Re: [gentoo-dev] GnomeUI-WARNING

[William Kenworthy]

I dont see ssh as being a good solution in this case.  On a firewalled
single user machine, the complexity of going through ssh (which seems to
have a patchy history as regards security itself) seems like it might be
more of a risk (i.e., misconfiguration, security holes etc) as well as
the inconvenience of an unwieldy command line compared to the
alternative - simplicity.

How does Mandrake, RedHat etc do this, as they work in the fashion I
desire?

I do use ssh in the above mode for external connections, but am
unconvinced it is useful or even adds anything but risky inconvenience
in a fully local mode.  I am convinced there is a point where security
can be overdone and be self-defeating in the long run.

BillK

On Sat, 2002-10-19 at 08:03, Troy Dack wrote:
> On Sat, 2002-10-19 at 09:45, William Kenworthy wrote:
> > xhost +localhost
> > su -
> > export DISPLAY=localhost:0.0
> >
> > Using "su -", requires a display set.  Where does one put the xhost and
> > export in a generic sence?  I have a single user machine and often use a
> > number of x displays - how could I set up to do the above automaticly,
> > no matter which X dispaly I am on?
> >
> > BillK
>
> You really don't want that configured as a "default" it is not the most
> secure idea.
>
> A better alternative is to install ssh on the local machine, configure
> public/private key pairs for your root account, make ssh only listen on
> localhost (127.0.0.1), enable automatic X11 forwarding and then whenever
> you want to run an X app as root do:
>
> 	ssh -X root@localhost /path/to/application
>
> The overheads in running a ssh server are really not that much when you
> are doing it on the local machine only.
>
>
> --
> 	Troy Dack
> 	http://linux.tkdack.com
>
>