Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-25 Thread Andrei POPESCU
On Vi, 21 mar 14, 10:34:03, Darac Marjal wrote: On Fri, Mar 21, 2014 at 11:46:38AM +0200, Andrei POPESCU wrote: On Vi, 21 mar 14, 09:52:09, Gian Uberto Lauri wrote: You can access the console X was started from even when the machine is locked. Seriously? I'd find that to be a

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-25 Thread Vincent Lefevre
On 2014-03-25 12:08:12 +0200, Andrei POPESCU wrote: Alt-SysRq-F is disabled on sid: mar 25 12:03:28 sid kernel: SysRq : This sysrq operation is disabled. But what if someone logs in, uses all the memory left (possibly not even in a malicious way) so that this triggers the OOM killer, and the

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-24 Thread Vincent Lefevre
On 2014-03-23 21:06:55 +0100, Jörg-Volker Peetz wrote: Seems I'm a little bit old-fashioned ;-) According to the man-page Xsession(5) the system scripts take care of using a log-file, given that you indeed don't have ~/.xinitrc . So maybe the man-page of startx(1) has to be updated, since it

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-24 Thread Brian
On Mon 24 Mar 2014 at 12:37:36 +0100, Vincent Lefevre wrote: On 2014-03-23 21:06:55 +0100, Jörg-Volker Peetz wrote: Seems I'm a little bit old-fashioned ;-) According to the man-page Xsession(5) the system scripts take care of using a log-file, given that you indeed don't have

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-23 Thread Jörg-Volker Peetz
Seems I'm a little bit old-fashioned ;-) According to the man-page Xsession(5) the system scripts take care of using a log-file, given that you indeed don't have ~/.xinitrc . So maybe the man-page of startx(1) has to be updated, since it only talks about ~/.xinitrc . Best regards, Jörg-Volker.

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Vincent Lefevre
On 2014-03-21 17:13:41 +0100, Gian Uberto Lauri wrote: Vincent Lefevre writes: The fact that it is multi-user doesn't mean that it will necessarily be used by several desktop users. You can remove spawning the getty on tty you don't want to use. I don't know how to do this with

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Vincent Lefevre
On 2014-03-21 13:35:37 -0400, Steve Litt of Troubleshooters.Com wrote: To cure my paranoia of having stdout going to an unknown place, I made the following executable /usr/local/bin/exx: == #!/bin/bash startx /dev/null exit == I invoke

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Joel Rees
On Sat, Mar 22, 2014 at 8:51 AM, Brian a...@cityscape.co.uk wrote: On Fri 21 Mar 2014 at 12:37:57 -0400, Steve Litt of Troubleshooters.Com wrote: I think it depends on the situation. If you're at the library with your laptop and need to go to the bathroom, it's best to take the computer

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Jörg-Volker Peetz
In order to keep the output of the X-session when starting with the command startx, something like the following snippet could be inserted into the file ~/.xinitrc : sessid=${HOSTNAME:-$(uname -n)}-${DISPLAY##*:} # Send output to file # logfile=${XDG_CACHE_HOME:-$HOME}/xinit-${sessid}.log :

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Jörg-Volker Peetz
Jörg-Volker Peetz wrote, on 03/22/2014 16:52: In order to keep the output of the X-session when starting with the command startx, something like the following snippet could be inserted into the file ~/.xinitrc : sessid=${HOSTNAME:-$(uname -n)}-${DISPLAY##*:} # Send output to file #

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Brian
On Sat 22 Mar 2014 at 17:50:11 +0100, Jörg-Volker Peetz wrote: Jörg-Volker Peetz wrote, on 03/22/2014 16:52: In order to keep the output of the X-session when starting with the command startx, something like the following snippet could be inserted into the file ~/.xinitrc : This is the

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Bill Wood
On Sat, 2014-03-22 at 19:14 +, Brian wrote: . . . This is the fourth or fifth time in this thread a recommendation to use ~/.xinitrc has been made. No sensible Debian user would have such a file in his account. A happy Debian system is one with ~/.xsession. I'm a Debian newbie, so --

