SYNOPSIS
X provides mechanism for implementing many access control systems. The sample implementation includes five mechanisms:
Host Access Simple host-based access control.
MIT-MAGIC-COOKIE-1 Shared plain-text "cookies".
XDM-AUTHORIZATION-1 Secure DES based private-keys.
SUN-DES-1 Based on Sun's secure rpc system.
MIT-KERBEROS-5 Kerberos Version 5 user-to-user.
THE AUTHORIZATION FILE
Except for Host Access control, each of these systems uses data stored in the
.Xauthority file to generate the correct authorization information to pass along to the X server at connection setup. MIT-MAGIC-COOKIE-1 and XDM-AUTHORIZATION-1 store secret data in the file; so anyone who can read the file can gain access to the X server. SUN-DES-1 stores only the identity of the principal who started the server (unix.
hostname@
domain when the server is started by
xdm), and so it is not useful to anyone not authorized to connect to the server.
Each entry in the .Xauthority file matches a certain connection family (TCP/IP, DECnet or local connections) and X display name (hostname plus display number). This allows multiple authorization entries for different displays to share the same data file. A special connection family (FamilyWild, value 65535) causes an entry to match every display, allowing the entry to be used for all connections. Each entry additionally contains the authorization name and whatever private authorization data is needed by that authorization type to generate the correct information at connection setup time.
The xauth program manipulates the .Xauthority file format. It understands the semantics of the connection families and address formats, displaying them in an easy to understand format. It also understands that SUN-DES-1 and MIT-KERBEROS-5 use string values for the authorization data, and displays them appropriately.
The X server (when running on a workstation) reads authorization information from a file name passed on the command line with the -auth option (see the Xserver manual page). The authorization entries in the file are used to control access to the server. In each of the authorization schemes listed above, the data needed by the server to initialize an authorization scheme is identical to the data needed by the client to generate the appropriate authorization information, so the same file can be used by both processes. This is especially useful when xinit is used.
-
MIT-MAGIC-COOKIE-1
-
This system uses 128 bits of data shared between the user and the X server. Any collection of bits can be used. Xdm generates these keys using a cryptographically secure pseudo random number generator, and so the key to the next session cannot be computed from the current session key.
-
XDM-AUTHORIZATION-1
-
This system uses two pieces of information. First, 64 bits of random data, second a 56 bit DES encryption key (again, random data) stored in 8 bytes, the last byte of which is ignored. Xdm generates these keys using the same random number generator as is used for MIT-MAGIC-COOKIE-1.
-
SUN-DES-1
-
This system needs a string representation of the principal which identifies the associated X server. This information is used to encrypt the client's authority information when it is sent to the X server. When xdm starts the X server, it uses the root principal for the machine on which it is running (unix. hostname@domain, e.g., "unix.expire.lcs.mit.edu@our.domain.edu"). Putting the correct principal name in the .Xauthority file causes Xlib to generate the appropriate authorization information using the secure RPC library.
-
MIT-KERBEROS-5
-
Kerberos reads tickets from the cache pointed to by the KRB5CCNAME environment variable, so does not use any data from the .Xauthority file. An entry with no data must still exist to tell clients that MIT-KERBEROS-5 is available.
-
-
Unlike the .Xauthority file for clients, the authority file passed by xdm to a local X server (with `` -auth filename'', see xdm(1)) does contain the name of the credentials cache, since the X server will not have the KRB5CCNAME environment variable set. The data of the MIT-KERBEROS-5 entry is the credentials cache name and has the form ``UU:FILE: filename'', where filename is the name of the credentials cache file created by xdm. Note again that this form is not used by clients.