Re: Netowrk connectivity (was: segfault on font ...)

On Tue, May 18, 2004 at 09:15:39AM -0400, Timothy C. Brown wrote:
> When you say "UNIX domain socket" I assume you are talking about an AF_UNIX
> socket,

It's a PF_UNIX socket. AF_UNIX is the type of their address. The fact
that they have the same numeric value on many platforms doesn't make
them interchangeable.

> SSH doesn't forward these sockets, it creates an
> Xauthority file and forwards the connection over TCP (i'm sure you know all
> this already - i'm typing it for posterity, for those of us who don't know
> it).

The above paragraph is wrong in every relevant particular. Every ssh
server I can think of can forward X11 using unix domain sockets. The
clients obviously can do as they please.

[Skip the lengthly discussion of PF_INET sockets; suffice it to say
that this is an SEP]

> Anyway - that was my digression.  Using TCP should be a possibility; let
> us not ignore it because it is "insecure", when realistically *some* security
> *must* be implemented in Y, beyond what Xauthority generally provides.
> Session cookies are at least a good idea and the client should be smart
> enough to re-establish a session (or the server, in the appropriate cases).

I have to wonder what you think .Xauthority does if not precisely
this, at least with the MIT-MAGIC-COOKIE-1 mechanism (some are
considerably more sophisticated, like MIT-KERBEROS-5). It would
provide a perfectly adequete security scheme.

However, this need not be implemented in Y, should not be, and
probably *will* not be; it's completely the wrong way to go about it,
from the perspectives of security, performance, and
usability. Xsecurity mechanisms other than MIT-MAGIC-COOKIE-1 are
almost never used, and even that is overkill for the scenarios in
which it is used. UID-based authentication over unix domain sockets
should be all we ever need in the server.

-- 
  .''`.  ** Debian GNU/Linux ** | Andrew Suffield
 : :' :  http://www.debian.org/ |
 `. `'                          |
   `-             -><-          |

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAqrbRlpK98RSteX8RAjXpAJ0WZSXwteqJCVrtPSM4NmZ2cI9frgCcCVUO
24cFUCbJGkfs8yElfGXEfpI=
=ufeJ
-----END PGP SIGNATURE-----