Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-25 Thread Vincent Lefevre
On 2014-03-25 12:08:12 +0200, Andrei POPESCU wrote: > Alt-SysRq-F is disabled on sid: > mar 25 12:03:28 sid kernel: SysRq : This sysrq operation is disabled. But what if someone logs in, uses all the memory left (possibly not even in a malicious way) so that this triggers the OOM killer, and the O

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-25 Thread Andrei POPESCU
On Vi, 21 mar 14, 10:34:03, Darac Marjal wrote: > On Fri, Mar 21, 2014 at 11:46:38AM +0200, Andrei POPESCU wrote: > > On Vi, 21 mar 14, 09:52:09, Gian Uberto Lauri wrote: > > > > > > You can access the console X was started from even when the machine is > > > locked. > > > > Seriously? I'd find t

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-24 Thread Brian
On Mon 24 Mar 2014 at 12:37:36 +0100, Vincent Lefevre wrote: > On 2014-03-23 21:06:55 +0100, Jörg-Volker Peetz wrote: > > Seems I'm a little bit old-fashioned ;-) > > According to the man-page Xsession(5) the system scripts take care of using > > a > > log-file, given that you indeed don't have ~

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-24 Thread Vincent Lefevre
On 2014-03-23 21:06:55 +0100, Jörg-Volker Peetz wrote: > Seems I'm a little bit old-fashioned ;-) > According to the man-page Xsession(5) the system scripts take care of using a > log-file, given that you indeed don't have ~/.xinitrc . > So maybe the man-page of startx(1) has to be updated, since i

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-23 Thread Jörg-Volker Peetz
Seems I'm a little bit old-fashioned ;-) According to the man-page Xsession(5) the system scripts take care of using a log-file, given that you indeed don't have ~/.xinitrc . So maybe the man-page of startx(1) has to be updated, since it only talks about ~/.xinitrc . Best regards, Jörg-Volker.

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Brian
On Sat 22 Mar 2014 at 21:19:59 +0100, Sven Joachim wrote: > On 2014-03-22 20:14 +0100, Brian wrote: > > > This is the fourth or fifth time in this thread a recommendation to use > > ~/.xinitrc has been made. No sensible Debian user would have such a file > > in his account. > > Care to elaborate

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Brian
On Sat 22 Mar 2014 at 15:02:58 -0500, Bill Wood wrote: > On Sat, 2014-03-22 at 19:14 +, Brian wrote: >. . . > > This is the fourth or fifth time in this thread a recommendation to use > > ~/.xinitrc has been made. No sensible Debian user would have such a file > > in his account. A happy D

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Sven Joachim
On 2014-03-22 20:14 +0100, Brian wrote: > On Sat 22 Mar 2014 at 17:50:11 +0100, Jörg-Volker Peetz wrote: > >> Jörg-Volker Peetz wrote, on 03/22/2014 16:52: >> > In order to keep the output of the X-session when starting with the command >> > startx, something like the following snippet could be in

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Bill Wood
On Sat, 2014-03-22 at 19:14 +, Brian wrote: . . . > This is the fourth or fifth time in this thread a recommendation to use > ~/.xinitrc has been made. No sensible Debian user would have such a file > in his account. A happy Debian system is one with ~/.xsession. I'm a Debian newbie, so --

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Brian
On Sat 22 Mar 2014 at 17:50:11 +0100, Jörg-Volker Peetz wrote: > Jörg-Volker Peetz wrote, on 03/22/2014 16:52: > > In order to keep the output of the X-session when starting with the command > > startx, something like the following snippet could be inserted into the file > > ~/.xinitrc : This is

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Jörg-Volker Peetz
Jörg-Volker Peetz wrote, on 03/22/2014 16:52: > In order to keep the output of the X-session when starting with the command > startx, something like the following snippet could be inserted into the file > ~/.xinitrc : > > > sessid="${HOSTNAME:-$(uname -n)}-${DISPLAY##*:}" > > # Send output to fi

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Jörg-Volker Peetz
In order to keep the output of the X-session when starting with the command startx, something like the following snippet could be inserted into the file ~/.xinitrc : sessid="${HOSTNAME:-$(uname -n)}-${DISPLAY##*:}" # Send output to file # logfile="${XDG_CACHE_HOME:-$HOME}/xinit-${sessid}.log" :

