Is 'xhost local' (no colon) allowing malicious access?
Clash Royale CLAN TAG#URR8PPP
up vote
1
down vote
favorite
I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities. I used the xhost command for this as follows, but mistakenly leaving off the colon suffix seems to have allowed access to the remote server lb.usemaxserver.de...
nonroot@host2:~ xhost -
access control enabled, only authorized clients can connect
nonroot@host2:~ xhost local
local being added to access control list
nonroot@host2:~ xhost
access control enabled, only authorized clients can connect
INET:lb.usemaxserver.de
INET:localhost
I've used the following to remove it...
nonroot@host2:~ xhost -INET:lb.usemaxserver.de
lb.usemaxserver.de being removed from access control list
Am I interpreting this correctly?
If so, how did lb.usemaxserver.de setup something so that local links to that addess?
Does this require there to be some malicious configuration or software already on my system? If so, any suggestions for where to look?
networking security x xhost
edited Sep 28 at 2:17
Rui F Ribeiro
36.9k1273117
asked Sep 27 at 23:14
DocSalvager
1,27521532
add a comment |Â
up vote
1
down vote
favorite
I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities. I used the xhost command for this as follows, but mistakenly leaving off the colon suffix seems to have allowed access to the remote server lb.usemaxserver.de...
nonroot@host2:~ xhost -
access control enabled, only authorized clients can connect
nonroot@host2:~ xhost local
local being added to access control list
nonroot@host2:~ xhost
access control enabled, only authorized clients can connect
INET:lb.usemaxserver.de
INET:localhost
I've used the following to remove it...
nonroot@host2:~ xhost -INET:lb.usemaxserver.de
lb.usemaxserver.de being removed from access control list
Am I interpreting this correctly?
If so, how did lb.usemaxserver.de setup something so that local links to that addess?
Does this require there to be some malicious configuration or software already on my system? If so, any suggestions for where to look?
networking security x xhost
edited Sep 28 at 2:17
Rui F Ribeiro
36.9k1273117
asked Sep 27 at 23:14
DocSalvager
1,27521532
A better way is to use MIT-auth cookies. Figure out where the X server you start gets his cookies from, and give this cookie to root, withxauthor other methods.
– dirkt
Sep 28 at 6:12
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities. I used the xhost command for this as follows, but mistakenly leaving off the colon suffix seems to have allowed access to the remote server lb.usemaxserver.de...
nonroot@host2:~ xhost -
access control enabled, only authorized clients can connect
nonroot@host2:~ xhost local
local being added to access control list
nonroot@host2:~ xhost
access control enabled, only authorized clients can connect
INET:lb.usemaxserver.de
INET:localhost
I've used the following to remove it...
nonroot@host2:~ xhost -INET:lb.usemaxserver.de
lb.usemaxserver.de being removed from access control list
Am I interpreting this correctly?
If so, how did lb.usemaxserver.de setup something so that local links to that addess?
Does this require there to be some malicious configuration or software already on my system? If so, any suggestions for where to look?
networking security x xhost
edited Sep 28 at 2:17
Rui F Ribeiro
36.9k1273117
asked Sep 27 at 23:14
DocSalvager
1,27521532
I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities. I used the xhost command for this as follows, but mistakenly leaving off the colon suffix seems to have allowed access to the remote server lb.usemaxserver.de...
nonroot@host2:~ xhost -
access control enabled, only authorized clients can connect
nonroot@host2:~ xhost local
local being added to access control list
nonroot@host2:~ xhost
access control enabled, only authorized clients can connect
INET:lb.usemaxserver.de
INET:localhost
I've used the following to remove it...
nonroot@host2:~ xhost -INET:lb.usemaxserver.de
lb.usemaxserver.de being removed from access control list
Am I interpreting this correctly?
If so, how did lb.usemaxserver.de setup something so that local links to that addess?
Does this require there to be some malicious configuration or software already on my system? If so, any suggestions for where to look?
networking security x xhost
networking security x xhost
edited Sep 28 at 2:17
Rui F Ribeiro
36.9k1273117
asked Sep 27 at 23:14
DocSalvager
1,27521532
edited Sep 28 at 2:17
Rui F Ribeiro
36.9k1273117
asked Sep 27 at 23:14
DocSalvager
1,27521532
edited Sep 28 at 2:17
Rui F Ribeiro
36.9k1273117
edited Sep 28 at 2:17
Rui F Ribeiro
36.9k1273117
edited Sep 28 at 2:17
Rui F Ribeiro
36.9k1273117
36.9k1273117
asked Sep 27 at 23:14
DocSalvager
1,27521532
asked Sep 27 at 23:14
DocSalvager
1,27521532
asked Sep 27 at 23:14
DocSalvager
1,27521532
1,27521532
A better way is to use MIT-auth cookies. Figure out where the X server you start gets his cookies from, and give this cookie to root, withxauthor other methods.
