accessing x on remote system 2

[garwain]

I have a server that I've set up but since the phone company has fallen behind schedule on bringing DSL lines to my town I'm going to set up the server co-location for a while.

Is there any way to access the work in xwindows on the server from a remote machine?

 

[ifincham]

Hi,

As long as theres no firewalling of the ports that should be no problem. If you want full remote X access you must have a X display manager running all the time (i.e. XDM, GDM, or KDM). In other words it must default to GUI logon at runlevel 5 (or equivalent if not redhat). See -->

http://www.linuxdoc.org/HOWTO/XDMCP-HOWTO/

Otherwise, you can run single remote x apps such as xterm . With this you normally telnet / ssh in first and do a xhost +ipaddress etc. See -->

http://www.linuxdoc.org/HOWTO/mini/Remote-X-Apps.html

The other option is to use VNC which is similar to the X protocol -->

http://www.uk.research.att.com/vnc/

However, that doesn't give a full remote gui if thats what you want.

Hope this helps

 

[DumTech]

ifincham -

If I may jump in with extra questions...

How does security fit in with those options? If you ssh to a host and launch an X app, is the IO from the app encrypted because you used ssh or do different ports come into play? Is there a way to make the other two possibilities more secure? I've heard VNC can be a bad idea if you're concerned with security...

[This is an area I've yet to even fiddle with much, though I do use VNC at home sometimes...]

 

[ifincham]

Hi,

ssh can (should) be used for running remote X apps because it is an encrypted session. Regular X uses TCP ports in the range 6000 to 6063, i.e. where 6000 is the first server, etc. XDM tends to use a random TCP port often 1024. However none of the regular X stuff (outside ssh) is encypted so there are obvious security exposures from plain text being sniffed over the network - the same goes for using telnet.

VNC as far as I recall uses TCP ports 5900 upwards in a similar way to X (5900 is first display, etc.). It, again, can be used with ssh although I can't say I've tried personally. See -->

http://www.uk.research.att.com/vnc/sshvnc.html

In summary, unless the session traffic is encrypted via ssh (or similar software solution) or a hardware based encryption using VPN equipment, then any protocol running via the public internet is vulnerable to packet sniffing or even session hijacking. See for instance -->

http://rr.sans.org/threats/hijack.php

So the ideal is always run encryted unless you want to run a risk instead..

Regards

 

[meekrob]

X and VNC can both be wrapped with SSH. Check out:

http://www.mandrakeuser.org/docs/secure/sssh.html

It's Mandrake oriented but it's a good document that tells how to wrap X and VNC in SSH among other things.

 

[DumTech]

Thanks for the info and the links! Good stuff!