tailieunhanh - .Pro OpenSSH phần 7

Các máy chủ X (có nghĩa là, máy tính để bàn của bạn) xác thực của khách hàng X và xác định liệu khách hàng đó nên được phép kết nối với phiên X là máy chủ đang quản lý. Theo truyền thống, bạn sử dụng xhost để tạo ra một máy chủ X hoặc từ chối một bộ quy tắc. | CHAPTER 7 TCP FORWARDING 163 Caution If you set your DISPLAY variable manually or through a .profile or any login script you have just bypassed X11 forwarding over SSH. Setting your DISPLAY variable reverts to standard unencrypted X connections. Also if you need to mess with xauth you probably are not working within the realm of SSH forwarding. X Authentication The X server that is your desktop authenticates the X client and determines whether that client should be allowed to connect to the X session that server is managing. Traditionally you use xhost to create an X host or deny a rule set. This allows any user from the X client to connect to your display. The xauth method of X authentication is a key-based authentication that authenticates the X client system and the user. The .Xauthority file contains keys for X clients. This allows the X client to authenticate to the X server in a more trusted fashion. The keys are still normally without SSH transmitted in the clear. The keys in this case only provide authentication that is the session is still clear-text. When using X over SSH that xauth key exchange is encrypted and secured. Notes on X11 Many users rely on X11 as a way of life. Changing their login habits can be nearly impossible. I worked with an engineer once who claimed that if we removed the ability to log in directly over X via xdm his team would lose 5 minutes per person per day and that added up to thousands of dollars a year. Working with your organization to help them understand and then contain X can be challenging. I have found that many end users who are used to logging in via xdm gdm or kdm are willing to change to using ssh to access a host and then launch their X application if an administrator takes the time to explain the security benefits of doing so and offer instruction on how to make it work. Many users think the only way to work on UNIX systems is to log in to a UNIX desktop environment and then launch a few terminal clients. Once you .