– dirkt
Sep 28 at 6:12
add a comment |Â
A better way is to use MIT-auth cookies. Figure out where the X server you start gets his cookies from, and give this cookie to root, withxauthor other methods.
– dirkt
Sep 28 at 6:12
A better way is to use MIT-auth cookies. Figure out where the X server you start gets his cookies from, and give this cookie to root, with
xauth or other methods.– dirkt
Sep 28 at 6:12
A better way is to use MIT-auth cookies. Figure out where the X server you start gets his cookies from, and give this cookie to root, with
xauth or other methods.– dirkt
Sep 28 at 6:12
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
2
down vote
accepted
I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities.
It sounds like you want xhost +si:localuser:root. (This is not available on all X implementations. man Xsecurity also says that it is not entirely effective on some implementations. But it seems better than +local:)
Also, your X server was probably not directly accessible from the network anyway. E.g. see How can I connect to a remote X server _without_ ssh?
I used the xhost command for this as follows, but ... seems to have allowed access to the remote server
lb.usemaxserver.de
xhost +local looks up the hostname local, so it depends what you have in your DNS search path etc.
$ xhost +local
xhost: bad hostname "local"
$ dig local
...
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
...
It sounds like your system resolves local, to a couple of different hosts. Compare:
$ xhost +smtp.gmail.com
smtp.gmail.com being added to access control list
$ xhost
access control enabled, only authorized clients can connect
INET6:wr-in-x6d.1e100.net
INET:wr-in-f108.1e100.net
INET:wr-in-f109.1e100.net
SI:localuser:alan
$ dig smtp.gmail.com
...
smtp.gmail.com. 104 IN CNAME gmail-smtp-msa.l.google.com.
gmail-smtp-msa.l.google.com. 104 IN A 108.177.15.108
gmail-smtp-msa.l.google.com. 104 IN A 108.177.15.109
...
$ dig AAAA smtp.gmail.com
smtp.gmail.com. 170 IN CNAME gmail-smtp-msa.l.google.com.
gmail-smtp-msa.l.google.com. 271 IN AAAA 2a00:1450:400c:c0c::6c
$ dig -x 2a00:1450:400c:c0c::6c
c.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.c.0.c.0.c.0.0.4.0.5.4.1.0.0.a.2.ip6.arpa. 300 IN PTR wr-in-x6c.1e100.net.
answered Sep 27 at 23:21
sourcejedi
20.5k42888
1
This works. Thanks. I've also determined that the "local = lb.usemaxserver.de" was due to entries in/etc/hosts. It's an antiX 17.1 distro that includes adblocking by zeroing out hundreds of addresses in that file and there were some erroneous entries.
– DocSalvager
Sep 28 at 8:07
@DocSalvager that's hilarious, thank you for the followup :-D.
– sourcejedi
Sep 28 at 10:25
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
2
down vote
accepted
I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities.
It sounds like you want xhost +si:localuser:root. (This is not available on all X implementations. man Xsecurity also says that it is not entirely effective on some implementations. But it seems better than +local:)
Also, your X server was probably not directly accessible from the network anyway. E.g. see How can I connect to a remote X server _without_ ssh?
I used the xhost command for this as follows, but ... seems to have allowed access to the remote server
lb.usemaxserver.de
xhost +local looks up the hostname local, so it depends what you have in your DNS search path etc.
$ xhost +local
xhost: bad hostname "local"
$ dig local
...
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
...
It sounds like your system resolves local, to a couple of different hosts. Compare:
$ xhost +smtp.gmail.com
smtp.gmail.com being added to access control list
$ xhost
access control enabled, only authorized clients can connect
INET6:wr-in-x6d.1e100.net
INET:wr-in-f108.1e100.net
INET:wr-in-f109.1e100.net
SI:localuser:alan
$ dig smtp.gmail.com
...
smtp.gmail.com. 104 IN CNAME gmail-smtp-msa.l.google.com.
gmail-smtp-msa.l.google.com. 104 IN A 108.177.15.108
gmail-smtp-msa.l.google.com. 104 IN A 108.177.15.109
...
