Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 22 / 450

In the case of cookie-based access control, a character string is generated that is only
known to the X server and to the legitimate user, just like an ID card of some kind. This
cookie (the word goes back not to ordinary cookies, but to Chinese fortune cookies,
which contain an epigram) is stored on login in the file
.Xauthority
in the user's
home directory and is available to any X client wanting to use the X server to display
a window. The file
.Xauthority
can be examined by the user with the tool
xauth
.
If you were to rename
.Xauthority
or if you deleted the file from your home direc-
tory by accident, you would not be able to open any new windows or X clients.
SSH (secure shell) can be used to encrypt a network connection completely and forward
it to an X server transparently without the encryption mechanism being perceived by
the user. This is also called X forwarding. X forwarding is achieved by simulating an
X server on the server side and setting a DISPLAY variable for the shell on the remote
host. Further details about SSH can be found in
Chapter 14, SSH: Secure Network Op-
erations (page 161).
WARNING
If you do not consider the host where you log in to be a secure host, do not
use X forwarding. With X forwarding enabled, an attacker could authenticate
via your SSH connection to intrude on your X server and sniff your keyboard
input, for instance.
1.1.9 Buffer Overflows and Format String
Bugs
As discussed in Section 1.1.5, “Buffer Overflows and Format String Bugs” (page 5),
buffer overflows and format string bugs should be classified as issues concerning both
local and network security. As with the local variants of such bugs, buffer overflows
in network programs, when successfully exploited, are mostly used to obtain
root
permissions. Even if that is not the case, an attacker could use the bug to gain access
to an unprivileged local account to exploit any other vulnerabilities that might exist on
the system.
Buffer overflows and format string bugs exploitable over a network link are certainly
the most frequent form of remote attacks in general. Exploits for these—programs to
exploit these newly-found security holes—are often posted on the security mailing lists.
They can be used to target the vulnerability without knowing the details of the code.
8 Security Guide