1

I would like to understand how the following problem is technically possible:

In my company, we have a machine which I and several colleagues connect to. I regularly use x11 forwarding when I connect via SSH. (I receive the data with XQuartz on MacOS.) Today my colleague has connected to the machine via RDP and there, surprise, XQuartz opened the menu of Linux Mint, the OS of the machine, on my computer.

I realize that it is not my session that I control, but that of my colleague. Which is obviously a huge security problem.

How is this possible? Has something been misconfigured?

Improve this question
4
  • How exactly do both of you log in into the machine? This is a different machine with maybe separate users, so maybe you connect to the same user account?
    – Steffen Ullrich
    Commented Sep 1, 2022 at 9:29
  • We have different accounts for this common machine. It was his session from this computer that has been redirected to my "personal" computer.
    – Hantlowt
    Commented Sep 1, 2022 at 9:32
  • Could you better describe the RDP/X11 relationship? What RDP server are you running? Please specify the exact path and software used by you and your colleague to this server.
    – Adam Katz
    Commented Sep 1, 2022 at 17:20
  • We can log to this machine by SSH or RDP. My colleague prefers to use RDP, so he uses the internal Windows client for the remote desktop, and me, i'm using SSH (with x11 forwarding) on MacOS.
    – Hantlowt
    Commented Sep 2, 2022 at 7:39

1 Answer 1

Reset to default
0

If I understand this correctly, you are already connected from your Mac to this Linux Mint host using ssh with X11 forwarding. Then your colleague on Windows uses Remote Desktop to connect to this Mint host. Your colleague's resulting session appears on your Mac.

I'm going to assume that the Mint server uses some sort of VNC X11 server that is then wrapped as RDP (which is my understanding of what xrdp does). If that's true, I'm guessing there's a misconfiguration and it attaches VNC to your forwarded X11 display.

If you're just getting a specific application popping up on your display, your colleague is probably explicitly specifying your display, e.g. xclock -display :10. Ask them about what they see when they run echo $DISPLAY and see if it's the same thing you see (it should not be!).

Accidentally throwing things to another user's display is supposed to be prevented with the X Window authorization (see also man xauth). Your account shouldn't be permitting that (maybe you disabled that with xhost +, which might be in your Mac's ~/.bashrc).

Improve this answer
1
  • Oh, Brilliant ! Thank you very much for this explication !
    – Hantlowt
    Commented Nov 2, 2022 at 16:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .