From: drew@juliet.cs.colorado.edu (Drew Eckhardt)
Subject: Re: Restricting access to display (AIX 3.2)
Organization: University of Colorado at Boulder
Date: Wed, 7 Oct 1992 00:17:48 GMT

In article <1992Oct6.190218.29499@ncsu.edu> raboles@eos.ncsu.edu (RODNEY ALLEN BOLES) writes:
>
>I have an RS/6000 that is running AIX3.2 (don't know if this matters
>or not for this question).
>
>I am running at display:0 at my workstation. It is possible 
>(and needed) for other users to rlogin to my machine. 
>I've noticed when a user does an xlock (and other programs) 
>that my display is locked (or otherwise affected depending on
>program). 
>
>Is there a way to restrict this and still allow access to my machine??

Yes - Xauthorization.  

>It is not an xhost access problem. 

No.  xhost only works on a per machine basis.

With Xauthorization, the server has a unique key.  If a client tries 
to connect to the server from a machine that is not in the host access
list (this includes the local host), keys are compared and if they don't
match, no connection.

Your copy of the key is kept in a file that is read/write you and 
root only, the server's copy is in /tmp, and is read/write root only.
So, unless you mail some one the key, they won't be able to find it 
out to connect to your Xserver.

Keys can be manually created, although xdm is probably more convienient.
Xdm creates a unique key for each login session, and automatically 
"does the right thing" with your Xauthority file (with keys for 
all of the displays you are logged into).  

Note that IBM sabotaged the Xserver bundled with AIX3.2, so it has to
be run with a HFT as a controlling terminal.  This means that it 
doesn't work with the stock xdm, and you need to hack xdm or 
use a wrapper for the Xserver.  I chose the later - the wrapper 
follows.  Simply change the line in the Xservers file pointed to 
by the xdm config file to point to the wrapper, instead of the "real"
Xserver under /usr/lpp/X11/bin.

-- cut
/*
 *	X wrapper for AIX 3.2 server 
 *
 * 	The Xserver needs to run with a hft as a controlling tty.
 *	This wrapper does just that.
 */

#include <stdio.h>
#include <sys/file.h>
#include <sys/ioctl.h>

/*
 * 	I tried moving the server to /usr/lpp/X11/bin/X.real, 
 *	things didn't work because of some shared library problem.
 */

#ifndef SERVER
#define SERVER "/usr/lpp/X11/bin/X"
#endif

/*
 *	/dev/hft  means the "first free virtual terminal".
 */

#ifndef HFT
#define HFT "/dev/hft"
#endif

void main (int argc, char **argv, char **envp) {
	int pgrp, f;

/*
 *	First, we must disconnect from the controlling terminal 
 *	(if there is one)
 */
	
	if ((f = open("/dev/tty", O_WRONLY)) >= 0) {

		if (ioctl(f, TIOCNOTTY, 0) < 0) {
			fprintf(stderr, "%s : TIOCNOTTY ioctl failed ", 
				argv[0]);
			perror("");
			exit(1);
		}

		close(f);
	}

	close(0);
	close(1);

/*
 *	Now, we get our own process group, and session.  This lets 
 *	us associate with a new controlling tty.
 */

	if ((pgrp = setpgrp()) < 0) {
		fprintf(stderr, "%s : setpgrp() failed ", argv[0]);
		perror("");
		exit(1);
	}

/*
 *	Since we have no controlling tty, and the HFT we want 
 *	has no session / pgrp associated with it, when we open it,
 *	it will become our controlling tty.
 */

	if (open(HFT, O_RDONLY, 0) < 0 ||
	    open(HFT, O_WRONLY, 0) < 0) {
		fprintf(stderr, "%s : open failed on %s ", argv[0], HFT);
		perror("");
		exit(1);
	}

	execv(SERVER, argv, envp);
	fprintf(stderr, "%s : exec %s failed ", argv[0], SERVER);
	perror("");
	exit(1);
}

	


-- 
Microsoft is responsible for propogating the evils it calls DOS and Windows, 
IBM for AIX (appropriately called Aches by those having to administer it), but 
marketing's sins don't come close to those of legal departments.
Boycott AT&T for their absurd anti-BSDI lawsuit.
Newsgroups: comp.unix.questions,comp.unix.wizards