2

I have a CentOS server that currently has no X server on it. It will be used for doing statistical crunching and providing other services (probably via a web interface). The main security for the box is provided by VPN.

Some of the users will need software that can't function without graphics. I'd rather not make even a minimal install of an Xserver and window manager, but if I do so I was planning installing X, a lightweight desktop or even just a window manager, and VNC. Users would connect to VNC sessions via ssh tunneling. One big advantage of this arrangement is that if the network connection drops, whatever is running persists instead of dying.

For persistence, people in operations suggested I look into using xpra instead. I did a dry run of an install, and it installs an X server, so at least on its face I don't see any advantage to this approach, either in terms of security or simplicity.

Is there any security reason to prefer the xpra approach over VNC+Xserver+ssh tunnelling?

Improve this question

1 Answer 1

Reset to default
4

The "normal" way to use remote X11 is to have the X11 server run not on your server, but on the machine which is physically in front of the user. Then use ssh to do X11 forwarding, so that the application on your server talks to the X11 server that runs on the client machine.

(Yes, the terminology is a bit confusing. "Your server" is the machine you are talking about, and the "X11 server" is the software that manages graphical display, called "server" because it waits for applications -- the "clients" -- to talk to it.)

I understand that you also want to have a sort of "mobility feature" that allows roaming users to disconnect and reconnect from several client machines without closing application, in which case the classic model is not appropriate.

The usual perceived security issues with X11 servers is that they run with high privileges (because they must access the graphic hardware) and they make use of components whose security is often considered as flaky (the drivers for the graphic hardware). Xpra uses Xdummy, which removes both problems: it does not actually talk to real hardware (so no drivers in the loop), and it does not run as root but under the identity of the calling user. In that sense, I would deem Xpra to be "better" for security than running a plain local Xserver exported through VNC.

(Conceptually you could run Xdummy with VNC, but that's basically reinventing Xpra.)

I also expect Xpra to make things much easier, compared to a Xserver+VNC setup, when it comes to:

  1. supporting several users simultaneously;
  2. supporting various screen sizes on the client side.

On the cons side, Xpra is under very active development, which, while ensuring good support, also means that deployed code has not "stood the test of time". Usually, for best security, you want to use software that is well supported but has nonetheless stabilized a bit. This is not a big problem, though.

Improve this answer
2
  • Thanks for the information. I was aware of distinct client/server nomenclature for X11; one of the reasons I'm not convinced about the simplicity (if not the security) advantage of the xpra solution is that, like I said, at least a naive xpra install on the remote host pulls in xorg-x11-server-Xorg. OTOH, I like what you're saying about the implications of using Xdummy. Thanks.
    – user1071847
    Apr 15, 2016 at 18:55
  • "The usual perceived security issues with X11 servers is that they run with high privileges..." I don't think that's true for Xvnc. (I know there's other pieces in the VNC ecosystem for which it might need to run suid, but I'd only need those pieces if the server weren't headless.)
    – user1071847
    Apr 27, 2016 at 12:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .