Security Options

This appendix describes the following security options:

Using Client Authorization

Client authorization lets you control which users can send data to your Netstation.

If you enable Client Authorize (on the X Server - Security configuration screen or in the remote configuration file), your Netstation can only be used by clients that produce the correct 128-bit magic cookie or key. This method of authorization is also referred to as MIT-MAGIC-COOKIE-1 authorization.

When you log in via a display manager such as XDM, dtlogin, or vuelogin, a random key is generated. This key is written in your $HOME/.Xauthority file. Any client that can read this file can send data to your Netstation. Because you are usually the only user with access to this file, client authorization generally prevents other users from writing data to your display.

Disabling Client Authorization with the .Xauthority File

If you want to permit another user to send a window to your display, you need to give the user access to your .Xauthority file. Here is one way to give access for the current session:

You type from your home directory:
chmod 644 .Xauthority
The sender types from the home directory:
xauth merge receiver_home_dir/.Xauthority
You restore the original read/write permissions on the .Xauthority file by typing:
chmod 0600 .Xauthority

Because each new session has a new magic cookie, you will need to repeat these instructions for each session that you want to share windows (or turn off client authorization).

The .Xauthority file is in a format that you cannot view or edit. To modify this file, use the xauth utility. (For more information, type man xauth.)

Additionally, when the Netstation boots up, it reads the file pointed to by the Xauthority File configuration parameter (Xauthority File). Any magic cookies in this file will allow a client to access the X server. This file is inherently a public file (readable by TFTP), so the use of this feature should be restricted to testing or public Netstations. General users should also be prevented from writing or creating these files. The format of this file is the same as the .Xauthority which is created in the user's home directory.

Disabling Client Authorization with the Defeat Security Option

You can temporarily disable client authorization with [Defeat Security] on the X Server - Security configuration screens. When you enable [Defeat Security], all other local users will have access to your Netstation until you reboot or disable this button. Please note that when you select [Defeat Security], you disable both client authorization and access control.

Using Access Control

Access control lets you control which workstations can send data to your Netstation. Because many Netstations can use the same workstation, client authorization is usually more appropriate than access control. If you enable client authorization, access control is ignored.

If you enable Access Control (on the X Server - Security configuration screen or in the remote configuration file), your Netstation can be used by any client that is running on a workstation in the access control list. It can also be used by any client that has access to the appropriate key (described in Using Client Authorization).

The default access control list contains:

The value of the XDMCP Host parameter (by default, the file server). See XDMCP Host.
The computers listed in the file named by the Xhosts File parameter (by default, the /opt/hpxt/enware2/xthome/etc/terminalname.hosts file). See Xhosts File.

Modifying the Access Control List

To give a new workstation access to your Netstation, add its IP address or hostname to the /opt/hpxt/enware2/xthome/etc/terminalname.hosts file.

To revoke a workstation's access, remove it from this file.

To give or revoke access for the current session only, use xhost on the login server as follows:
xhost +host
xhost -host
where host is the hostname or IP address.

Disabling Access Control with the Defeat Security Option

You can temporarily disable access control with [Defeat Security] on the X Server - Security configuration screens. When you enable [Defeat Security], all other local users will have access to your Netstation until you reboot or disable this button. Please note that when you select [Defeat Security], you disable both access control and client authorization.

Controlling Remsh Access and Client Access

With the Remsh Access remote configuration parameter, you can specify which remote shell access (remsh or rsh) commands can be issued by a specific user on a specific workstation. This also determines which clients can be started.

For more information, see the following sections:

Remsh Access Privileges lists the access privileges that you can set.
Remsh Commands lists the commands and says which access privileges they require.

Remsh Access Privileges

With the Remsh Access remote configuration parameter, you can set the following access levels:

x: The user can start, query, or kill processes on the Netstation, and start clients that remain executing.
w: The user (and clients started by the user) can write configuration changes to the Netstation.
r: The user (and clients started by the user) can read configuration and statistics information from the Netstation.
*: Equivalent to rwx.
blank: The user has no access to the Netstation's remsh services.

Remsh Commands

Remsh commands have the following syntax:
remsh terminalname command [parameters]

For Sun workstations, use rsh instead of remsh.

For example, if your Netstation has the terminal name hpxterm1, the command to list the processes running on your Netstation is:

remsh hpxterm1 ps

To start up the configuration screens from the command line, enter the following:
remsh terminalname config

For a listing of all commands that get information from the Netstation, type:
remsh terminalname get help

Commands Requiring x Privileges:

local_client client_parameters: executes the specified local client. For example:
remsh xterm1 get log
ps: lists the processes running on the Netstation.
kill pid: terminates the specified local client.

Commands Requiring wx Privileges:

reset: resets the X server, terminating the current session.
reboot: reboots the Netstation.

Commands Requiring w Privileges:

putlog string: writes string to the Netstation's log screen.
reconfig: forces the Netstation to re-read its remote configuration file.

Commands Requiring r Privileges:

ls /dev/device: lists the directories for the specified device.
cat file: prints the specified file (or device).
get parameter: prints the specified information. Use get help for a list of available parameters.
adShow: lists the directives file loaded by the Netstation.
env: lists the Netstation's environment variables.

Commands Requiring No Privileges:

ping hostname: "pings" the specified device.

Securing the Configuration Screens

You can secure your configuration screens:

Network-wide with the Configuration Screen Area(n) Access remote configuration parameter
Locally, with the [Password] button on all configuration screens (if the Configuration Password Allowed parameter in the remote configuration file is set to true).

Setting the Configuration Screen Area(n) Remote Configuration Parameter

With the Configuration Screen Area(n) Access remote configuration parameter, you can specify which configuration screens a user can access. The "n" refers to one of the icons in the first column of the configuration screen, where:

1 = Network
2 = Terminal
3 = Diagnostic
4 = X Server

There are three levels of configuration lock:

Read Write: (Default). The configuration screens are completely accessible, unless the configuration Password has been set. When a user specifies a configuration password, only people who know the password can view or change the Netstation's configuration parameters.
Read Only: Users can view all the configuration screens, but cannot change any of the Netstation's configuration parameters.
Locked: Users cannot view the configuration screens or change any of the Netstation's configuration parameters.

When configuration access is locked, remote configuration and DHCP/BOOTP are automatically enabled.

Setting the Password on the Configuration Screens

In order to restrict local access to configuration screens, you can enable password protection on the configuration screens. To do this, complete the following steps:

Press and hold [F12] to access the configuration screens.
Select the [Password] button on the configuration screen. The [Password] button only appears when the remote configuration parameter Configuration Password Allowed is set to True (the default value is False). Change the value to True and reboot your Netstation to view the [Password] button.
The following popup window appears:

Password Configuration Popup Window
If this is the first time you are setting the password, type the new password in the New Password field.
If you have already set a password, type the password in the Old Password field. Then type the new password in the New Password field.
Confirm the new password by typing it into the Reenter New Password field.
Select [OK].

Your configuration screens are now locally protected.

Note: The values of the Configuration Screen Area(n) Access remote configuration parameters are still in effect when the Password field is enabled. For example, if the Configuration Screen Area(n) Access parameter is set to Locked, you will not be able to view the configuration screens or change any of the configuration parameters even if you know the correct password.