[plug] finally starting to get somewhere

[Matt Kemner]

On Mon, 1 Nov 1999, Stephen Smart wrote:

> You probably have activated the Auto-configure hostname option and the X Server 
> has problems connecting to your newly named host.
 ... 
> Issuing xhost + before starting the connection
> would do the job, but be warned of any security risks that involves since
> everyone else is granted access to your X Server. 

What the hell? They're advertising "xhost +" on a dialup machine?
The person that wrote that FAQ deserves to be hung, drawn and quartered.

> I had a look and the Auto-configure is not ticked

Sounds like kppp is buggy as all hell if the box is not ticked, but it
goes ahead and does it anyway.
My suggestion is to scrap kppp and configure kppp the oldfashioned way. :)
See http://live.networx.net.au/LinuxToNetworx.txt for some basic
instructions on how to set up a Linux machine to dial into Networx
It should work with most ISPs - just change the phone number and DNS
settings to match your ISP.

> I use the xhost + and all works fine again but what sort of security
> risk are we talking about here.

We are talking a gigantic risk.

By issuing "xhost +" you are saying to your X server "accept connections
from all hosts on the internet" which means anybody can run X applications
on your X server without your permission - and without you even knowing.

There are several programs available that will connect to a remote X
server, that don't pop up a window on the screen, but that sit there and
record all keystrokes and mouseclicks, and sends them back to the person
running the program.

Anybody could run such a program, connecting to your system, and then scan
the logs for something like "su - root" and on the next line read your
root password. 

 - Matt