Bug 490606 - patch xau-1.0.4-local.patch breaks ssh X11 forwarding, when X11UseLocalhost is on
patch xau-1.0.4-local.patch breaks ssh X11 forwarding, when X11UseLocalhost i...
Status: CLOSED NEXTRELEASE
Product: Fedora
Classification: Fedora
Component: libXau (Show other bugs)
11
All Linux
low Severity medium
: ---
: ---
Assigned To: Søren Sandmann Pedersen
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-03-17 05:37 EDT by Fabrice Bellet
Modified: 2014-06-18 05:11 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-12-07 15:16:44 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Fabrice Bellet 2009-03-17 05:37:58 EDT
Hi!

NetworkManager has the possibility to change the hostname when the user moves from one network to another. NM also updates the 127.0.0.1 entry in /etc/hosts, with this new hostname.

When sshd is running on such a machine, that is reached remotely with X11 forwarding enabled, the ~/.Xauthority file will contain several entries for the same couple (unix socket, port number), that will differ only by the hostname that _was_ the localhost when the cookie had been previously added. 

For example :

bonobo.domain1.com/unix:12  MIT-MAGIC-COOKIE-1  de1b9xxxxxx
bonobo.domain2.com/unix:12  MIT-MAGIC-COOKIE-1  da78bxxxxxx

[bellet@bonobo ~]$ xhost
X11 connection rejected because of wrong authentication.
xhost:  unable to open display "localhost:12.0"

It seems to me that the problem with xau-1.0.4-local.patch is, that without checking the hostname, when family is FamilyLocal, you try to authenticate with the wrong cookie.

Rebuilding the rpm with this patch disabled gives back the expected behaviour:

[bellet@bonobo ~]$ xhost
access control enabled, only authorized clients can connect
SI:localuser:bellet

I think that, this case would also be resolved, if xauth is modified so that the command "xauth remove :xx.0" invoked by the ssh client, removes _all_ entries matching "unix/xx", and not only the one matching the current hostname for localhost.
Comment 1 Bug Zapper 2009-06-09 08:17:37 EDT
This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle.
Changing version to '11'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 2 Fabrice Bellet 2009-12-07 15:16:44 EST
fixed in 1.0.4-5

Note You need to log in before you can comment on or make changes to this bug.