5 ms·

> It's somewhat common to install a graphical environment on server machines It's really not that common. Yes there's the odd cases of servers that use enterp

> It's somewhat common to install a graphical environment on server machines It's really not that common. Yes there's the odd cases of servers that use enterprise software that have to have GUIs, but most linux boxes run headless. GUIs are just a waste of processing power and resources for the large majority of the things that servers are used for. That said, I'm not happy that Canonical are entirely discounting the possibility that customers will have desktop environments installed on servers. It's not common, but it does happen.

dannyw 6y ago
One thing to note is that depending on how your network is structured and firewalled, if _one_ server has a graphical env of some sort (maybe a ML/image processing server that has graphical environments installed)... root access could be nasty nonetheless. I never install GUIs on my servers, but when deploying a image processing server, while installing another package to debug CUDA/drivers, I've unintentionally added a full windowing system without realising it.
- woodson 6y ago
  Unfortunately, nvidia-settings requires xorg to be installed and running (even when run in cli mode), and it's pretty much the only way to control fan speeds on consumer GPUs.
necovek 6y ago
I think this requires both a desktop environment to be installed, and local access to the server to be exploited (in most cases: X server is configured not to allow remote access by default in Ubuntu afaik). The core vulnerability is in gdm which means that you have to have that running as a system service. Though on second thought, if one can easily set up X forwarding as an unprivileged user, it might still be trivially exploitable. Anyway, the announcement means that Ubuntu has fixes in affected (desktop) packages. If they are installed on a server, they'd be fixed with next apt update/upgrade too: they use the same package repositories.

dannyw 6y ago

One thing to note is that depending on how your network is structured and firewalled, if _one_ server has a graphical env of some sort (maybe a ML/image processing server that has graphical environments installed)... root access could be nasty nonetheless. I never install GUIs on my servers, but when deploying a image processing server, while installing another package to debug CUDA/drivers, I've unintentionally added a full windowing system without realising it.

woodson 6y ago
Unfortunately, nvidia-settings requires xorg to be installed and running (even when run in cli mode), and it's pretty much the only way to control fan speeds on consumer GPUs.

necovek 6y ago

I think this requires both a desktop environment to be installed, and local access to the server to be exploited (in most cases: X server is configured not to allow remote access by default in Ubuntu afaik). The core vulnerability is in gdm which means that you have to have that running as a system service. Though on second thought, if one can easily set up X forwarding as an unprivileged user, it might still be trivially exploitable. Anyway, the announcement means that Ubuntu has fixes in affected (desktop) packages. If they are installed on a server, they'd be fixed with next apt update/upgrade too: they use the same package repositories.