Re: XDM Insecurity revisited

From: Jeremy Buhler (jbuhlerat_private)
Date: Sat Aug 21 1999 - 00:37:43 PDT

Next message: Adam Morrison: "Re: Solaris rpcbind tricks"

Previous message: Aleph One: "Microsoft Security Bulletin (MS99-030)"
Maybe in reply to: Jochen Bauer: "XDM Insecurity revisited"
Next in thread: Michael Herrmann: "Re: XDM Insecurity revisited"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> On the Red Hat side, for a standard Red Hat 6 using gdm 
> not xdm, edit /etc/X11/gdm.conf and set it to
> [xdcmp]
> Enable=0

Regular xdm has an equivalent switch, though it's not
documented anywhere but in the source code.  Add the
following resource to your xdm-config file (usually found
in the X11R6 tree in lib/X11/xdm):

! SECURITY: do not listen for XDMCP or Chooser requests
DisplayManager.requestPort:     0

Or, start xdm with the flag '-udpPort 0' .

Next message: Adam Morrison: "Re: Solaris rpcbind tricks"
Previous message: Aleph One: "Microsoft Security Bulletin (MS99-030)"
Maybe in reply to: Jochen Bauer: "XDM Insecurity revisited"
Next in thread: Michael Herrmann: "Re: XDM Insecurity revisited"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:57:53 PDT