X server authority only allows local connections even if xserver-allow-tcp=true
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Light Display Manager |
Triaged
|
Low
|
Unassigned | ||
lightdm (Ubuntu) |
Triaged
|
Low
|
Unassigned |
Bug Description
I'm currently working on configuring Ubuntu 12.04 Linux to match our user environment - one of the aspects I'm working on is enabling X11 over TCP as we have a large number of graphical applications running on local (same-subnet) compute server systems. Encrypting the X11 stream between clients and servers on the same physical network switch inside a secured floor of offices seems like insanity to me.
I've obviously configured Lightdm to start the Xorg X11 server with TCP mode connections enabled, but the -auth argument (which I assume is provided by lightdm) points to a file called /var/run/
What I need to do is to have lightdm (assuming it is lightdm that is creating this authorisation file) create it with simply "hostname:0" so that the MIT-MAGIC-COOKIE-1 key may be used on X11 over TCP connections as well as those over X11 over Unix Domain socket connections.
I have confirmed that extracting the key from the :0 file using Xauth -f :0 list followed by a correspondingly altered re-insertion of the key without the /unix part using Xauth -f :0 add ... command does indeed work.
My first question is whether there is something I've missed in the lightdm configuration file that would allow me to specify that I want the MIT-MAGIC-COOKIE-1 enabled for both TCP and Unix domain connections?
The second point which follows on from that is whether when allowing TCP connections to the Xserver, maybe lightdm SHOULD remove the /unix element from the MIT_MAGIC-COOKIE-1 stored in the :0 file. It would seem to me to be logical that it should.
And the final point is seeking advice on the best recommended way to work around this problem for the time being. I assume I could do the xauth list/xauth add steps within the display-
Thanks in advance for your help.
Description: Ubuntu 12.04.2 LTS
Release: 12.04
ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: lightdm 1.2.3-0ubuntu2.3
ProcVersionSign
Uname: Linux 3.2.0-49-generic x86_64
NonfreeKernelMo
ApportVersion: 2.0.1-0ubuntu17.3
Architecture: amd64
Date: Tue Jul 30 15:16:52 2013
MarkForUpload: True
ProcEnviron:
LANGUAGE=en_GB:
TERM=xterm
PATH=(custom, no user)
LANG=en_GB.UTF-8
SHELL=/bin/csh
SourcePackage: lightdm
UpgradeStatus: No upgrade log present (probably fresh install)
Changed in lightdm (Ubuntu): | |
status: | New → Triaged |
importance: | Undecided → Wishlist |
Changed in lightdm: | |
status: | New → Triaged |
importance: | Undecided → Wishlist |
importance: | Wishlist → Medium |
Changed in lightdm (Ubuntu): | |
importance: | Wishlist → Medium |
summary: |
- Removing the /unix specification from the /var/run/lightdm/root/:0 file + X server authority only allows local connections even if xserver-allow- + tcp=true |
Changed in lightdm: | |
importance: | Medium → Low |
Changed in lightdm (Ubuntu): | |
importance: | Medium → Low |
I've created the following script which does the necessary - I've called it enabletcp and placed it in /etc/lightdm:
#/bin/sh lightdm/ root; xauth -f :0 list | grep "$HOSTNAME/unix")` lightdm/ root; xauth -f :0 add $CLEANED)
#
# enable TCP mode MIT-MAGIC-COOKIE-1
#
HOSTNAME=`hostname`
COOKIE=`(cd /var/run/
CLEANED=`echo $COOKIE | sed -e 's/\/unix//'`
(cd /var/run/
exit 0
and I've added: setup-script= /etc/lightdm/ enabletcp
display-
to the /etc/lightdm/ lightdm. conf file.