Subject: X authorization

From: [email-masked]
Date: Sat, 14 Sep 1996 00:29:17 -0400

How is the X authorization set up in Debian?

I am running xdm and I discovered that only the login user can
start an X window. There are 2 situations when I cannot start a 
X window:
(1) when I try to start a window after 'su' to root. I discovered this
    can be fixed if I do 'xhost +mymachinename'. How to this automatically?
    A line in Xaccess or some /etc/X11/X???.hosts file?
(2) after establishing a PPP connection to my service provider and 
    changing my hostname (I have only a dynamic IP address from my ISP).
    Here I suppose there is nothing I can do except do xhost from my ip-up
    script after fixing (1).

--Derek Lee

---

From: [email-masked] (Kazuhiro Sasayama)
Date: Sun, 15 Sep 1996 08:01:23 +0900 (JST)

>>>>> "dkklee" == dkklee  <[email-masked]> writes:

    dkklee> (1) when I try to start a window after 'su' to root. I
    dkklee> discovered this can be fixed if I do 'xhost
    dkklee> +mymachinename'. How to this automatically?  A line in
    dkklee> Xaccess or some /etc/X11/X???.hosts file?

You can setenv XAUTHORITY to your $HOME/.Xauthority or something.
Since the super user can read any file, you should be able to connect
to your server while you switch to root.

-- 
Kaz Sasayama, a Nagoyan X68000, Linux and OS/2 user.
*PGP key fingerprint:  53 71 54 56 FB 3D 76 0B  92 5D 32 40 C5 34 38 00

---

From: [email-masked] (Stephen Early)
Date: Sun, 15 Sep 96 01:48 BST

In article <[email-masked]> you write:
>start an X window.

The 'MIT-MAGIC-COOKIE' authentication method is being used; only X
clients with access to the appropriate 'cookie' (an automatically
generated password) can connect to the server. I suggest you read the
Xsecurity manpage in the xmanpages package for more information. The
xauth and Xserver manpages are also relevant.

>There are 2 situations when I cannot start a 
>X window:

You should set up a script to be run by root to copy the cookie from
the user's .Xauthority file to root's .Xauthority.

>    Here I suppose there is nothing I can do except do xhost from my ip-up

What is your DISPLAY variable being set to? If it's hostname:0.0 (or
similar) then the connection from the X client to the server will be
made by TCP using the cookie listed for TCP. If it's just :0.0 then
the connection will be made using a Unix-domain socket, and the cookie
listed for that connection method. (The cookie will have the same
value, just a different name).

If all you're worried about is getting X clients on your local machine
to start up on your own display, I'd recommend having DISPLAY set to
:0.0, so changes in hostname or IP address won't matter.

Steve Early

---

From: Boris Beletsky <[email-masked]>
Date: Sun, 15 Sep 1996 23:01:21 +0200 (IST)

-----BEGIN PGP SIGNED MESSAGE-----

On Sat, 14 Sep 1996 [email-masked] wrote:

dkklee>(1) when I try to start a window after 'su' to root. I discovered this
dkklee>    can be fixed if I do 'xhost +mymachinename'. How to this automatically?
dkklee>    A line in Xaccess or some /etc/X11/X???.hosts file?
put it into u're xsession 
but don't put `xhost +`!!!!

___
Boris Beletsky <[email-masked]>
For pgp public key, e-mail me 
with subject "get pgp-key."
___
In Linux veritas

---

From: "Susan G. Kleinmann" <[email-masked]>
Date: Mon, 16 Sep 1996 21:29:56 -0400

Hi Derek --

> How is the X authorization set up in Debian?

Lukas Nellen provided a nice answer to this a while ago.  I'm just repeating

>     A line in Xaccess or some /etc/X11/X???.hosts file?
Below is a solution for users of startx.  If you want to run xdm, then
you'll have to replace the 2nd file mentioned with an appropriate file
for xdm (It's whatever file starts up xdm.)

Create 2 files in /usr/local/bin.

File #1 is called "mkcookie".  Here are its contents:
-------Start of mkcookie ------ cut here-------------------------
#!/bin/sh
# create a magic cookie for X11
# From Lukas Nellen <[email-masked]>

if [ -z "$1" ]; then
    display=0
else
    display=$1
fi

cookie=`ps auxwwee | md5sum`
xauth add :$display MIT-MAGIC-COOKIE-1 $cookie
xauth add `hostname`:$display MIT-MAGIC-COOKIE-1 $cookie
-------End   of mkcookie ------ cut here-------------------------

File #2 is called "startx".  Here are its contents:
-------Start of startx  ------ cut here-------------------------
#!/bin/sh
# From Lukas Nellen <[email-masked]>
mkcookie
exec xinit -- -auth $HOME/.Xauthority
-------End   of startx  ------ cut here-------------------------

If you're trying to execute an X command as root from a display owned by
user, then as root execute these commands:

ln -s /home/user/.Xauthority ~/.Xauthority
export DISPLAY=`hostname`:0    <== this is a bash-ism; you may want 
                                   sentenv for csh.

>     Here I suppose there is nothing I can do except do xhost from my ip-up

Guy Maor suggested the following addition to your /etc/ppp/ip-up script:

--cut--
#
# edit /etc/hosts
#
myip=$4
myname=`nslookup $myip | sed -n 's/Name: *\(.*\)/\1/p'`
sed -e "/femto/s/.*/$myip       $myname femto/" /etc/hosts > /tmp/hosts
mv -f /tmp/hosts /etc/hosts
chmod +r /etc/hosts
--cut--

Note that the big space on the sed line is a tab, but it's just for
readability.

Then put your machine's name on the /etc/hosts the first time with a
bogus address.  Don't put it in the loopback line; and replace femto
aboce with whatever your machine's name is.  My /etc/hosts looks like
this for example:
127.0.0.1       loopback localhost
128.83.111.163  slip-33-3.ots.utexas.edu femto
128.83.204.246  telesys1.ots.utexas.edu telesys1 telesys
128.83.185.40   ns1.utexas.edu
128.83.185.41   ns2.utexas.edu

============================================================
Hope that helps.
Susan Kleinmann