From owner-freebsd-security@FreeBSD.ORG Tue Oct 28 08:44:07 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DD1C816A4CE for ; Tue, 28 Oct 2003 08:44:07 -0800 (PST) Received: from stinky.trash.net (stinky.trash.net [195.134.144.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0749343FB1 for ; Tue, 28 Oct 2003 08:44:03 -0800 (PST) (envelope-from bsdlist@kess.ch) Received: by stinky.trash.net (Postfix, from userid 1918) id 642E99495E; Tue, 28 Oct 2003 17:44:02 +0100 (MET) Date: Tue, 28 Oct 2003 17:44:02 +0100 From: Wolfgang Kess To: Jason Stone Message-ID: <20031028164402.GA9780@stinky.trash.net> References: <20031027211512.GA14467@stinky.trash.net> <20031027175709.C38023@walter> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20031027175709.C38023@walter> User-Agent: Mutt/1.4i Priority: normal cc: "freebsd-security@freebsd.org" Subject: Re: How to disable XFree86 and wdm listening ports X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Oct 2003 16:44:08 -0000 On Mon, Oct 27, 2003 at 06:00:42PM -0800, Jason Stone wrote: > > If you think that you might someday invoke X with a different display > manager, you might consider replacing /usr/X11R6/bin/X with a shell script > that calls "X.real -nolisten tcp" - this would make all methods of > starting X not use the tcp port. On the other hand, you'll have to > remember to maintain it when you upgrade. A very nice recommendation. X is linked to Xwrapper-4 lrwxr-xr-x 1 root wheel - 10 Oct 22 18:18 X@ -> Xwrapper-4 Please publish your shell script. > Also, it's probably a good idea to firewall of that port as well - defense > in depth and all that. Yes, I'll do so. Thank's Wolfgang