|
Bugzilla – Full Text Bug Listing |
| Summary: | YaST XDMCP firewall support and description of /etc/sysconfig/displaymanager DISPLAYMANAGER_REMOTE_ACCESS | ||
|---|---|---|---|
| Product: | [openSUSE] SUSE LINUX 10.0 | Reporter: | Stanislav Brabec <sbrabec> |
| Component: | Basesystem | Assignee: | Ruediger Oertel <ro> |
| Status: | RESOLVED FIXED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Enhancement | ||
| Priority: | P0 - Crit Sit | CC: | lnussel, ro |
| Version: | Final | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | All | ||
| Whiteboard: | |||
| Found By: | Other | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Stanislav Brabec
2005-09-21 11:14:51 UTC
well, asking firewall maintainer then ... Ludwig: ok with that text ? XDMCP support has been added into the yast2 firewall module... ms: is that file /etc/sysconfig/displaymanager yours? no it's Stefans Well. There is one another configuration option and one another port in the same file: # TCP port 6000 of Xserver. When set to "no" (default) Xserver is # started with "-nolisten tcp". Only set this to "yes" if you really # need to. Then you have to open TCP port 6000 to allow this access. # Use ssh X11 port forwarding whenever possible. DISPLAYMANAGER_XSERVER_TCP_PORT_6000_OPEN="no" And firewall should contain following ports: TCP 6000 - X :0 - remote access to X display and maybe TCP 6001 - X :1 - remote access to X display I am not sure whether to open more ports. Rudi, please make the changes for DISPLAYMANAGER_REMOTE_ACCESS in sysconfig.displaymanager mentioned in comment #1 and reassign to Ludwig afterwards. It's just a bunch of tcp and udp ports so no special firewall support needed. I'd explicitely mention which ones are needed in the config file though. Btw IIRC gdm opens the second display at :20. comment for DISPLAYMANAGER_REMOTE_ACCESS changed. I don't see what I am supposed to do. Reopening, taking the bug. I will check, what exactly must be done with firewall for following scenarios: - Private XDMCP server (invisible to others). - Public XDMCP server (visible to others). - Remote XDMCP client. - Server opened for direct use by remote X application. Ports required for X remote access: TCP 6000+server_no (it means 6000 for :0, 6001 for :1 etc.) Ports required for XDMCP client: TCP 6000+server_no (it means 6000 for :0, 6001 for :1 etc.) UDP 1025-5999 (all these packets has source port 177) Other non-critical ports tried by gdm client: UDP 5353 (multicast DNS) Ports required for XDMCP server: UDP 177 UDP broadcast 177 (without it you can create invisible XDMCP server, which can be used by X -query, but invisible for chooser) Other non critical ports tried by gdm server: UDP 68 (bootpc, source port = 67) Stanislav, what are we supposed to do with your information? Either Ludwig will decide, that opening UDP port range (or even providing remote X access) is bad. In this case we should change above mentioned commets again and recommend turning firewall off for interfaces, where XDMCP service is provided. Or it is OK for security team and then YaST2 team should create firewall settings: XDMCP client, XDMCP server, Remote X access and otionally Invisible XDMCP server (without broadcast port). Please note, that all three services should run only in trusted networks, because are by design vulnerable to DoS and remote X access traffic contains unencrypted key presses. Opening such a large port range certainly is a bad thing. I agree with Stanislav that xdcmp is a service for trusted networks, ie internal zone or no firewall at all. The internal zone has all ports open anyways. There is no yast frontend for configuring xdcmp right? So no need for extra xdcmp gui options in yast either IMO. I expect noone is going to test them in every release anyways. There is a YaST sysconfig editor for configuring XDMCP. And help in these options has to be consistent with real behavior. And because default behavior disables both XDMCP and port 6000, we muse cleanly state, that XDMCP server has to be in zone not protected by firewall. For port 6000, it depends on your decission - either firewall will support it or not. If not, we should say the same in the help of DISPLAYMANAGER_XSERVER_TCP_PORT_6000_OPEN. Proposed change: # Allow remote access (XDMCP) to your display manager (xdm/kdm/gdm). Please note # that a modified kdm or xdm configuration, e.g. by KDE control center # will not be changed. For gdm, values will be updated after change. # XDMCP service should run only on trusted networks and you have to disable # firewall for interfaces, where you want to provide this service. Nice, now we're back at comment #1. Rudi: mir@chu:src > rpm -qf /var/adm/fillup-templates/sysconfig.displaymanager aaa_base-10.0-28 Please don't reassign to yast2 ;-) In this case please also change: # TCP port 6000 of Xserver. When set to "no" (default) Xserver is # started with "-nolisten tcp". Only set this to "yes" if you really # need to. Remote X service should run only on trusted networks and # you have to disable firewall for interfaces, where you want to # provide this service. Use ssh X11 port forwarding whenever possible. both comments updated. |