xhost and Exceed

[Verónica Muñoz Segovia]

Good afternoon,

Weeks ago we had an internal auditory and they put us as high risk the use of any xterminal software, I'm attaching you the document. Anybody knows these kind of security vulnerabilities and how can I fix them?

Best Regards,

Veronica Munoz

[Rick Garland]

The xhost command can list specific hosts which can connect to the server. If you do "xhost +" you are allowing anybody to connect. If you do 'xhost ' you are allowing only the nodename to connect to the X-server.

[Alex Glennie]

You can also create a file /etc/X0.hosts : Plain ascii text containing on each line the single name of hosts you wish to grant host access to. All others will be rejected unless xhost + or xhost + is run.

Also be aware of user based control access by way of encrypted MIT magic cookie :
see man X and Xserver for more info : key word .Xauthority : also see /usr/dt/config/Xconfig : Dtlogin*Authorise : True/False CDE resource.

Also at 11.xx ICEauthority comes into action ....I don't know too much about this but it prevents more than one user with the same uid from login under CDE.