ldm with xauth TODO

Warren Togami <[email protected]>
Newsgroups gmane.linux.terminal-server.devel
Message-ID <[email protected]>
I just pushed a minimal implementation of xauth to ldm-trunk.  This 
allows LDM_DIRECTX=true to stop using the insecure -ac option.  The code 
in ldm-trunk is ugly but works.  Here are further TODO items in priority 
order.

* /tmp/foople remains in the rc.d/ script because it is extremely useful 
in debugging the xauth behavior.  I highly suggest we keep it until we 
have fixed these TODO items, then remove it entirely.
* Currently screen.d/ldm avoids generating an xauth file if you are not 
using LDM_DIRECTX because it causes the login to fail with these kinds 
of messages.

Xorg.7.log:
AUDIT: Sun Mar 23 16:38:21 2008: 1335 X: client 1 rejected from local 
host ( uid=0 gid=0 pid=1352 )
   Auth name: MIT-MAGIC-COOKIE-1 ID: -1
AUDIT: Sun Mar 23 16:38:21 2008: 1335 X: client 1 rejected from local 
host ( uid=0 gid=0 pid=1352 )
   Auth name: MIT-MAGIC-COOKIE-1 ID: -1
AUDIT: Sun Mar 23 16:38:21 2008: 1335 X: client 1 rejected from local 
host ( uid=0 gid=0 pid=1352 )
   Auth name: MIT-MAGIC-COOKIE-1 ID: -1
AUDIT: Sun Mar 23 16:38:22 2008: 1335 X: client 1 rejected from local 
host ( uid=0 gid=0 pid=1352 )
   Auth name: MIT-MAGIC-COOKIE-1 ID: -1
AUDIT: Sun Mar 23 16:38:22 2008: 1335 X: client 1 rejected from local 
host ( uid=0 gid=0 pid=1352 )
   Auth name: MIT-MAGIC-COOKIE-1 ID: -1

ldm.log:
Saw sentinel. Logged in successfully
Established ssh session.
Process returned no status
Executing rc files.
Beginning X session.
X session ended.
Executing rc files.
Killing X server.
Ending ssh session.
expect saw: sh-3.2$ Warning: No xauth data; using fake authentication 
data for X11 forwarding.^M
Connection to 172.31.100.254 closed by remote host.^M^M
Connection to 172.31.100.254 closed.^M^M

Both gdm and startx show that it should be possible for this to work. 
We should be able to generate an xauth key unconditionally, but 
apparently something else is going wrong causing it to fail in the ssh 
X11 forwarding case.

* Multiple X's running on the same LTSP client will conflict because 
they share the same XAUTHORITY file path.  It really isn't necessary to 
share it as a unique file name could be generated on-the-fly like the 
attached /usr/bin/startx from F9 script or like gdm.
* Convert LDM to use libXau like gdm instead of running xauth manually. 
  AFAICT this doesn't really gain us anything, except the code becomes a 
little faster, and it becomes much cleaner to implement fixes for the 
previous two problems.

Warren Togami
[email protected]

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net
startx (text/plain, 4 KB)
#!/bin/sh

# $Xorg: startx.cpp,v 1.3 2000/08/17 19:54:29 cpqbld Exp $
#
# This is just a sample implementation of a slightly less primitive
# interface than xinit. It looks for user .xinitrc and .xserverrc
# files, then system xinitrc and xserverrc files, else lets xinit choose
# its default. The system xinitrc should probably do things like check
# for .Xresources files and merge them in, startup up a window manager,
# and pop a clock and serveral xterms.
#
# Site administrators are STRONGLY urged to write nicer versions.
#
# $XFree86: xc/programs/xinit/startx.cpp,v 3.16tsi Exp $

unset DBUS_SESSION_BUS_ADDRESS
unset SESSION_MANAGER
userclientrc=$HOME/.xinitrc
sysclientrc=/etc/X11/xinit/xinitrc


userserverrc=$HOME/.xserverrc
sysserverrc=/etc/X11/xinit/xserverrc
defaultclient=xterm
defaultserver=/usr/bin/X
defaultclientargs=""
defaultserverargs=""
clientargs=""
serverargs=""

