a secure connection to an elec*
tronic purse; another is going trough firewalls.