Re: [Ltsp-discuss] X server vulnerability on ltsp clients

2014-09-10 Thread Denis Croombs
On 11/09/2014 05:03, Vagrant Cascadian wrote: > On 2014-09-10 14:39:21 -0500, Denis Croombs wrote: >> when we do a vulnerability scan it tells us that it is finding an x >> server on each pxe booted device iPhone using port 6007/tcp. > Thanks for reporting the issue, we didn't use the "-nolisten tc

Re: [Ltsp-discuss] X server vulnerability on ltsp clients

2014-09-10 Thread Vagrant Cascadian
On 2014-09-10 14:39:21 -0500, Denis Croombs wrote: > when we do a vulnerability scan it tells us that it is finding an x > server on each pxe booted device iPhone using port 6007/tcp. Thanks for reporting the issue, we didn't use the "-nolisten tcp" flag when starting the X server. I've fixed this

Re: [Ltsp-discuss] X server vulnerability on ltsp clients

2014-09-10 Thread James McQuillan
The X server is always listening for client apps to connect up and display stuff. Jim. On Wed, Sep 10, 2014 at 4:46 PM, Vagrant Cascadian wrote: > On 2014-09-10 15:10:14 -0500, Vagrant Cascadian wrote: > > I haven't yet verified for myself if 6007 is open in either the default > > or LDM_DIRECT

Re: [Ltsp-discuss] X server vulnerability on ltsp clients

2014-09-10 Thread Vagrant Cascadian
On 2014-09-10 15:10:14 -0500, Vagrant Cascadian wrote: > I haven't yet verified for myself if 6007 is open in either the default > or LDM_DIRECTX case, but will do so shortly... Seems to be an open port with or without LDM_DIRECTX, starts up as soon as LDM is running. I'm not sure what *exacty* X

Re: [Ltsp-discuss] X server vulnerability on ltsp clients

2014-09-10 Thread Vagrant Cascadian
On 2014-09-10 14:39:21 -0500, Denis Croombs wrote: > Hi, we have some lisp servers Wow, Lisp! Er, LTSP. :) > and pc's pxe booting as thin long-running all apps on the ltsp server, > but when we do a vulnerability scan it tells us that it is finding an > x server on each pxe booted device iPhone

Re: [Ltsp-discuss] X server vulnerability on ltsp clients

2014-09-10 Thread James McQuillan
By default, all of the X traffic is tunneled through the ssh connection. ssh will connect to the X server on a standard 600x range port, but it should be doing it on the loopback interface (127.0.0.1). But, the Xserver is probably still listening on the public interface (usually something like

[Ltsp-discuss] X server vulnerability on ltsp clients

2014-09-10 Thread Denis Croombs
Hi, we have some lisp servers and pc's pxe booting as thin long-running all apps on the ltsp server, but when we do a vulnerability scan it tells us that it is finding an x server on each pxe booted device iPhone using port 6007/tcp. I believed this connection between the pc and the server was ov