X/OpenGL forwarding

From: Noel (ncookson@networkusa.net)
Date: 01/11/03


From: ncookson@networkusa.net (Noel)
Date: 11 Jan 2003 14:18:58 -0800

Hi,

I have setup a local network that looks like the model
below. The firewall is OpenBSD 3.1 -stable. The workstations
on both the private and dmz are Suns running solaris 8.

I have been asked to allow individuals to start X and OpenGL
Sessions from their home PCs to Host B on the DMZ.

I have ssh up and running on both the firewall and Host B.

I understand that ssh can forward X sessions to the PCs across
the internet to the home PCs. I have a copy of snail book covering
ssh and X forwarding. However the x forwading section is brief
and has left me with a few questions I hope someone can
help me with.

1) Will I be able to forward OpenGL through ssh?

2) When forwarding X is it the ssh server on host B that does the
forwarding or the ssh server on the firewall? Maybe I can
do it either way? If so then wouldn't it be better to have host B
do the forwarding?

3) Is X forwarding really secure? The man pages reference potential
security problems if people have the ability to change file
permissions.

Noel

                                                                                                                                                                           
                      Internet
                         |
                         |
                         |
                     ------------
                     | |
                     | Firewall |
                     | & SSH |
                     | |
                     ------------
                       | |
                       | |
               private | | DMZ Net
               net ---- ----
                    | |
                    | |
                    | |
                    |Host A,C -F ---------- Host B
                ------------ |
                | | ------------
                | Workstations | WWW, SMTP |
                | | | |
                | | | SSH, X, |
                ------------ | OpenGL |
                                      ------------