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Joel Rees
On Sat, Mar 22, 2014 at 8:51 AM, Brian wrote: > On Fri 21 Mar 2014 at 12:37:57 -0400, Steve Litt of Troubleshooters.Com > wrote: > > > I think it depends on the situation. If you're at the library with your > > laptop and need to go to the bathroom, it's best to take the computer > > with you, be

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Vincent Lefevre
On 2014-03-21 13:35:37 -0400, Steve Litt of Troubleshooters.Com wrote: > To cure my paranoia of having stdout going to an unknown place, I made > the following executable /usr/local/bin/exx: > > == > #!/bin/bash > startx > /dev/null & exit > == > >

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-22 Thread Vincent Lefevre
On 2014-03-21 17:13:41 +0100, Gian Uberto Lauri wrote: > Vincent Lefevre writes: > > The fact that it is multi-user doesn't mean that it will necessarily > > be used by several desktop users. > > You can remove spawning the getty on tty you don't want to use. > > I don't know how to do this wit

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 12:37:57 -0400, Steve Litt of Troubleshooters.Com wrote: > I think it depends on the situation. If you're at the library with your > laptop and need to go to the bathroom, it's best to take the computer > with you, because it's easier to just walk off with it than to dink > w

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 12:37:57 -0400, Steve Litt of Troubleshooters.Com wrote: > I think it depends on the situation. If you're at the library with your > laptop and need to go to the bathroom, it's best to take the computer > with you, because it's easier to just walk off with it than to dink > w

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 12:37:57 -0400, Steve Litt of Troubleshooters.Com wrote: > On Fri, 21 Mar 2014 11:06:03 + > Robin wrote: > > > I may have missed something. If someone has physical access to your > > machine can't they just power off and go into single user mode and > > change the root

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Steve Litt of Troubleshooters.Com
On Fri, 21 Mar 2014 14:25:14 +0100 "Valerio Vanni" wrote: > "Brian" ha scritto nel messaggio > news:21032014113647.c62190855...@desktop.copernicus.demon.co.uk > > > For the situation when X is started with startx would 'startx & > > exit' prevent the termination of an X session even if CTRL+ALT

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Gian Uberto Lauri
Steve Litt of Troubleshooters.Com writes: > I think it depends on the situation. If you're at the library with your > laptop and need to go to the bathroom, it's best to take the computer > with you, because it's easier to just walk off with it than to dink > with the command prompt. Easier a

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Steve Litt of Troubleshooters.Com
On Fri, 21 Mar 2014 11:06:03 + Robin wrote: > I may have missed something. If someone has physical access to your > machine can't they just power off and go into single user mode and > change the root password? Unless you have a BIOS password or encrypted root partition (or encrypted partiti

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Steve Litt of Troubleshooters.Com
On Fri, 21 Mar 2014 09:24:21 + Jonathan Dowland wrote: > On Thu, Mar 20, 2014 at 02:19:46PM +, Brian wrote: > >Ctrl+Alt+F1...F12 > > For systems with virtual terminal support, these keystroke > > combinations are used to switch to virtual terminals 1 > > throug

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Gian Uberto Lauri
Vincent Lefevre writes: > The fact that it is multi-user doesn't mean that it will necessarily > be used by several desktop users. You can remove spawning the getty on tty you don't want to use. I don't know how to do this with systemd... With init you had some nice and well commented entries i

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Vincent Lefevre
On 2014-03-21 11:41:29 +, Brian wrote: > For the situation when X is started with startx would 'startx & exit' > prevent the termination of an X session even if CTRL+ALT+FN etc gets > console access? Doing the exit immediately can have some side effects in some configurations. For instance, my

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Vincent Lefevre
On 2014-03-21 10:34:03 +, Darac Marjal wrote: > On Fri, Mar 21, 2014 at 11:46:38AM +0200, Andrei POPESCU wrote: > > On Vi, 21 mar 14, 09:52:09, Gian Uberto Lauri wrote: > > > > > > You can access the console X was started from even when the machine is > > > locked. > > > > Seriously? I'd find

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 14:25:14 +0100, Valerio Vanni wrote: > "Brian" ha scritto nel messaggio > news:21032014113647.c62190855...@desktop.copernicus.demon.co.uk > > > For the situation when X is started with startx would 'startx & exit' > > prevent the termination of an X session even if CTRL+ALT

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Lisi Reisz
On Friday 21 March 2014 11:06:03 Robin wrote: > If someone has physical access to your > machine can't they just power off and go into single user mode and > change the root password? The default on Debian since I have been using it is that the root password is required for access via single user

