Re: X server, xhost, and xauth

> Hi Allister
> 
> If you run an x application from a console which is not the same user as the 
> owner of the display, then you will get that message.
> 
> I tend to do an xhost+ before doing an su for this reason, but I should 
> probably add the root user to the xhost command line ... rather than a plus, 
> which would allow anyone to open a session on my display ...
> 
> Cheers,
> Bryan

Well, going a bit further than that, here's how it works:

    The X server starts up either by kdm/xdm/gdm (the display manager)

    you login with a name and a password and choose your window manager

    the window manager becomes the "controlling application" for the X
    server, and if the window manager ever terminates, the server shuts
    down (normally, although this behaviour can be changed)

    when the display manager started the window manager (such as KDE),
    it sets the DISPLAY variable to a value that uniquely identifies
    the X server.  Typically something like "hostname:display.screen",
    where "hostname" is a TCP/IP hostname or IP address, "display" is
    the number of the X server on the host (usually 0), and "screen"
    is which screen of the X server (also usually 0).

    the DISPLAY variable is export'ed and passed to all child processes,
    including konsole, netscape, and everything else.
    
    For security reasons, when you execute "su -" the environment is
    cleared, including DISPLAY.  Recreating the variable and exporting
    is the first step.  Using "su" without the dash is not as secure,
    but your DISPLAY variable doesn't get destroyed either.

    each individual application uses the TCP/IP socket programming
    functions to access the X server, using subroutines like connect().

    Unfortunately, because IP addresses can be faked (called "spoofing"),
    the X server normally only allows connections from the same machine
    through an internal connection that doesn't use TCP/IP.  (This is
    why the DISPLAY variable is often set to ":0.0" without a hostname.)

    the suggested command, "xhost", turns off this connection checking
    either for all hosts (via "xhost +") or for specific hosts (via "xhost
    +hostname").

    If you take that route, use "xhost +localhost" and "xhost +hostname",
    where you substitute your machine's name for "hostname".  This way,
    only connections from your IP address and from 127.0.0.1 are allowed.
    (Of course, if someone else telnet'ed to your box, they could still do
    bad things to your desktop because there no user-level control with
    xhost.)

    A better technique is to use "xauth" instead.  Xauth creates
    an authentication record in a file in your home directory
    (~/.Xauthority) which can restrict access per-user.  To use this
    technique, you would run "xauth extract /tmp/newfile $DISPLAY" to
    extract the proper authentication for your X server and put it into
    a file called "/tmp/newfile".  Then merge it into root's records
    with the command, "xauth merge /tmp/newfile" while su'd to root.
    Now root can open windows on your X server without any xhost-related
    security/reliability issues.

The biggest problem with using xauth, is that the extraction can be easily
automated, but merging it back into root's authentication database means
you have to be root first.  So you would need to do this process every
time you login: login to the X server, open konsole, extract the record,
su to root, merge the record.  Now you're all set until you log out and
log back in again, at which time a new X server will be running and the
old authentication record won't be any good anymore.

> On Thursday 29 May 2003 09:26, Allister Levi Sanchez wrote:
> > Hi,
> >
> > I guess this is off-topic I'm sure somebody in this list knows about how
> > to fix this problem.  Anyway, here goes...
> >
> > I've just installed SuSE 8.2 on my Vaio PCG-GR5F/BP (Japanese model) and
> > everything works great (except the modem, but I don't need it this time
> > anyway).  However, when I do su in a konsole terminal and run X
> > applications, e.g. emacs, I get this error message:
> >
> > allister@ngtalx:~> su
> > Password:
> > ngtalx:/home/allister # emacs
> > Xlib: connection to ":0.0" refused by server
> > Xlib: No protocol specified
> >
> > emacs: Cannot connect to X server :0.0.
> > Check the DISPLAY environment variable or use `-d'.
> > Also use the `xhost' program to verify that it is set to permit
> > connections from your machine.
> >
> > ngtalx:/home/allister #
> >
> > It's my first time ever with SuSE (it's always been Red Hat or Mandrake)
> > so I wonder if somebody could tell me how to fix this in the proper way.
> >
> > Thanks in advance,
> >
> > Allister Levi Sanchez
> > Niigata, Japan

-- 
Frank J. Edwards       Edwards & Edwards Consulting
Voice:  (813)991-5490  http://www.eec.com/
Fax:    (813)991-6074  Training, Contract Programming, and Contract SysAdmin
Email:  [email protected]  "Training -- creating the employee base of the future"