Bug 490606

Summary: patch xau-1.0.4-local.patch breaks ssh X11 forwarding, when X11UseLocalhost is on
Product: [Fedora] Fedora Reporter: Fabrice Bellet <fabrice>
Component: libXauAssignee: Søren Sandmann Pedersen <sandmann>
Status: CLOSED NEXTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 11CC: ajax, fabrice, kem, sandmann
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-12-07 20:16:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Fabrice Bellet 2009-03-17 09:37:58 UTC 
Hi!

NetworkManager has the possibility to change the hostname when the user moves from one network to another. NM also updates the 127.0.0.1 entry in /etc/hosts, with this new hostname.

When sshd is running on such a machine, that is reached remotely with X11 forwarding enabled, the ~/.Xauthority file will contain several entries for the same couple (unix socket, port number), that will differ only by the hostname that _was_ the localhost when the cookie had been previously added. 

For example :

bonobo.domain1.com/unix:12  MIT-MAGIC-COOKIE-1  de1b9xxxxxx
bonobo.domain2.com/unix:12  MIT-MAGIC-COOKIE-1  da78bxxxxxx

[bellet@bonobo ~]$ xhost
X11 connection rejected because of wrong authentication.
xhost:  unable to open display "localhost:12.0"

It seems to me that the problem with xau-1.0.4-local.patch is, that without checking the hostname, when family is FamilyLocal, you try to authenticate with the wrong cookie.

Rebuilding the rpm with this patch disabled gives back the expected behaviour:

[bellet@bonobo ~]$ xhost
access control enabled, only authorized clients can connect
SI:localuser:bellet

I think that, this case would also be resolved, if xauth is modified so that the command "xauth remove :xx.0" invoked by the ssh client, removes _all_ entries matching "unix/xx", and not only the one matching the current hostname for localhost.
Comment 1 Bug Zapper 2009-06-09 12:17:37 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle.
Changing version to '11'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 2 Fabrice Bellet 2009-12-07 20:16:44 UTC 
fixed in 1.0.4-5