Configuring Exceed

cerated by KEVIN TWIDLE at http://www.doc.ic.ac.uk/~kpt/Exceed/

How to make your Xwindows (relatively) secure

After installing Exceed you will find that it is set up with no X windows security whatsoever.  By default anyone has access to your screen when you are running Exceed.  Access to your screen gives people the ability to create windows on it, or to read any part of your screen or even to intercept the mouse or keystrokes. Follow these step by step instructions to stop this from being allowed and to sleep happily at night.

Start Exceed and using your Exceed Toolbar click on the configuration icon (if your Exceed Toolbar is not visible you can right click on the Exceed button on your task bar at the bottom of the screen):

 

In the Xconfig window double-click on the Security icon

This will give you the following window:

As you can see from the settings anyone can access your screen from any computer on the Internet, this is not generally considered to be a Good Thing.

One possibility is to create a file called xhost.txt and to list the computers that may have access to your screen.  This is better security but allows anyone on that computer to access your screen.

A better scheme is to use the User Access Control List.  This will allow only your applications to access your screen, other people running applications on the same computers will not be able to.  This works because your server (Exceed, on your PC) keeps a secret password and all your clients (programs on Unix computers that want to access your screen e.g. xterm, ghostview etc.) have to supply that same password.  The password is kept on Unix in a file that only you (and your programs) can read. This is not super secure because your password is passed backwards and forwards over the network but it is the best you can do.

The first step is to create a password entry in your special Unix X authority file.  First of all you should telnet to the Unix system that you normally use.  Use the run command from your start button at the bottom left of your screen.

Check that your Exceed system is working by running the following commands:

Replace "mypc" by the name of your PC.  You should get an X terminal appearing on your screen.  If you don't get a window at this stage then you may have the wrong name for your PC or Exceed may not be properly configured.  If your Security does not have the Disabled button selected then select it, click ok and try again.  If this still does not work you will have to see your system administrator, you will not be able to continue with this security configuration.

Type exit to the X terminal or kill it using the windows controls.  Now you can disable all access to your screen by clicking the "Enabled (no host access)" radio button in the Security window.  Click OK and allow the server to be reset if it asks you.  Try the above commands again, this time it should fail because you have not set up any passwords yet.

Open the security window again, it should now look like this:

You now have to make up a password by issuing a special Unix command.  Fill in your PC's host name an click on the Command button below, you will get a set of commands that you can copy and paste into your Unix system using the telnet window.
 
 
Enter your host name here:  

Now press the Command button 

 
Copy and paste one of the above commands to Unix.  Make sure that you select the complete line, the easiest way is to right-click at the start of the text and drag down one line. With any luck, if your Unix path is set up correctly, the first line will work.  If you get a "no such command error" then you can try the others.  If they all fail then you had better see your Unix System Administrator and ask him/her where the xauth command may be found.

After running the xauth command you should get just get another Unix prompt.  If the name of your computer is not recognised then you will get the error message:

Your computer name must be registered with CSG so that it is put into the Internet Domain Name Service (DNS).

Right, you have set up the Unix system so that whenever you run the X server Exceed on your PC, the Unix clients will quote the password (the long string of hex digits in the xauth line) to your server.  You now have to copy the file containing the password to your PC.

You first have to find the name of the file on Unix where the password is kept.  In your telnet window run the following command:

You will see something like:
 
Authority file:       /home/kpt/.Xauthority 
File new:             no 
File locked:          yes 
Number of entries:    2 
Changes honoured:     yes 
Changes made:         no 
Current input:        (argv):1		 <-----This is the file name that you want
 
Now you know where to copy the file from, you now have to find out where to copy the file to. For this we go back to the Exceed Security window.  Click on the Enable User Access Control List check box and then on the Browse button.

Now click on the Browse button and you will get

This file window shows the directory where you must put your X authority file, you have no choice but to put it here!  You must now work out exactly where this directory actually is. You will use this window in a couple of steps' time.

Now assuming that you have the name of your Unix file to copy you can use the ftp program to copy it to the right place on your PC..

Start a command window on your PC.  Use the Run... option on the start menu on your Windows' task bar.  Enter cmd in the input box and press return:

You will now have a window looking something like:

Enter the text cd in the cmd window followed by a space, now click and drag one of the file names from the Exceed Browser window to the CMD window and let go of the mouse button.  You will see the cd command extended by the complete file name of the file that you dragged over. You can close the Browser window as it is no longer required.

e.g.

Delete the file name and the last '\' character then press return.  This will take you to the Exceed directory.  Note that if the disk drive with your Exceed directory differs from your current disk drive, you will have to change drives by typing the drive name as a command.  See below:

Now type ftp followed by the name of your Unix computer and log in.
 

Check your telnet window to see where your Unix X authority file is and tell the FTP program to copy the file over for you.  You need two commands, the first to make sure that you copy the file in binary mode and the second to start the copy.  The X authority file in the example above was in /home/kevin/.Xauthority so the two commands are:

The get command tells FTP to copy from the Unix file named in the first argument to the PC file named in the second.  You should now have a valid X authority file on your PC.  You do not need FTP nor the CMD window any longer, just select close on the top left-hand icon to get rid of it.

 

Now go back to your exceed security window and click on OK, resetting the server if asked.  You should now be able to repeat the xterm command from your telnet window and this time an X terminal window should appear on your screen.

Congratulations a job well done.