if [ -f $userclientrc ]; then
    defaultclientargs=$userclientrc
elif [ -f $sysclientrc ]; then
    defaultclientargs=$sysclientrc






fi
if [ -f $userserverrc ]; then
    defaultserverargs=$userserverrc
elif [ -f $sysserverrc ]; then
    defaultserverargs=$sysserverrc
fi

whoseargs="client"
while [ x"$1" != x ]; do
    case "$1" in
    # '' required to prevent cpp from treating "/*" as a C comment.
    /''*|\./''*)
 if [ "$whoseargs" = "client" ]; then
     if [ x"$clientargs" = x ]; then
  client="$1"
     else
  clientargs="$clientargs $1"
     fi
 else
     if [ x"$serverargs" = x ]; then
  server="$1"
     else
  serverargs="$serverargs $1"
     fi
 fi
 ;;
    --)
 whoseargs="server"
 ;;
    *)
 if [ "$whoseargs" = "client" ]; then
     clientargs="$clientargs $1"
 else
     # display must be the FIRST server argument
     if [ x"$serverargs" = x ] && \
   expr "$1" : ':[0-9][0-9]*$' > /dev/null 2>&1; then
  display="$1"
     else
  serverargs="$serverargs $1"
     fi
 fi
 ;;
    esac
    shift
done

# process client arguments
if [ x"$client" = x ]; then
    # if no client arguments either, use rc file instead
    if [ x"$clientargs" = x ]; then
 client="$defaultclientargs"
    else
 client=$defaultclient
    fi
fi

# process server arguments
if [ x"$server" = x ]; then
    # if no server arguments or display either, use rc file instead
    if [ x"$serverargs" = x -a x"$display" = x ]; then
 server="$defaultserverargs"
    else
 server=$defaultserver
    fi
fi

if [ x"$XAUTHORITY" = x ]; then
    XAUTHORITY=$HOME/.Xauthority
    export XAUTHORITY
fi

removelist=

# set up default Xauth info for this machine
case `uname` in
Linux*)
 if [ -z "`hostname --version 2>&1 | grep GNU`" ]; then
  hostname=`hostname -f`
 else
  hostname=`hostname`
 fi
 ;;
*)
 hostname=`hostname`
 ;;
esac

authdisplay=${display:-:0}



mcookie=`dd if=/dev/random bs=16 count=1 2>/dev/null | hexdump -e \\"%08x\\"`
if test x"$mcookie" = x; then
                echo "Couldn't create cookie"
                exit 1
fi

dummy=0

# create a file with auth information for the server. ':0' is a dummy.
xserverauthfile=$HOME/.serverauth.$$
trap "rm -f $xserverauthfile" HUP INT QUIT ILL TRAP KILL BUS TERM
xauth -q -f $xserverauthfile << EOF
add :$dummy . $mcookie
EOF
serverargs=${serverargs}" -auth "${xserverauthfile}

# now add the same credentials to the client authority file
# if '$displayname' already exists do not overwrite it as another
# server man need it. Add them to the '$xserverauthfile' instead.
for displayname in $authdisplay $hostname$authdisplay; do
     authcookie=`xauth list "$displayname" \
       | sed -n "s/.*$displayname[[:space:]*].*[[:space:]*]//p"` 2>/dev/null;
    if [ "z${authcookie}" = "z" ] ; then
        xauth -q << EOF
add $displayname . $mcookie
EOF
 removelist="$displayname $removelist"
    else
        dummy=$(($dummy+1));
        xauth -q -f $xserverauthfile << EOF
add :$dummy . $authcookie
EOF
    fi
done
xinit $client $clientargs -- $server $display $serverargs


if [ x"$removelist" != x ]; then
    xauth remove $removelist
fi
if [ x"$xserverauthfile" != x ]; then
    rm -f $xserverauthfile
fi





if command -v deallocvt > /dev/null 2>&1; then
    deallocvt
fi
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.