From owner-freebsd-security@FreeBSD.ORG Tue Oct 28 08:59:29 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8901C16A4CF for ; Tue, 28 Oct 2003 08:59:29 -0800 (PST) Received: from walter.dfmm.org (walter.dfmm.org [209.151.233.240]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4017443FF5 for ; Tue, 28 Oct 2003 08:59:28 -0800 (PST) (envelope-from freebsd-security@dfmm.org) Received: (qmail 9923 invoked by uid 1000); 28 Oct 2003 16:59:28 -0000 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 28 Oct 2003 16:59:28 -0000 Date: Tue, 28 Oct 2003 08:59:28 -0800 (PST) From: Jason Stone X-X-Sender: jason@walter To: Wolfgang Kess In-Reply-To: <20031028164402.GA9780@stinky.trash.net> Message-ID: <20031028084942.C38023@walter> References: <20031027211512.GA14467@stinky.trash.net> <20031027175709.C38023@walter> <20031028164402.GA9780@stinky.trash.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: "freebsd-security@freebsd.org" Subject: Re: How to disable XFree86 and wdm listening ports X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Oct 2003 16:59:29 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > > If you think that you might someday invoke X with a different display > > manager, you might consider replacing /usr/X11R6/bin/X with a shell script > > that calls "X.real -nolisten tcp" - this would make all methods of > > starting X not use the tcp port. On the other hand, you'll have to > > remember to maintain it when you upgrade. > > A very nice recommendation. > > X is linked to Xwrapper-4 > lrwxr-xr-x 1 root wheel - 10 Oct 22 18:18 X@ -> Xwrapper-4 > > Please publish your shell script. Um, I'm not using such a thing, but I imagine it would be something like the following. Call it something like /usr/X11R6/bin/X-no-tcp and symlink /usr/X11R6/bin/X to it. #!/bin/sh if [ -x /usr/X11R6/bin/Xwrapper-4 ] then exec /usr/X11R6/bin/Xwrapper-4 -nolisten tcp $@ elif [ -x /usr/X11R6/bin/XFree86 ] then exec /usr/X11R6/bin/XFree86 -nolisten tcp $@ else echo "Couldn't find Xwrapper-4 or XFree86 - sorry" >&2 exit 1 fi -Jason -------------------------------------------------------------------------- Freud himself was a bit of a cold fish, and one cannot avoid the suspicion that he was insufficiently fondled when he was an infant. -- Ashley Montagu -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (FreeBSD) Comment: See https://private.idealab.com/public/jason/jason.gpg iD8DBQE/nqBwswXMWWtptckRAoiyAJ4sGbSV/+U4/Yv3qVnFsJuYeS7whwCgyrrF Vu/aLcEzeZTjfMhMJBTIZN0= =k7nC -----END PGP SIGNATURE-----