$ dig AAAA smtp.gmail.com
smtp.gmail.com. 170 IN CNAME gmail-smtp-msa.l.google.com.
gmail-smtp-msa.l.google.com. 271 IN AAAA 2a00:1450:400c:c0c::6c
$ dig -x 2a00:1450:400c:c0c::6c
c.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.c.0.c.0.c.0.0.4.0.5.4.1.0.0.a.2.ip6.arpa. 300 IN PTR wr-in-x6c.1e100.net.
answered Sep 27 at 23:21
sourcejedi
20.5k42888
1
This works. Thanks. I've also determined that the "local = lb.usemaxserver.de" was due to entries in/etc/hosts. It's an antiX 17.1 distro that includes adblocking by zeroing out hundreds of addresses in that file and there were some erroneous entries.
– DocSalvager
Sep 28 at 8:07
@DocSalvager that's hilarious, thank you for the followup :-D.
– sourcejedi
Sep 28 at 10:25
add a comment |Â
up vote
2
down vote
accepted
I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities.
It sounds like you want xhost +si:localuser:root. (This is not available on all X implementations. man Xsecurity also says that it is not entirely effective on some implementations. But it seems better than +local:)
Also, your X server was probably not directly accessible from the network anyway. E.g. see How can I connect to a remote X server _without_ ssh?
I used the xhost command for this as follows, but ... seems to have allowed access to the remote server
lb.usemaxserver.de
xhost +local looks up the hostname local, so it depends what you have in your DNS search path etc.
$ xhost +local
xhost: bad hostname "local"
$ dig local
...
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
...
It sounds like your system resolves local, to a couple of different hosts. Compare:
$ xhost +smtp.gmail.com
smtp.gmail.com being added to access control list
$ xhost
access control enabled, only authorized clients can connect
INET6:wr-in-x6d.1e100.net
INET:wr-in-f108.1e100.net
INET:wr-in-f109.1e100.net
SI:localuser:alan
$ dig smtp.gmail.com
...
smtp.gmail.com. 104 IN CNAME gmail-smtp-msa.l.google.com.
gmail-smtp-msa.l.google.com. 104 IN A 108.177.15.108
gmail-smtp-msa.l.google.com. 104 IN A 108.177.15.109
...
$ dig AAAA smtp.gmail.com
smtp.gmail.com. 170 IN CNAME gmail-smtp-msa.l.google.com.
gmail-smtp-msa.l.google.com. 271 IN AAAA 2a00:1450:400c:c0c::6c
$ dig -x 2a00:1450:400c:c0c::6c
c.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.c.0.c.0.c.0.0.4.0.5.4.1.0.0.a.2.ip6.arpa. 300 IN PTR wr-in-x6c.1e100.net.
answered Sep 27 at 23:21
sourcejedi
20.5k42888
1
This works. Thanks. I've also determined that the "local = lb.usemaxserver.de" was due to entries in/etc/hosts. It's an antiX 17.1 distro that includes adblocking by zeroing out hundreds of addresses in that file and there were some erroneous entries.
– DocSalvager
Sep 28 at 8:07
@DocSalvager that's hilarious, thank you for the followup :-D.
– sourcejedi
Sep 28 at 10:25
add a comment |Â
up vote
2
down vote
accepted
up vote
2
down vote
accepted
I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities.
It sounds like you want xhost +si:localuser:root. (This is not available on all X implementations. man Xsecurity also says that it is not entirely effective on some implementations. But it seems better than +local:)
Also, your X server was probably not directly accessible from the network anyway. E.g. see How can I connect to a remote X server _without_ ssh?
I used the xhost command for this as follows, but ... seems to have allowed access to the remote server
lb.usemaxserver.de
xhost +local looks up the hostname local, so it depends what you have in your DNS search path etc.
$ xhost +local
xhost: bad hostname "local"
$ dig local
...
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
...
It sounds like your system resolves local, to a couple of different hosts. Compare:
$ xhost +smtp.gmail.com
smtp.gmail.com being added to access control list
$ xhost
access control enabled, only authorized clients can connect
INET6:wr-in-x6d.1e100.net
INET:wr-in-f108.1e100.net
INET:wr-in-f109.1e100.net
SI:localuser:alan
$ dig smtp.gmail.com
...
smtp.gmail.com. 104 IN CNAME gmail-smtp-msa.l.google.com.
gmail-smtp-msa.l.google.com. 104 IN A 108.177.15.108
gmail-smtp-msa.l.google.com. 104 IN A 108.177.15.109
...
