Subject: exmh and Xauthority

From: Maarten Boekhold <[email-masked]>
Date: Sat, 17 Aug 1996 20:30:27 +0200 (MET DST)

Hi,

I think it was on debian-devel that somebody asked about this subject. I
replied that I had a rather simple setup using the .xserverrc-file, and a
couple of people asked me to mail it to them. So I decided to send it to
the list. Here it follows:

#!/bin/sh

# Generate a random key; Mui and Pearce offer a number of alternatives
# for this.
randomkey=`perl -e 'srand; printf int(rand(100000000000000000))'`
#
HOST=`hostname`
#
# Add the code to the .Xauthority list for local-host sockets
xauth add $HOST/unix:0 . $randomkey
#
# Add the code to the .Xauthority list for TCP/IP connections
xauth add $HOST:0 . $randomkey

exec /usr/X11R6/bin/X -auth $HOME/.Xauthority

Sometimes there are some messages on startup about non-hex characters in
the random-key, but it still works AFAIK.

Maarten

_______________________________________________________________________
| Maarten Boekhold, Faculty of Electrical Engineering TU Delft,   NL  |
|   [email-masked] [email-masked]   |
-----------------------------------------------------------------------

---

From: Ian Jackson <[email-masked]>
Date: Sat, 24 Aug 96 18:29 BST

Maarten Boekhold writes ("exmh and Xauthority"):
...
> randomkey=`perl -e 'srand; printf int(rand(100000000000000000))'`

Do NOT do this.  It results in a weak cookie, meaning that someone
could fairly easily guess your cookie and take over your session and
account.

There are ways of getting a good cookie.  This isn't one.

Ian.