Xhosts

UNUG Home
Up
Ports
Sendmail
tcp_wrapper
PGP
Firewalls
Linux
Sun OS
Web
setuid
tcpdump
CERT/Hacker Reports
Vendor
SSH
Monitor
Kerberos
AFS
Xhosts
r Command
su_users
Installation
Virus, Trojan, Worm, etc.
Filesystem
Passwords
Monitor Logs
Physical Security
User Management

18.       Xhosts command

Host level security is maintained through an xhost file (host access control list).  The xhost command is used to grant access to specific hosts or to all hosts, or it can be used to deny access to all hosts.

User level security is available through an xauthority list (user access control list). The xauth command is used to main this list.

Where possible, only trusted hosts or users should be allowed access.  Convenience is not sufficient reason to give universal access. “xhost +” gives access to all hosts; “xhost –“ removes access from all hosts.  Examples of what could happen if untrusted hosts or uses are allowed access include:

·        An x-window, mimicking a standard screen (perhaps with a password field), can be displayed on your system.  Non-authorized people could capture input in that window.

·        An invisible x-window can be placed on your system which can monitor all your keystrokes.

Review the xhost lists regularly.  Hosts are identified by IP address or by name.  The IP addresses or names can change, and the change is often likely to happen without your knowledge.  Give access only to a host that you know needs to display at your terminal screen.  For example, if I want my workstation to display X output from a remote host, I should explicitly issue an xhost command for that host only (e.g. xhost remote.la.asu.edu).  This will allow only users from that host to display at your workstation.

Some systems are shipped with “xhost +” enabled (SGI IRIX for example).  This is a serious oversight and should be corrected.  At the very least you should issue the “xhost –“ command as part of your system startup thereby making it the default for all users.

Other suggestions for X users include:

·        Review the xauthority lists regularly. Userids may be reassigned to other people.

·        If the x server can log security-related events, activate the log and then review it periodically.

·        When a specific host or user no longer needs access, remove the entry from the appropriate list