$ dig AAAA smtp.gmail.com
smtp.gmail.com. 170 IN CNAME gmail-smtp-msa.l.google.com.
gmail-smtp-msa.l.google.com. 271 IN AAAA 2a00:1450:400c:c0c::6c
$ dig -x 2a00:1450:400c:c0c::6c
c.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.c.0.c.0.c.0.0.4.0.5.4.1.0.0.a.2.ip6.arpa. 300 IN PTR wr-in-x6c.1e100.net.
answered Sep 27 at 23:21
sourcejedi
20.5k42888
I'm setting up a new system and need to grant the root user authority to access the nonroot user's X display in order to run GUI utilities.
It sounds like you want xhost +si:localuser:root. (This is not available on all X implementations. man Xsecurity also says that it is not entirely effective on some implementations. But it seems better than +local:)
Also, your X server was probably not directly accessible from the network anyway. E.g. see How can I connect to a remote X server _without_ ssh?
I used the xhost command for this as follows, but ... seems to have allowed access to the remote server
lb.usemaxserver.de
xhost +local looks up the hostname local, so it depends what you have in your DNS search path etc.
$ xhost +local
xhost: bad hostname "local"
$ dig local
...
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
...
It sounds like your system resolves local, to a couple of different hosts. Compare:
$ xhost +smtp.gmail.com
smtp.gmail.com being added to access control list
$ xhost
access control enabled, only authorized clients can connect
INET6:wr-in-x6d.1e100.net
INET:wr-in-f108.1e100.net
INET:wr-in-f109.1e100.net
SI:localuser:alan
$ dig smtp.gmail.com
...
smtp.gmail.com. 104 IN CNAME gmail-smtp-msa.l.google.com.
gmail-smtp-msa.l.google.com. 104 IN A 108.177.15.108
gmail-smtp-msa.l.google.com. 104 IN A 108.177.15.109
...
$ dig AAAA smtp.gmail.com
smtp.gmail.com. 170 IN CNAME gmail-smtp-msa.l.google.com.
gmail-smtp-msa.l.google.com. 271 IN AAAA 2a00:1450:400c:c0c::6c
$ dig -x 2a00:1450:400c:c0c::6c
c.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.c.0.c.0.c.0.0.4.0.5.4.1.0.0.a.2.ip6.arpa. 300 IN PTR wr-in-x6c.1e100.net.
answered Sep 27 at 23:21
sourcejedi
20.5k42888
edited Sep 28 at 10:40
answered Sep 27 at 23:21
sourcejedi
20.5k42888
answered Sep 27 at 23:21
sourcejedi
20.5k42888
answered Sep 27 at 23:21
sourcejedi
20.5k42888
20.5k42888
1
This works. Thanks. I've also determined that the "local = lb.usemaxserver.de" was due to entries in/etc/hosts. It's an antiX 17.1 distro that includes adblocking by zeroing out hundreds of addresses in that file and there were some erroneous entries.
– DocSalvager
Sep 28 at 8:07
@DocSalvager that's hilarious, thank you for the followup :-D.
– sourcejedi
Sep 28 at 10:25
add a comment |Â
1
This works. Thanks. I've also determined that the "local = lb.usemaxserver.de" was due to entries in/etc/hosts. It's an antiX 17.1 distro that includes adblocking by zeroing out hundreds of addresses in that file and there were some erroneous entries.
– DocSalvager
Sep 28 at 8:07
@DocSalvager that's hilarious, thank you for the followup :-D.
– sourcejedi
Sep 28 at 10:25
1
1
This works. Thanks. I've also determined that the "local = lb.usemaxserver.de" was due to entries in
/etc/hosts. It's an antiX 17.1 distro that includes adblocking by zeroing out hundreds of addresses in that file and there were some erroneous entries.– DocSalvager
Sep 28 at 8:07
This works. Thanks. I've also determined that the "local = lb.usemaxserver.de" was due to entries in
/etc/hosts. It's an antiX 17.1 distro that includes adblocking by zeroing out hundreds of addresses in that file and there were some erroneous entries.– DocSalvager
Sep 28 at 8:07
@DocSalvager that's hilarious, thank you for the followup :-D.
– sourcejedi
Sep 28 at 10:25
@DocSalvager that's hilarious, thank you for the followup :-D.
– sourcejedi
Sep 28 at 10:25
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f471957%2fis-xhost-local-no-colon-allowing-malicious-access%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
A better way is to use MIT-auth cookies. Figure out where the X server you start gets his cookies from, and give this cookie to root, with
xauthor other methods.– dirkt
Sep 28 at 6:12