From: anthony@kurango.cit.gu.edu.au (Anthony Thyssen)
Subject: Re: X remote display failure
Organization: Griffith University, Brisbane, Australia.
Date: Thu, 16 Apr 92 08:39:17 GMT

tneff@bfmny0.BFM.COM (Tom Neff) writes:
| Please, will one of you smarties help me.  I've asked twice in two
| different places, but I think people are skimming.
|
| I have a network of ISC 3.0 boxes talking TCP.  I can't run an X client
| (say, xload) on my workstation and redirect the output to another box's
| display.  BUT he can do it to mine OK.   ......

  The X Window System has a security system to prevent any tom, dick, and
harry from using your current display. You obviously know that you have to
either add a ``-display host:0'' or set the ``DISPLAY'' environment
variable to open a window on a screen. What you also need is permission to
open the window.

  X11 (from Revision 4 onward) provides authorization methods.

METHOD 1: Authority by host.   (See the xhost man page)

  xhost provides authority to other people by host, and reports which
machines can run programs directly on that display.

Example:
    prompt>> xhost
    access control enabled, only authorized clients can connect
    dragon
    cornet

This means that any program running on either of the machine dragon or
cornet can place windows on your screen without any trouble.  If the
program was not run on either of these machines, the user must have
a `authorization password' (See method 2).

  Remove a machine

     xhost -cornet

  and to add a machine

    xhost +cornet

  and to allow use of your display from any machine (in the world)

    xhost +

  to return to normal

    xhost -

  Note, because of the unusal systax of xhost you can't use a 
``-display host:0'' option with it, instead use the env command to
set the ``DISPLAY'' environment variable for just that command.

    env DISPLAY=host:0 xhost

This method is not recomended except as a temporary arrangment (See the
Warning below).


METHOD 2: Authority by password   (See the xauth man page)

  When you start a session on a display the `xdm' program (the one that
displays the initial login window) creates a file in your home directory
called ``.Xauthority''.  This file holds a password to allow you to
access your display regardless of your xhost permission.
To list this file type (assuming you are on dragon)

   prompt>> xauth list
   dragon.cit.gu.edu.au:0  MIT-MAGIC-COOKIE-1  e102ba90f0f55f2108a9ee2526537845

The long number at the end of each list is the password, and is randomly
generated everytime anyone starts a session. If you do not have xhost
permission (method 1) you MUST have the current password to the display
you wish to access.  For example a friend decided to give me access to his
display on thorax. He did not however wanted to use xhost as he only
wanted to give me permission -- not just anyone on machine I am working
on.  So he mailed (or other means) his current authority.

   thorax.cit.gu.edu.au:0  MIT-MAGIC-COOKIE-1  3704a0c7fd52c90eabf53892c0ba7ee1

  So I then add this to my ``.Xauthority'' file

   prompt>> xauth add thorax.cit.gu.edu.au:0  MIT-MAGIC-COOKIE-1  3704a0c..etc

  Now I have access to his display regardless of his xhost setup. Which
in case you are wondering was completely empty (no hosts at all).


WARNING: If someone has permission to access your display (via either
xhost or xauth) they can not only open windows, but can also look at your
display, or kill various windows, and terminate your current session!

EXAMPLE:  I now have authority to look at thorax -- Thus I can look at
what is visible on that display and look at it on my own display.

      xwd -root -display thorax:0 | xwud -geometry +0+0 &

--------

I hope this clarifies things.

  Anthony Thyssen - (CIT, Griffith University)       anthony@cit.gu.edu.au
------------------------------------------------------------------------------
       "Patience Lewis, we're only human!"   - RoboCop   -- "RoboCop 2"
------------------------------------------------------------------------------