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Gian Uberto Lauri
berenger.mo...@neutralite.org writes: > > > Le 21.03.2014 13:54, Gian Uberto Lauri a écrit : > > berenger.mo...@neutralite.org writes: > > > Can't ~/.xinitrc force startx to logout? > > > > H, maybe if you start x with . xinitrc . Me _idiot_! (despite the triple expresso shot). I sh

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Valerio Vanni
"Brian" ha scritto nel messaggio news:21032014113647.c62190855...@desktop.copernicus.demon.co.uk > For the situation when X is started with startx would 'startx & exit' > prevent the termination of an X session even if CTRL+ALT+FN etc gets > console access? I've always used "startx & exit", and

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Robin
On 21 March 2014 11:18, Darac Marjal wrote: > On Fri, Mar 21, 2014 at 11:06:03AM +, Robin wrote: >> I may have missed something. If someone has physical access to your >> machine can't they just power off and go into single user mode and >> change the root password? > > Maybe, maybe not. Conso

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread berenger . morel
Le 21.03.2014 13:54, Gian Uberto Lauri a écrit : berenger.mo...@neutralite.org writes: > Can't ~/.xinitrc force startx to logout? H, maybe if you start x with . xinitrc . Would you forgive me if I don't do the test right now and continue to do the work I am paid for :) ? Currently, yo

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Gian Uberto Lauri
berenger.mo...@neutralite.org writes: > Can't ~/.xinitrc force startx to logout? H, maybe if you start x with . xinitrc . Would you forgive me if I don't do the test right now and continue to do the work I am paid for :) ? -- /\ ___Ubuntu: anci

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread berenger . morel
Le 20.03.2014 02:44, Zenaan Harkness a écrit : Yeah, when making a machine for a less technical or less command-prompt comfortable person, I like to have it boot into GUI via the desktop manager. But when setting it up for myself or for people technically sharp enough to log in and then type "

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 11:18:19 +, Darac Marjal wrote: > On Fri, Mar 21, 2014 at 11:06:03AM +, Robin wrote: > > I may have missed something. If someone has physical access to your > > machine can't they just power off and go into single user mode and > > change the root password? > > Maybe

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Darac Marjal
On Fri, Mar 21, 2014 at 11:06:03AM +, Robin wrote: > I may have missed something. If someone has physical access to your > machine can't they just power off and go into single user mode and > change the root password? Maybe, maybe not. Console access doesn't have to mean complete access. The s

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Robin
I may have missed something. If someone has physical access to your machine can't they just power off and go into single user mode and change the root password? -- rob -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 10:24:54 +, Jonathan Dowland wrote: > On Fri, Mar 21, 2014 at 09:52:03AM +, Brian wrote: > > In an xterm (with or without using DontVTSwitch): > > > >brian@localhost:~$ chvt 4 > >Couldn't gat a file descriptor referring to the console > > > > Doubt no longer

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Darac Marjal
On Fri, Mar 21, 2014 at 11:46:38AM +0200, Andrei POPESCU wrote: > On Vi, 21 mar 14, 09:52:09, Gian Uberto Lauri wrote: > > > > You can access the console X was started from even when the machine is > > locked. > > Seriously? I'd find that to be a severe bug in the said locking > application. It

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Jonathan Dowland
On Fri, Mar 21, 2014 at 09:52:03AM +, Brian wrote: > In an xterm (with or without using DontVTSwitch): > >brian@localhost:~$ chvt 4 >Couldn't gat a file descriptor referring to the console > > Doubt no longer. :) Try via sudo. (risk reduced to: X session left open, terminal left open

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Brian
On Fri 21 Mar 2014 at 09:24:21 +, Jonathan Dowland wrote: > On Thu, Mar 20, 2014 at 02:19:46PM +, Brian wrote: > >Ctrl+Alt+F1...F12 > > For systems with virtual terminal support, these keystroke > > combinations are used to switch to virtual terminals 1 > > thro

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Andrei POPESCU
On Vi, 21 mar 14, 09:52:09, Gian Uberto Lauri wrote: > > You can access the console X was started from even when the machine is > locked. Seriously? I'd find that to be a severe bug in the said locking application. Kind regards, Andrei -- http://wiki.debian.org/FAQsFromDebianUser Offtopic disc

