Re: Netowrk connectivity (was: segfault on font ...)

On Wed, May 19, 2004 at 02:22:25AM +0100, Andrew Suffield wrote:
> On Tue, May 18, 2004 at 09:15:39AM -0400, Timothy C. Brown wrote:
> > When you say "UNIX domain socket" I assume you are talking about an AF_UNIX
> > socket,
> 
> It's a PF_UNIX socket. AF_UNIX is the type of their address. The fact
> that they have the same numeric value on many platforms doesn't make
> them interchangeable.

Valid point, I stand corrected.

> > SSH doesn't forward these sockets, it creates an
> > Xauthority file and forwards the connection over TCP (i'm sure you know all
> > this already - i'm typing it for posterity, for those of us who don't know
> > it).
> 
> The above paragraph is wrong in every relevant particular. Every ssh
> server I can think of can forward X11 using unix domain sockets. The
> clients obviously can do as they please.

The point isn't that SSH can secure this connection, it's that you can't
always rely on SSH to do the heavy lifting for you, nor should you.
Furthermore,  I think we're diverging from the issue here.  The issue is,
should Y do network communication, and, additionally, should we always depend
on domain sockets to be present.  If Y does network communication, which
method does it use - and do we assume that in order for it to do any kind
of network communication reliably that we must use SSH?

> I have to wonder what you think .Xauthority does if not precisely
> this, at least with the MIT-MAGIC-COOKIE-1 mechanism (some are
> considerably more sophisticated, like MIT-KERBEROS-5). It would
> provide a perfectly adequete security scheme.
> 
> However, this need not be implemented in Y, should not be, and
> probably *will* not be; it's completely the wrong way to go about it,
> from the perspectives of security, performance, and
> usability. Xsecurity mechanisms other than MIT-MAGIC-COOKIE-1 are
> almost never used, and even that is overkill for the scenarios in
> which it is used. UID-based authentication over unix domain sockets

MIT-MAGIC-COOKIE-1 works fine; what I meant to say by this statement is
that Y's mechanisms should be similar in scope but more advanced (like,
as you describe, MIT-KERBEROS-5).  When I say similar in scope, I don't mean
that I agree with the implementation method, which was the thrust of my
statement.  UID-based authentication over domain sockets should be a
supported method but not the only method.  

However, if the suggestion is that we should table this discussion until we
get the tires put on the bus, I wouldn't disagree with you.  So what's
your plan for using Y over a network - domain sockets forwarded over SSH
all the time?

Tim