Novell LINUX ENTERPRISE DESKTOP 10 SP2 - DEPLOYMENT GUIDE 08-05-2008 Deployment Manual page 796

In the case of cookie-based access control, a character string is generated that is only
known to the X server and to the legitimate user, just like an ID card of some kind. This
cookie (the word goes back not to ordinary cookies, but to Chinese fortune cookies,
which contain an epigram) is stored on login in the file .Xauthority in the user's
home directory and is available to any X client wanting to use the X server to display
a window. The file .Xauthority can be examined by the user with the tool xauth.
If you were to rename .Xauthority or if you deleted the file from your home direc-
tory by accident, you would not be able to open any new windows or X clients. Read
more about X Window System security mechanisms in the man page of Xsecurity
(man Xsecurity).
SSH (secure shell) can be used to encrypt a network connection completely and forward
it to an X server transparently without the encryption mechanism being perceived by
the user. This is also called X forwarding. X forwarding is achieved by simulating an
X server on the server side and setting a DISPLAY variable for the shell on the remote
host. Further details about SSH can be found in
erations
WARNING
If you do not consider the host where you log in to be a secure host, do not
use X forwarding. With X forwarding enabled, an attacker could authenticate
via your SSH connection to intrude on your X server and sniff your keyboard
input, for instance.
44.1.9 Buffer Overflows and Format String
As discussed in
buffer overflows and format string bugs should be classified as issues concerning both
local and network security. As with the local variants of such bugs, buffer overflows
in network programs, when successfully exploited, are mostly used to obtain root
permissions. Even if that is not the case, an attacker could use the bug to gain access
to an unprivileged local account to exploit any other vulnerabilities that might exist on
the system.
Buffer overflows and format string bugs exploitable over a network link are certainly
the most frequent form of remote attacks in general. Exploits for these—programs to
780 Deployment Guide
(page 743).
Bugs
Section 44.1.5, "Buffer Overflows and Format String Bugs"
Chapter 40, SSH: Secure Network Op-
(page 777),