4

I've never loved the idea of trusted X11 connections to shared machines. However, several years ago, we noticed that untrusted connections stopped working after a very short amount of time. After some digging, I found out that there's a "ForwardX11Timeout" setting that's set to a low-ish number; changing it to a big number (596h, in my case) makes the problem effectively go away.

But! I'm wondering if there's an important reason why this is set to a low number. Am I better off using a trusted X11 connection for some reason? ForwardX11Trusted (or ssh -Y) also makes the problem stop manifesting.

Nate
  • 143
  • 4

1 Answers1

2

I am not sure what is the exact problem you are talking about, but:

Is setting a long ForwardX11Timeout better than ForwardX11Trusted?

Each of these options solves different problem:

  • ForwardX11Trusted exposes you local X server so potential evil admin on the remote server can do whatever he wants (screenshots, input, keylogging, ...)
  • ForwardX11Timeout does not prevent anything from above. It just refuses X11 connections after some time. Settimg that to long time will basically "disable" it (well ... who is running ssh sessions 596 hours?). This option assumes that when you need to run X11 application, you start it soon after the connection is established. It is basically preventing the attack being performed on the idle connections without users notice (after 20 minutes by default).
Jakuje
  • 5,759
  • 1
  • 22
  • 34
  • Right: why is ForwardX11Timeout a thing? During the window before the timeout expires, are attackers able to do the same things the could do with a trusted connection? Or other, less-evil things? Or is it just a "there are no known attacks against this, but better safe than sorry"?

    20 minutes is really short. It seems like it's probably short for a reason. Is it short for a reason?

     – Nate Mar 10 '17 at 20:49
  • I never though about this option before. The commit introducing this feature brings little bit more light into the details about this option. I would consider it as "better than nothing". The textbook attack on the X11 forwarding is on long-running unattended sessions. 20 minutes is short enough to consider session "attended", but to work for genera use case. – Jakuje Mar 11 '17 at 15:10
  • I like that even in the commit message and source, there's no explicit documentation of what the option's intent is or why 20 minutes was chosen. – Nate Mar 13 '17 at 19:57
  • Yes. I searched even the release notes for openssh-5.6p1, but there is no note about this option. Probably the best would be ask authors, ideally on this mailing list: https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev – Jakuje Mar 13 '17 at 19:59