4 ms·

It's somewhat common to install a graphical environment on server machines, particularly if they need to run certain (Oracle) enterprise software, for which GUI

It's somewhat common to install a graphical environment on server machines, particularly if they need to run certain (Oracle) enterprise software, for which GUI tools are either the only option, or by far the most expected and documented solution. Of course in theory you could install the bare minimum to run the utility using X-forwarding, in practice anyone doing this usually installs a full environment because it's much simpler to manage. Plus, there are a few admins out there who simply prefer to use VNC over a straight terminal. I'm not here to judge; while this is uncommon, it's certainly not unheard of. Personally I would rather not have that much attack surface on my servers, but there are a few legitimate use cases here and there.

Twirrim 6y ago
> It's somewhat common to install a graphical environment on server machines It's really not that common. Yes there's the odd cases of servers that use enterprise software that have to have GUIs, but most linux boxes run headless. GUIs are just a waste of processing power and resources for the large majority of the things that servers are used for. That said, I'm not happy that Canonical are entirely discounting the possibility that customers will have desktop environments installed on servers. It's not common, but it does happen.
- dannyw 6y ago
  One thing to note is that depending on how your network is structured and firewalled, if _one_ server has a graphical env of some sort (maybe a ML/image processing server that has graphical environments installed)... root access could be nasty nonetheless. I never install GUIs on my servers, but when deploying a image processing server, while installing another package to debug CUDA/drivers, I've unintentionally added a full windowing system without realising it.
  - woodson 6y ago
    Unfortunately, nvidia-settings requires xorg to be installed and running (even when run in cli mode), and it's pretty much the only way to control fan speeds on consumer GPUs.
- necovek 6y ago
  I think this requires both a desktop environment to be installed, and local access to the server to be exploited (in most cases: X server is configured not to allow remote access by default in Ubuntu afaik). The core vulnerability is in gdm which means that you have to have that running as a system service. Though on second thought, if one can easily set up X forwarding as an unprivileged user, it might still be trivially exploitable. Anyway, the announcement means that Ubuntu has fixes in affected (desktop) packages. If they are installed on a server, they'd be fixed with next apt update/upgrade too: they use the same package repositories.
deleted 6y ago
[deleted]
apexalpha 6y ago
If you install a GUI on Ubuntu Server it simply becomes Ubuntu Desktop. There's no difference between the two, except for the presence of the GUI software. Simply go apt install ubuntu-desktop on any server and you got yourself a desktop install.

Twirrim 6y ago

> It's somewhat common to install a graphical environment on server machines It's really not that common. Yes there's the odd cases of servers that use enterprise software that have to have GUIs, but most linux boxes run headless. GUIs are just a waste of processing power and resources for the large majority of the things that servers are used for. That said, I'm not happy that Canonical are entirely discounting the possibility that customers will have desktop environments installed on servers. It's not common, but it does happen.

dannyw 6y ago
One thing to note is that depending on how your network is structured and firewalled, if _one_ server has a graphical env of some sort (maybe a ML/image processing server that has graphical environments installed)... root access could be nasty nonetheless. I never install GUIs on my servers, but when deploying a image processing server, while installing another package to debug CUDA/drivers, I've unintentionally added a full windowing system without realising it.
- woodson 6y ago
  Unfortunately, nvidia-settings requires xorg to be installed and running (even when run in cli mode), and it's pretty much the only way to control fan speeds on consumer GPUs.
necovek 6y ago
I think this requires both a desktop environment to be installed, and local access to the server to be exploited (in most cases: X server is configured not to allow remote access by default in Ubuntu afaik). The core vulnerability is in gdm which means that you have to have that running as a system service. Though on second thought, if one can easily set up X forwarding as an unprivileged user, it might still be trivially exploitable. Anyway, the announcement means that Ubuntu has fixes in affected (desktop) packages. If they are installed on a server, they'd be fixed with next apt update/upgrade too: they use the same package repositories.

deleted 6y ago

[deleted]

apexalpha 6y ago

If you install a GUI on Ubuntu Server it simply becomes Ubuntu Desktop. There's no difference between the two, except for the presence of the GUI software. Simply go apt install ubuntu-desktop on any server and you got yourself a desktop install.