Jump to contentJump to page navigation: previous page [access key p]/next page [access key n]
openSUSE Leap Documentation › Security Guide › Network Security › X Window System and X Authentication
ContentsContents
Security Guide
  1. About This Guide
  2. 1 Security and Confidentiality
  3. I Authentication
    1. 2 Authentication with PAM
    2. 3 Using NIS
    3. 4 Setting Up Authentication Clients Using YaST
    4. 5 LDAP—A Directory Service
    5. 6 Network Authentication with Kerberos
    6. 7 Active Directory Support
  4. II Local Security
    1. 8 Spectre/Meltdown Checker
    2. 9 Configuring Security Settings with YaST
    3. 10 Authorization with PolKit
    4. 11 Access Control Lists in Linux
    5. 12 Encrypting Partitions and Files
    6. 13 Certificate Store
    7. 14 Intrusion Detection with AIDE
  5. III Network Security
    1. 15 X Window System and X Authentication
    2. 16 SSH: Secure Network Operations
    3. 17 Masquerading and Firewalls
    4. 18 Configuring a VPN Server
  6. IV Confining Privileges with AppArmor
    1. 19 Introducing AppArmor
    2. 20 Getting Started
    3. 21 Immunizing Programs
    4. 22 Profile Components and Syntax
    5. 23 AppArmor Profile Repositories
    6. 24 Building and Managing Profiles with YaST
    7. 25 Building Profiles from the Command Line
    8. 26 Profiling Your Web Applications Using ChangeHat
    9. 27 Confining Users with pam_apparmor
    10. 28 Managing Profiled Applications
    11. 29 Support
    12. 30 AppArmor Glossary
  7. V SELinux
    1. 31 Configuring SELinux
  8. VI The Linux Audit Framework
    1. 32 Understanding Linux Audit
    2. 33 Setting Up the Linux Audit Framework
    3. 34 Introducing an Audit Rule Set
    4. 35 Useful Resources
  9. A GNU Licenses
Navigation←→
openSUSE Leap Documentation › Security Guide › Network Security › X Window System and X Authentication
Top
←→
Applies to openSUSE Leap 15.1

15 X Window System and X Authentication Edit source

As mentioned at the beginning, network transparency is one of the central characteristics of a Unix system. X, the windowing system of Unix operating systems, can use this feature in an impressive way. With X, it is no problem to log in to a remote host and start a graphical program that is then sent over the network to be displayed on your computer.

When an X client needs to be displayed remotely using an X server, the latter should protect the resource managed by it (the display) from unauthorized access. In more concrete terms, certain permissions must be given to the client program. With the X Window System, there are two ways to do this, called host-based access control and cookie-based access control. The former relies on the IP address of the host where the client should run. The program to control this is xhost. xhost enters the IP address of a legitimate client into a database belonging to the X server. However, relying on IP addresses for authentication is not very secure. For example, if there were a second user working on the host sending the client program, that user would have access to the X server as well—like someone spoofing the IP address. Because of these shortcomings, this authentication method is not described in more detail here, but you can learn about it with man xhost.

In the case of cookie-based access control, a character string is generated that is only known to the X server and to the legitimate user, like an ID card of some kind. This cookie is stored on login in the file .Xauthority in the user's home directory and is available to any X client wanting to use the X server to display a window. The file .Xauthority can be examined by the user with the tool xauth. If you rename .Xauthority, or if you delete the file from your home directory by accident, you will not be able to open any new windows or X clients.

SSH (secure shell) can be used to encrypt a network connection and forward it to an X server transparently. This is also called X forwarding. X forwarding is achieved by simulating an X server on the server side and setting a DISPLAY variable for the shell on the remote host. Further details about SSH can be found in Chapter 16, SSH: Secure Network Operations.

Warning
Warning: X Forwarding Can Be Insecure

If you do not consider the computer where you log in to be a secure host, do not use X forwarding. If X forwarding is enabled, an attacker could authenticate via your SSH connection. The attacker could then intrude on your X server and, for example, read your keyboard input.

→Chapter 16 SSH: Secure Network Operations←Part III Network Security
Print this page

© 2020 SUSE