Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007, Руководство по установке

Страница: 904 / 982

In the case of cookie-based access control, a character string is generated that is only
known to the X server and to the legitimate user, just like an ID card of some kind. This
cookie (the word goes back not to ordinary cookies, but to Chinese fortune cookies,
which contain an epigram) is stored on login in the file
.Xauthority
in the user's
home directory and is available to any X client wanting to use the X server to display
a window. The file
.Xauthority
can be examined by the user with the tool xauth.
If you were to rename
.Xauthority
or if you deleted the file from your home direc-
tory by accident, you would not be able to open any new windows or X clients. Read
more about X Window System security mechanisms in the man page of Xsecurity
(
man Xsecurity
).
SSH (secure shell) can be used to encrypt a network connection completely and forward
it to an X server transparently without the encryption mechanism being perceived by
the user. This is also called X forwarding. X forwarding is achieved by simulating an
X server on the server side and setting a DISPLAY variable for the shell on the remote
host. Further details about SSH can be found in
Chapter 44, SSH: Secure Network Op-
erations (page 827).
WARNING
If you do not consider the host where you log in to be a secure host, do not
use X forwarding. With X forwarding enabled, an attacker could authenticate
via your SSH connection to intrude on your X server and sniff your keyboard
input, for instance.
49.1.9 Buffer Overflows and Format String
Bugs
As discussed in Section 49.1.5, “Buffer Overflows and Format String Bugs” (page 883),
buffer overflows and format string bugs should be classified as issues concerning both
local and network security. As with the local variants of such bugs, buffer overflows
in network programs, when successfully exploited, are mostly used to obtain
root
permissions. Even if that is not the case, an attacker could use the bug to gain access
to an unprivileged local account to exploit any other vulnerabilities that might exist on
the system.
Buffer overflows and format string bugs exploitable over a network link are certainly
the most frequent form of remote attacks in general. Exploits for these—programs to
886 Installation and Administration