Re: Partial SNAFUs - X11Forwarding etc.

In article <x7MNi.257672$xp6.221608@xxxxxxxxxxxxxxxxxxxxxxxxx> Mike
<Not@xxxxxxxxxxx> writes:

I'm thinking here that with ForwardX11Trusted
set to yes, the client running it over SSH is vunerable to Firefox
security holes and exploits, as if they had it running on the client
machine directly.

I'm not sure I follow you here, but anyway the problem that the
ForwardX11Trusted disabling is addressing isn't with the clients you run
via the X11 forwarding, but rather with *other* clients that are
displaying on the same X11 server. I.e. the evil things would use the
X11 tunnel "itself" to spy on or manipulate those other clients -
doesn't matter if yo have *any* clients using the tunnel as long as it's
there. Of course the tunnel could also be used to attack clients that
*are* running via the tunnel, but if the assumption is that the remote
host is compromised, there are more direct ways to attack those clients
anyway.

The only option I'm seeing here is to work on each desired app to
find a workaround to the apps problems with being called via SSH. For
instance, both Opera and Dillo complain without the -Y flag, but do
function acceptably. Firefox just kicks out a stroppy error message
and refuses to play. If Firefox, for example, could be cajoled into
accepting a pseudo process on the server it live on, then the SSH
client could benefit from having "fooled it".

No, it's not Firefox that is unhappy specifically with being pointed to
a ssh X11 tunnel, it's ssh that is preventing certain X11 protocol
messages from getting through the tunnel. If you use some kind of X11
proxy on the remote host, Firefox won't care one way or the other, but
the proxy will still end up trying to forward those protocol messages
through the tunnel and fail. Well, in theory you could have something
that wasn't just a proxy, and fooled Firefox into believing that the X11
request suceeded, but that can get arbirtrarily complex, since that
first lie will likely require more and more follow-on lies...

....and then you basically end up implementing a virtual X11 server, but
others have already done that, and in fact that may *be* a workaround -
i.e. you simply don't forward the X11 protocol at all. You could e.g.
run Firefox under Xvnc, and then make a "forward" vnc connection via ssh
port forwarding to interact with it. (I've periodically made extensive
use of this technique, with other clients and for other reasons.)

And of course you could run Firefox locally and tell it to use the
builtin SOCKS server a.k.a. "dynamic forwarding" in the ssh client, if
your problem is that you can't get a direct Internet connection from the
client host.

--Per Hedeland
per@xxxxxxxxxxxx
.

Relevant Pages

  • Re: Partial SNAFUs - X11Forwarding etc.
    ... consolecommand "ssh -XY username@P2" ... consolecommand "ssh -XY username@P2 firefox" ... If its just to stop clients messing around with each other's stuff, ...
    (comp.security.ssh)
  • Re: Partial SNAFUs - X11Forwarding etc.
    ... ForwardX11Trusted disabling is addressing isn't with the clients you run ... displaying on the same X11 server. ... untrustworthy) *ssh server* is what 'ForwardX11Trusted no' is for. ... port forwarding to interact with it. ...
    (comp.security.ssh)
  • RE: Commentary on the seven words
    ... When I was an operating systems programmer we all too often forgot that the Operating system existed to support the application, not the other way around. ... A Because the application that we run uses a telnet client that doesn't support ssh - and that's why I can't run ssh on this system. ... I administrate one system that has 128 clients on it and it's ...
    (RedHat)
  • Re: Newbie asking for advice/help with ISA 2004
    ... I tried using firefox in my lab and it worked fine for me (firefox version ... will all of the clients have to be SecureNAT for that to happen? ... internet and you wish to be able to restrict internet access according to ... Our subnet is 192.168.168.x. ...
    (microsoft.public.isaserver)
  • Re: New problem with Firefox
    ... had zero complaints and the forms are in use by clients regularly. ... some of you visited the site back then with both IE and FireFox and noted no ... I suspect that Rob is correct in that it is not the *size* of the monitors, ... up with jumbled pages if you publish with a monitor set at 120 dpi. ...
    (microsoft.public.publisher.webdesign)
Quantcast