Very Computer

I would like to know if there is any way to block this hole.

  Thanks
     Michael

Quote:>I found a way to kill any "xlock" on any machine as a simple user.
>This can be done as long as I can login to that machine of
>after "xhost +".
>I've written something that makes the job automatically on any
>machine I choose (in few seconds).
>I don't want to post the exact procedure (who knows what can be done
>with this information...).
>I would like to know if there is any way to block this hole.
>  Thanks
>     Michael

steve

--
=-------------------------------------------------------------------------=

=                                                                         =
=  Scalable Computing Lab     Phone: (515) 294-1918                       =
=  237 Wilhelm Hall           Fax  : (515) 294-4491                       =
=  Iowa State University      Home : 227 Hyland Ave Ames, Ia 50014        =
=  Ames Ia 50011                     (515) 292-8445                       =
=                                                                         =
=  www: http://www.physics.iastate.edu/cfd/people/heistand/heistand.html  =
=                                                                         =
=         We are far to busy around here to get anything done.            =
=       GE D? P C++ L+ U++ E++ M+ S N- H-- F* G- W+++ T+ T+ Y*            =
=-------------------------------------------------------------------------=

xhost is ok security if the people you want to protect against can't
log into your server machine (I think).  If you want better security,
try xauth (still by no means perfect, but better than xhost).

- Chris

A. Chris Long, Jr.              \ "I am attempting, madam, to construct a
Graduate Serf^H^H^H^HStudent     \ pneumonic memory circuit out of stone knives

WWW: http://www-plateau.cs.berkeley.edu/people/allanl \  Edge of Forever"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                    <A HREF=http://www.leo.org/~bartsch/>Wolfgang Bartsch</A>

    Michael> I found a way to kill any "xlock" on any machine as a
    Michael> simple user.  This can be done as long as I can login to
    Michael> that machine of after "xhost +".  I've written something
    Michael> that makes the job automatically on any machine I choose
    Michael> (in few seconds).  I don't want to post the exact
    Michael> procedure (who knows what can be done with this
    Michael> information...).

    Michael> I would like to know if there is any way to block this
    Michael> hole.

  I wouldnt say that this was a 'HUGE security hole'... When someone types
'xhost +' they're saying:

         "hey I don't care what anyone does to any of my windows"

It's just like someone setting a null password.. You wouldn't say that the
system had a HUGE security hole, you'd say that the user was a little 'naive'
and hope that they will learn from their mistake. The same kind of thing
applies with 'xhost', you should do 'xhost -' and maintain your system
integrity by carefully managing the magic cookies created by xauth et al..

(Another solution is do "xhost +", run whatever it was you wanted to run on
 the remote system, then do "xhost -", the open connection will remain open,
 but new ones will be refused - Of course this can work against you, since
 someone can open a fairly dormant connection while your server is available,
 and it will stay open even if you restrict access - In fact, depending on
 your X server, it will stay open until you restart X.)

Daniel.

PS: If I completely mis-understood your problem then none of the above will
    be of any use - however I don't think I did.
--
/-           Daniel Stephens            ---------------------#----------------\

| .signature still under development 8-)                    ### ##  # # 'LIFE'|
\-----------------------------------------------                 #  ##       -/

: I would like to know if there is any way to block this hole.

:   Thanks
:      Michael

   Can't you get out of Xlock on a Linux machine just by hitting
<CTRL>-<ALT>-<BACKSPACE> and killing X altogether?  Though I suppose this
wouldn't be too effective if XDM was being used.  Just a thought...

                                                Bill
--
Bill McKinnon                        Senior Information Technology Assistant