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Sven Joachim
On 2014-03-22 20:14 +0100, Brian wrote: On Sat 22 Mar 2014 at 17:50:11 +0100, Jörg-Volker Peetz wrote: Jörg-Volker Peetz wrote, on 03/22/2014 16:52: In order to keep the output of the X-session when starting with the command startx, something like the following snippet could be inserted

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Brian
On Sat 22 Mar 2014 at 15:02:58 -0500, Bill Wood wrote: On Sat, 2014-03-22 at 19:14 +, Brian wrote: . . . This is the fourth or fifth time in this thread a recommendation to use ~/.xinitrc has been made. No sensible Debian user would have such a file in his account. A happy Debian

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Brian
On Sat 22 Mar 2014 at 21:19:59 +0100, Sven Joachim wrote: On 2014-03-22 20:14 +0100, Brian wrote: This is the fourth or fifth time in this thread a recommendation to use ~/.xinitrc has been made. No sensible Debian user would have such a file in his account. Care to elaborate why not?

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Andrei POPESCU
On Jo, 20 mar 14, 12:44:21, Zenaan Harkness wrote: Anyone with physical access to your computer could: a) logout of your gui session (if it's not screensaver locked), taking them back to your command line, and depending on your settings of /etc/sudoers tty_tickets or respectively

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Gian Uberto Lauri
Andrei POPESCU writes: 3. any user, with or without root access, who doesn't lock his workstation as needed[1] deserves his fate. And does not uses startx; exit You can access the console X was started from even when the machine is locked. -- /\ ___

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Jonathan Dowland
On Thu, Mar 20, 2014 at 02:19:46PM +, Brian wrote: Ctrl+Alt+F1...F12 For systems with virtual terminal support, these keystroke combinations are used to switch to virtual terminals 1 through 12, respectively. This can be disabled with the DontVTSwitch

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Andrei POPESCU
On Vi, 21 mar 14, 09:52:09, Gian Uberto Lauri wrote: You can access the console X was started from even when the machine is locked. Seriously? I'd find that to be a severe bug in the said locking application. Kind regards, Andrei -- http://wiki.debian.org/FAQsFromDebianUser Offtopic

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 09:24:21 +, Jonathan Dowland wrote: On Thu, Mar 20, 2014 at 02:19:46PM +, Brian wrote: Ctrl+Alt+F1...F12 For systems with virtual terminal support, these keystroke combinations are used to switch to virtual terminals 1 through 12,

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Jonathan Dowland
On Fri, Mar 21, 2014 at 09:52:03AM +, Brian wrote: In an xterm (with or without using DontVTSwitch): brian@localhost:~$ chvt 4 Couldn't gat a file descriptor referring to the console Doubt no longer. :) Try via sudo. (risk reduced to: X session left open, terminal left open,

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Darac Marjal
On Fri, Mar 21, 2014 at 11:46:38AM +0200, Andrei POPESCU wrote: On Vi, 21 mar 14, 09:52:09, Gian Uberto Lauri wrote: You can access the console X was started from even when the machine is locked. Seriously? I'd find that to be a severe bug in the said locking application. It's a

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 10:24:54 +, Jonathan Dowland wrote: On Fri, Mar 21, 2014 at 09:52:03AM +, Brian wrote: In an xterm (with or without using DontVTSwitch): brian@localhost:~$ chvt 4 Couldn't gat a file descriptor referring to the console Doubt no longer. :) Try

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Robin
I may have missed something. If someone has physical access to your machine can't they just power off and go into single user mode and change the root password? -- rob -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Darac Marjal
On Fri, Mar 21, 2014 at 11:06:03AM +, Robin wrote: I may have missed something. If someone has physical access to your machine can't they just power off and go into single user mode and change the root password? Maybe, maybe not. Console access doesn't have to mean complete access. The

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 11:18:19 +, Darac Marjal wrote: On Fri, Mar 21, 2014 at 11:06:03AM +, Robin wrote: I may have missed something. If someone has physical access to your machine can't they just power off and go into single user mode and change the root password? Maybe, maybe

