Table of Contents
Advertisement
50.1.7 Network Security
Network security is important for protecting from an attack that is started outside. The
typical login procedure requiring a username and a password for user authentication is
still a local security issue. In the particular case of logging in over a network, differen-
tiate between the two security aspects. What happens until the actual authentication is
network security and anything that happens afterwards is local security.
50.1.8 X Window System and X
Authentication
As mentioned at the beginning, network transparency is one of the central characteristics
of a UNIX system. X, the windowing system of UNIX operating systems, can make
use of this feature in an impressive way. With X, it is basically no problem to log in at
a remote host and start a graphical program that is then sent over the network to be
displayed on your computer.
When an X client should be displayed remotely using an X server, the latter should
protect the resource managed by it (the display) from unauthorized access. In more
concrete terms, certain permissions must be given to the client program. With the X
Window System, there are two ways to do this, called host-based access control and
cookie-based access control. The former relies on the IP address of the host where the
client should run. The program to control this is xhost. xhost enters the IP address of a
legitimate client into a tiny database belonging to the X server. However, relying on
IP addresses for authentication is not very secure. For example, if there were a second
user working on the host sending the client program, that user would have access to
the X server as well—just like someone stealing the IP address. Because of these
shortcomings, this authentication method is not described in more detail here, but you
can learn about it with man xhost.
In the case of cookie-based access control, a character string is generated that is only
known to the X server and to the legitimate user, just like an ID card of some kind. This
cookie (the word goes back not to ordinary cookies, but to Chinese fortune cookies,
which contain an epigram) is stored on login in the file .Xauthority in the user's
home directory and is available to any X client wanting to use the X server to display
a window. The file .Xauthority can be examined by the user with the tool xauth.
If you were to rename .Xauthority or if you deleted the file from your home direc-
tory by accident, you would not be able to open any new windows or X clients. Read
Security and Confidentiality
895
Advertisement
Table of Contents
Troubleshooting