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Jonathan Dowland
On Thu, Mar 20, 2014 at 02:19:46PM +, Brian wrote: >Ctrl+Alt+F1...F12 > For systems with virtual terminal support, these keystroke > combinations are used to switch to virtual terminals 1 > through 12, respectively. This can be disabled with the > DontVTSwitc

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-21 Thread Gian Uberto Lauri
Andrei POPESCU writes: > 3. any user, with or without root access, who doesn't lock his > workstation as needed[1] deserves his fate. And does not uses startx; exit You can access the console X was started from even when the machine is locked. -- /\ ___

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-20 Thread Andrei POPESCU
On Jo, 20 mar 14, 12:44:21, Zenaan Harkness wrote: > > Anyone with physical access to your computer could: > > a) logout of your gui session (if it's not screensaver locked), taking > them back to your command line, and depending on your settings of > /etc/sudoers tty_tickets or respectively !tty

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-20 Thread Brian
On Wed 19 Mar 2014 at 22:48:49 -0400, Steve Litt of Troubleshooters.Com wrote: > On Thu, 20 Mar 2014 12:44:21 +1100 > Zenaan Harkness wrote: > > > SO: what to do? > > > > What I did for a while was: > > a) log in to Linux console > > b) startx; exit > > Outstanding! I'm going to start doing th

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-20 Thread Brian
On Thu 20 Mar 2014 at 12:44:21 +1100, Zenaan Harkness wrote: > > Yeah, when making a machine for a less technical or less command-prompt > > comfortable person, I like to have it boot into GUI via the desktop > > manager. But when setting it up for myself or for people technically > > sharp enough

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-20 Thread Curt
On 2014-03-20, Vincent Lefevre wrote: > > For instance, type: > > sleep 2; exit > > and Ctrl-C just after. The "sleep 2" is interrupted, but "exit" > isn't run. > > You could still do "exec startx", but this may not be OK if you > want *logout files to be sourced for clean-up. Not using sudo wo

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-20 Thread Vincent Lefevre
On 2014-03-20 12:44:21 +1100, Zenaan Harkness wrote: > When logging in at the Linux console (on current kernels at least), > then running startx, there is a security problem: > > Anyone with physical access to your computer could: > > a) logout of your gui session (if it's not screensaver locked)

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-19 Thread Scott Ferguson
On 20/03/14 13:48, Steve Litt of Troubleshooters.Com wrote: > On Thu, 20 Mar 2014 12:44:21 +1100 > Zenaan Harkness wrote: > >>> Yeah, when making a machine for a less technical or less >>> command-prompt comfortable person, I like to have it boot into GUI >>> via the desktop manager. But when set

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-19 Thread Zenaan Harkness
>> their way with the machine. > > Of course. This is simply one extra layer of protection, and will only > protect you against a quick-and-dirty type attach which might > otherwise be done in just a few seconds. This script can prevent that > type of physical-access attack,

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-19 Thread Zenaan Harkness
On 3/20/14, Steve Litt of Troubleshooters.Com wrote: > On Thu, 20 Mar 2014 12:44:21 +1100 > Zenaan Harkness wrote: > >> > Yeah, when making a machine for a less technical or less >> > command-prompt comfortable person, I like to have it boot into GUI >> > via the desktop manager. But when setting

Re: Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-19 Thread Steve Litt of Troubleshooters.Com
On Thu, 20 Mar 2014 12:44:21 +1100 Zenaan Harkness wrote: > > Yeah, when making a machine for a less technical or less > > command-prompt comfortable person, I like to have it boot into GUI > > via the desktop manager. But when setting it up for myself or for > > people technically sharp enough t

Security Implications of running startx from command line - was Re: Startx: was Great Debian experience

2014-03-19 Thread Zenaan Harkness
> Yeah, when making a machine for a less technical or less command-prompt > comfortable person, I like to have it boot into GUI via the desktop > manager. But when setting it up for myself or for people technically > sharp enough to log in and then type "startx" (and people you can > trust with the

Re: Startx: was Great Debian experience

2014-03-19 Thread Lisi Reisz
On Wednesday 19 March 2014 15:50:41 Steve Litt of Troubleshooters.Com wrote: > And last but > not least, booting to CLI and using startx gives me that nostalgic > feeling for when I was a young whippersnapper using Red Hat 5.1. :-) Lisi -- To UNSUBSCRIBE, email to debian-user-requ...@lists.de