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread berenger . morel
Le 20.03.2014 02:44, Zenaan Harkness a écrit : Yeah, when making a machine for a less technical or less command-prompt comfortable person, I like to have it boot into GUI via the desktop manager. But when setting it up for myself or for people technically sharp enough to log in and then type

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Gian Uberto Lauri
berenger.mo...@neutralite.org writes: Can't ~/.xinitrc force startx to logout? H, maybe if you start x with . xinitrc . Would you forgive me if I don't do the test right now and continue to do the work I am paid for :) ? -- /\ ___Ubuntu:

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread berenger . morel
Le 21.03.2014 13:54, Gian Uberto Lauri a écrit : berenger.mo...@neutralite.org writes: Can't ~/.xinitrc force startx to logout? H, maybe if you start x with . xinitrc . Would you forgive me if I don't do the test right now and continue to do the work I am paid for :) ? Currently,

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Robin
On 21 March 2014 11:18, Darac Marjal mailingl...@darac.org.uk wrote: On Fri, Mar 21, 2014 at 11:06:03AM +, Robin wrote: I may have missed something. If someone has physical access to your machine can't they just power off and go into single user mode and change the root password? Maybe,

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Valerio Vanni
Brian a...@cityscape.co.uk ha scritto nel messaggio news:21032014113647.c62190855...@desktop.copernicus.demon.co.uk For the situation when X is started with startx would 'startx exit' prevent the termination of an X session even if CTRL+ALT+FN etc gets console access? I've always used startx

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Gian Uberto Lauri
berenger.mo...@neutralite.org writes: Le 21.03.2014 13:54, Gian Uberto Lauri a écrit : berenger.mo...@neutralite.org writes: Can't ~/.xinitrc force startx to logout? H, maybe if you start x with . xinitrc . Me _idiot_! (despite the triple expresso shot). I should have

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Lisi Reisz
On Friday 21 March 2014 11:06:03 Robin wrote: If someone has physical access to your machine can't they just power off and go into single user mode and change the root password? The default on Debian since I have been using it is that the root password is required for access via single user

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 14:25:14 +0100, Valerio Vanni wrote: Brian a...@cityscape.co.uk ha scritto nel messaggio news:21032014113647.c62190855...@desktop.copernicus.demon.co.uk For the situation when X is started with startx would 'startx exit' prevent the termination of an X session even

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Vincent Lefevre
On 2014-03-21 10:34:03 +, Darac Marjal wrote: On Fri, Mar 21, 2014 at 11:46:38AM +0200, Andrei POPESCU wrote: On Vi, 21 mar 14, 09:52:09, Gian Uberto Lauri wrote: You can access the console X was started from even when the machine is locked. Seriously? I'd find that to be a

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Vincent Lefevre
On 2014-03-21 11:41:29 +, Brian wrote: For the situation when X is started with startx would 'startx exit' prevent the termination of an X session even if CTRL+ALT+FN etc gets console access? Doing the exit immediately can have some side effects in some configurations. For instance, my

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Gian Uberto Lauri
Vincent Lefevre writes: The fact that it is multi-user doesn't mean that it will necessarily be used by several desktop users. You can remove spawning the getty on tty you don't want to use. I don't know how to do this with systemd... With init you had some nice and well commented entries in

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Steve Litt of Troubleshooters.Com
On Fri, 21 Mar 2014 09:24:21 + Jonathan Dowland j...@debian.org wrote: On Thu, Mar 20, 2014 at 02:19:46PM +, Brian wrote: Ctrl+Alt+F1...F12 For systems with virtual terminal support, these keystroke combinations are used to switch to virtual terminals 1

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Steve Litt of Troubleshooters.Com
On Fri, 21 Mar 2014 11:06:03 + Robin rc.rattusrat...@gmail.com wrote: I may have missed something. If someone has physical access to your machine can't they just power off and go into single user mode and change the root password? Unless you have a BIOS password or encrypted root

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Gian Uberto Lauri
Steve Litt of Troubleshooters.Com writes: I think it depends on the situation. If you're at the library with your laptop and need to go to the bathroom, it's best to take the computer with you, because it's easier to just walk off with it than to dink with the command prompt. Easier and

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Steve Litt of Troubleshooters.Com
On Fri, 21 Mar 2014 14:25:14 +0100 Valerio Vanni vale...@valeriovanni.com wrote: Brian a...@cityscape.co.uk ha scritto nel messaggio news:21032014113647.c62190855...@desktop.copernicus.demon.co.uk For the situation when X is started with startx would 'startx exit' prevent the termination

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 12:37:57 -0400, Steve Litt of Troubleshooters.Com wrote: On Fri, 21 Mar 2014 11:06:03 + Robin rc.rattusrat...@gmail.com wrote: I may have missed something. If someone has physical access to your machine can't they just power off and go into single user mode and

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 12:37:57 -0400, Steve Litt of Troubleshooters.Com wrote: I think it depends on the situation. If you're at the library with your laptop and need to go to the bathroom, it's best to take the computer with you, because it's easier to just walk off with it than to dink with

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 12:37:57 -0400, Steve Litt of Troubleshooters.Com wrote: I think it depends on the situation. If you're at the library with your laptop and need to go to the bathroom, it's best to take the computer with you, because it's easier to just walk off with it than to dink with

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-20 Thread Vincent Lefevre
On 2014-03-20 12:44:21 +1100, Zenaan Harkness wrote: When logging in at the Linux console (on current kernels at least), then running startx, there is a security problem: Anyone with physical access to your computer could: a) logout of your gui session (if it's not screensaver locked),

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-20 Thread Curt
On 2014-03-20, Vincent Lefevre vinc...@vinc17.net wrote: For instance, type: sleep 2; exit and Ctrl-C just after. The sleep 2 is interrupted, but exit isn't run. You could still do exec startx, but this may not be OK if you want *logout files to be sourced for clean-up. Not using sudo

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-20 Thread Brian
On Thu 20 Mar 2014 at 12:44:21 +1100, Zenaan Harkness wrote: Yeah, when making a machine for a less technical or less command-prompt comfortable person, I like to have it boot into GUI via the desktop manager. But when setting it up for myself or for people technically sharp enough to log

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-20 Thread Brian
On Wed 19 Mar 2014 at 22:48:49 -0400, Steve Litt of Troubleshooters.Com wrote: On Thu, 20 Mar 2014 12:44:21 +1100 Zenaan Harkness z...@freedbms.net wrote: SO: what to do? What I did for a while was: a) log in to Linux console b) startx; exit Outstanding! I'm going to start doing

Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-19 Thread Zenaan Harkness
Yeah, when making a machine for a less technical or less command-prompt comfortable person, I like to have it boot into GUI via the desktop manager. But when setting it up for myself or for people technically sharp enough to log in and then type startx (and people you can trust with the

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-19 Thread Steve Litt of Troubleshooters.Com
On Thu, 20 Mar 2014 12:44:21 +1100 Zenaan Harkness z...@freedbms.net wrote: Yeah, when making a machine for a less technical or less command-prompt comfortable person, I like to have it boot into GUI via the desktop manager. But when setting it up for myself or for people technically

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-19 Thread Zenaan Harkness
On 3/20/14, Steve Litt of Troubleshooters.Com litt...@gmail.com wrote: On Thu, 20 Mar 2014 12:44:21 +1100 Zenaan Harkness z...@freedbms.net wrote: Yeah, when making a machine for a less technical or less command-prompt comfortable person, I like to have it boot into GUI via the desktop

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-19 Thread Zenaan Harkness
On 3/20/14, Zenaan Harkness z...@freedbms.net wrote: On 3/20/14, Steve Litt of Troubleshooters.Com litt...@gmail.com wrote: On Thu, 20 Mar 2014 12:44:21 +1100 Zenaan Harkness z...@freedbms.net wrote: Yeah, when making a machine for a less technical or less command-prompt comfortable

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-19 Thread Scott Ferguson
On 20/03/14 13:48, Steve Litt of Troubleshooters.Com wrote: On Thu, 20 Mar 2014 12:44:21 +1100 Zenaan Harkness z...@freedbms.net wrote: Yeah, when making a machine for a less technical or less command-prompt comfortable person, I like to have it boot into GUI via the desktop manager. But