Re: Setuid problems & OpenSSH X-forwarding

From: Barry Margolin (barmar@genuity.net)
Date: 08/19/02 

From: Barry Margolin <barmar@genuity.net>
Date: Mon, 19 Aug 2002 20:39:04 GMT

In article <6262ae6b.0208191219.3b1d65ea@posting.google.com>,
Jenn <jaz24@drexel.edu> wrote:
>OK, I got the setuid program to work with OpenSSH X-forwarding by
>setting $HOME/.Xauthority to 640. But this must be manually reset upon
>each new ssh session. The .Xauthority file get set back to 600 upon
>exit.
>
>What security implications do I need to be concerned with by opening
>group read, if any? What can someone do w/the MIT_COOKIE or auth list
>output? What data is actually encyrpted in this key when it's
>generated by xdm?

The cookie in the .Xauthority file is basically the password to your X
server. Anyone who can get this can establish an X session with your
server (assuming they can make a connection to the server at the TCP/IP
level). 

-- 
Barry Margolin, barmar@genuity.net
Genuity, Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.

Relevant Pages

  • Re: Setuid problems & OpenSSH X-forwarding
    ... But this must be manually reset upon ... >each new ssh session. ... The cookie in the .Xauthority file is basically the password to your X ... server (assuming they can make a connection to the server at the TCP/IP ...
    (comp.security.ssh)
  • Cant create .Xauthority for users
    ... I'm setting up a new machine with 2.6.8-2-686 kernel on sarge. ... .Xauthority file actually created in user's account. ... user not authorized to run the X server, ... When root does on a similarly configured sarge 2.4.8 machine:: ...
    (Debian-User)
  • Cant create .Xauthority for users
    ... server (root has no problem). ... When user does startx, the nVidia splash screen appears momentarily, ... .Xauthority file actually created in user's account. ... user not authorized to run the X server, ...
    (Debian-User)
  • RE: problems when opening an ssh session
    ... SSH2 uses a protocol that is not compatible with openSSH. ... Now if I open a connection from the SSH 3.2.0 client to the OpenSSH ... So I can open an ssh session with the 3.5p1 server but not with the ...
    (SSH)
  • Re: SSH question (some kind off-topic)
    ... forwarding, for instance, port 110 to the SSH session, or some other ... So my question is what happens in the SSH server then, the traffic can be analyzed on that side? ...
    (freebsd-questions)