4 ms·

ssh with X11 forwarding (-X option) had this same problem. A privileged malicious user on the host you were ssh'ed into might be able to monitor the keystrokes

by tshtf 16y ago

ssh with X11 forwarding (-X option) had this same problem. A privileged malicious user on the host you were ssh'ed into might be able to monitor the keystrokes of your whole X session.

tedunangst 16y ago
Note that hasn't been true for years and years. -Y and -X are different.
- tshtf 16y ago
  That's why I mentioned the -X option... -Y handles the problem the correct way and doesn't have the same issues. Edit: Ignore this, I was incorrect.
  - tedunangst 16y ago
    You have that backwards.
    - deleted 16y ago
      [deleted]
- rst 16y ago
  [deleted former mummery after five-minute fact-check] Unfortunately, the documentation on -X and -Y is awfully confusing. On a casual read, it looks like -Y is less safe, since practically the only thing the docs for -Y say is that forwarded connections are "not subjected to X11 SECURITY extension controls"...
  - tedunangst 16y ago
    You were apparently more right the first time. -X establishes an untrusted connection, subject to limitations. -Y says "trust me, no limits". -Y is the less safe option.
- rst 16y ago
  So, trying again... here are the caveats on -X, from the man page on the current version[1]: -X Enables X11 forwarding. This can also be specified on a per-host basis in a configuration file. X11 forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the user's X authorization database) can access the local X11 display through the forwarded connection. An attacker may then be able to perform activities such as keystroke monitoring. So, it's not documented as being proof against hostile parties with root at the remote end; in fact, it's documented as being vulnerable... [1] http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1 http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion...
  - tedunangst 16y ago
    That's why the next paragraph exists. For this reason, X11 forwarding is subjected to X11 SECURITY extension restrictions by default. Please refer to the ssh -Y option and the ForwardX11Trusted directive in ssh_config(5) for more information.
sciurus 16y ago
'-X' is supposedly the safe alternative to '-Y'. However, as a Cygwin/X maintainer says "this is widely considered to be not useful, because the Security extension uses an arbitrary and limited access control policy, which results in a lot of applications not working correctly and what is really a false sense of security" http://cygwin.com/ml/cygwin-xfree/2008-11/msg00154.html http://cygwin.com/ml/cygwin-xfree/2008-11/msg00154.html

by tshtf 16y ago

ssh with X11 forwarding (-X option) had this same problem. A privileged malicious user on the host you were ssh'ed into might be able to monitor the keystrokes of your whole X session.

tedunangst 16y ago

Note that hasn't been true for years and years. -Y and -X are different.

tshtf 16y ago
That's why I mentioned the -X option... -Y handles the problem the correct way and doesn't have the same issues. Edit: Ignore this, I was incorrect.
- tedunangst 16y ago
  You have that backwards.
  - deleted 16y ago
    [deleted]
rst 16y ago
[deleted former mummery after five-minute fact-check] Unfortunately, the documentation on -X and -Y is awfully confusing. On a casual read, it looks like -Y is less safe, since practically the only thing the docs for -Y say is that forwarded connections are "not subjected to X11 SECURITY extension controls"...
- tedunangst 16y ago
  You were apparently more right the first time. -X establishes an untrusted connection, subject to limitations. -Y says "trust me, no limits". -Y is the less safe option.
rst 16y ago
So, trying again... here are the caveats on -X, from the man page on the current version[1]: -X Enables X11 forwarding. This can also be specified on a per-host basis in a configuration file. X11 forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the user's X authorization database) can access the local X11 display through the forwarded connection. An attacker may then be able to perform activities such as keystroke monitoring. So, it's not documented as being proof against hostile parties with root at the remote end; in fact, it's documented as being vulnerable... [1] http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1 http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion...
- tedunangst 16y ago
  That's why the next paragraph exists. For this reason, X11 forwarding is subjected to X11 SECURITY extension restrictions by default. Please refer to the ssh -Y option and the ForwardX11Trusted directive in ssh_config(5) for more information.

sciurus 16y ago

'-X' is supposedly the safe alternative to '-Y'. However, as a Cygwin/X maintainer says "this is widely considered to be not useful, because the Security extension uses an arbitrary and limited access control policy, which results in a lot of applications not working correctly and what is really a false sense of security" http://cygwin.com/ml/cygwin-xfree/2008-11/msg00154.html http://cygwin.com/ml/cygwin-xfree/2008-11/msg00154.html