ldm with xauth TODO
Warren Togami <[email protected]>
| Newsgroups | gmane.linux.terminal-server.devel |
|---|---|
| Message-ID | <[email protected]> |
I just pushed a minimal implementation of xauth to ldm-trunk. This allows LDM_DIRECTX=true to stop using the insecure -ac option. The code in ldm-trunk is ugly but works. Here are further TODO items in priority order. * /tmp/foople remains in the rc.d/ script because it is extremely useful in debugging the xauth behavior. I highly suggest we keep it until we have fixed these TODO items, then remove it entirely. * Currently screen.d/ldm avoids generating an xauth file if you are not using LDM_DIRECTX because it causes the login to fail with these kinds of messages. Xorg.7.log: AUDIT: Sun Mar 23 16:38:21 2008: 1335 X: client 1 rejected from local host ( uid=0 gid=0 pid=1352 ) Auth name: MIT-MAGIC-COOKIE-1 ID: -1 AUDIT: Sun Mar 23 16:38:21 2008: 1335 X: client 1 rejected from local host ( uid=0 gid=0 pid=1352 ) Auth name: MIT-MAGIC-COOKIE-1 ID: -1 AUDIT: Sun Mar 23 16:38:21 2008: 1335 X: client 1 rejected from local host ( uid=0 gid=0 pid=1352 ) Auth name: MIT-MAGIC-COOKIE-1 ID: -1 AUDIT: Sun Mar 23 16:38:22 2008: 1335 X: client 1 rejected from local host ( uid=0 gid=0 pid=1352 ) Auth name: MIT-MAGIC-COOKIE-1 ID: -1 AUDIT: Sun Mar 23 16:38:22 2008: 1335 X: client 1 rejected from local host ( uid=0 gid=0 pid=1352 ) Auth name: MIT-MAGIC-COOKIE-1 ID: -1 ldm.log: Saw sentinel. Logged in successfully Established ssh session. Process returned no status Executing rc files. Beginning X session. X session ended. Executing rc files. Killing X server. Ending ssh session. expect saw: sh-3.2$ Warning: No xauth data; using fake authentication data for X11 forwarding.^M Connection to 172.31.100.254 closed by remote host.^M^M Connection to 172.31.100.254 closed.^M^M Both gdm and startx show that it should be possible for this to work. We should be able to generate an xauth key unconditionally, but apparently something else is going wrong causing it to fail in the ssh X11 forwarding case. * Multiple X's running on the same LTSP client will conflict because they share the same XAUTHORITY file path. It really isn't necessary to share it as a unique file name could be generated on-the-fly like the attached /usr/bin/startx from F9 script or like gdm. * Convert LDM to use libXau like gdm instead of running xauth manually. AFAICT this doesn't really gain us anything, except the code becomes a little faster, and it becomes much cleaner to implement fixes for the previous two problems. Warren Togami [email protected] ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _____________________________________________________________________ Ltsp-developer mailing list. To un-subscribe, or change prefs, goto: https://lists.sourceforge.net/lists/listinfo/ltsp-developer For additional LTSP help, try #ltsp channel on irc.freenode.net
startx
(text/plain, 4 KB)
#!/bin/sh
# $Xorg: startx.cpp,v 1.3 2000/08/17 19:54:29 cpqbld Exp $
#
# This is just a sample implementation of a slightly less primitive
# interface than xinit. It looks for user .xinitrc and .xserverrc
# files, then system xinitrc and xserverrc files, else lets xinit choose
# its default. The system xinitrc should probably do things like check
# for .Xresources files and merge them in, startup up a window manager,
# and pop a clock and serveral xterms.
#
# Site administrators are STRONGLY urged to write nicer versions.
#
# $XFree86: xc/programs/xinit/startx.cpp,v 3.16tsi Exp $
unset DBUS_SESSION_BUS_ADDRESS
unset SESSION_MANAGER
userclientrc=$HOME/.xinitrc
sysclientrc=/etc/X11/xinit/xinitrc
userserverrc=$HOME/.xserverrc
sysserverrc=/etc/X11/xinit/xserverrc
defaultclient=xterm
defaultserver=/usr/bin/X
defaultclientargs=""
defaultserverargs=""
clientargs=""
serverargs=""
if [ -f $userclientrc ]; then
defaultclientargs=$userclientrc
elif [ -f $sysclientrc ]; then
defaultclientargs=$sysclientrc
fi
if [ -f $userserverrc ]; then
defaultserverargs=$userserverrc
elif [ -f $sysserverrc ]; then
defaultserverargs=$sysserverrc
fi
whoseargs="client"
while [ x"$1" != x ]; do
case "$1" in
# '' required to prevent cpp from treating "/*" as a C comment.
/''*|\./''*)
if [ "$whoseargs" = "client" ]; then
if [ x"$clientargs" = x ]; then
client="$1"
else
clientargs="$clientargs $1"
fi
else
if [ x"$serverargs" = x ]; then
server="$1"
else
serverargs="$serverargs $1"
fi
fi
;;
--)
whoseargs="server"
;;
*)
if [ "$whoseargs" = "client" ]; then
clientargs="$clientargs $1"
else
# display must be the FIRST server argument
if [ x"$serverargs" = x ] && \
expr "$1" : ':[0-9][0-9]*$' > /dev/null 2>&1; then
display="$1"
else
serverargs="$serverargs $1"
fi
fi
;;
esac
shift
done
# process client arguments
if [ x"$client" = x ]; then
# if no client arguments either, use rc file instead
if [ x"$clientargs" = x ]; then
client="$defaultclientargs"
else
client=$defaultclient
fi
fi
# process server arguments
if [ x"$server" = x ]; then
# if no server arguments or display either, use rc file instead
if [ x"$serverargs" = x -a x"$display" = x ]; then
server="$defaultserverargs"
else
server=$defaultserver
fi
fi
if [ x"$XAUTHORITY" = x ]; then
XAUTHORITY=$HOME/.Xauthority
export XAUTHORITY
fi
removelist=
# set up default Xauth info for this machine
case `uname` in
Linux*)
if [ -z "`hostname --version 2>&1 | grep GNU`" ]; then
hostname=`hostname -f`
else
hostname=`hostname`
fi
;;
*)
hostname=`hostname`
;;
esac
authdisplay=${display:-:0}
mcookie=`dd if=/dev/random bs=16 count=1 2>/dev/null | hexdump -e \\"%08x\\"`
if test x"$mcookie" = x; then
echo "Couldn't create cookie"
exit 1
fi
dummy=0
# create a file with auth information for the server. ':0' is a dummy.
xserverauthfile=$HOME/.serverauth.$$
trap "rm -f $xserverauthfile" HUP INT QUIT ILL TRAP KILL BUS TERM
xauth -q -f $xserverauthfile << EOF
add :$dummy . $mcookie
EOF
serverargs=${serverargs}" -auth "${xserverauthfile}
# now add the same credentials to the client authority file
# if '$displayname' already exists do not overwrite it as another
# server man need it. Add them to the '$xserverauthfile' instead.
for displayname in $authdisplay $hostname$authdisplay; do
authcookie=`xauth list "$displayname" \
| sed -n "s/.*$displayname[[:space:]*].*[[:space:]*]//p"` 2>/dev/null;
if [ "z${authcookie}" = "z" ] ; then
xauth -q << EOF
add $displayname . $mcookie
EOF
removelist="$displayname $removelist"
else
dummy=$(($dummy+1));
xauth -q -f $xserverauthfile << EOF
add :$dummy . $authcookie
EOF
fi
done
xinit $client $clientargs -- $server $display $serverargs
if [ x"$removelist" != x ]; then
xauth remove $removelist
fi
if [ x"$xserverauthfile" != x ]; then
rm -f $xserverauthfile
fi
if command -v deallocvt > /dev/null 2>&1; then
deallocvt
fi