HP Visualize J5000 hp workstations - hp-ux 10.20 graphics administration guide - Page 151

Running From INIT, Granting Access

Get HP Visualize J5000 - Workstation PDF manuals and user guides View all HP Visualize J5000 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 151 highlights

Running From INIT Though X will usually be run by dtlogin from init, it is possible to run X directly from init. For information about running X from dtlogin, see the dtlogin man page. To run X directly from init, it is necessary to modify /etc/inittab and /etc/gettydefs. Detailed information on these files may be obtained from the inittab(4) and gettydefs(4) man pages. To run X from init on display 0, with a login xterm running on /dev/ttypf, in init state 3, the following line must be added to /etc/inittab: X0:3:respawn:env PATH=/bin:/usr/bin/X11:/usr/bin xinit -L ttyqf -- :0 To run X with a login hpterm, the following should be used instead: X0:3:respawn:env PATH=/bin:/usr/bin/X11:/usr/bin xinit hpterm =+1+1 -n login -L ttyqf -- :0 In addition, the following line must be added to /etc/gettydefs (this should be a single line): Xwindow# B9600 HUPCL PARENB CS7 # B9600 SANE PARENB CS7 ISTRIP IXANY TAB3 00#X login: #Xwindow There should not be a getty running against the display whenever X is run from xinit. Granting Access The sample server implements a simplistic authorization protocol, MIT-MAGIC-COOKIE-1 which uses data private to authorized clients and the server. This is a rather trivial scheme; if the client passes authorization data which is the same as the server has, it is allowed access. This scheme is inferior to host-based access control mechanisms in environments with unsecure networks as it allows any host to connect, given that it has discovered the private key. But in many environments, this level of security is better than the host-based scheme as it allows access control per-user instead of per-host. In addition, the server provides support for a DES-based authorization scheme, XDMAUTHORIZATION-1, which is more secure (given a secure key distribution mechanism), but as DES is not generally distributable, the implementation is missing routines to encrypt and decrypt the authorization data. This authorization scheme can be used in conjunction with XDMCP's authentication scheme, XDM-AUTHENTICATION-1 or in isolation. The authorization data is passed to the server in a private file named with the -auth command line option. Each time the server is about to accept the first connection after a reset (or when the server is starting), it reads this file. If this file contains any authorization records, the local host is not automatically allowed access to the server, and only clients which send one of the authorization records contained in the file in the connection setup information will be allowed access. See the Xau manual Page 151 Graphics Administration Guide for HP-UX 10.20

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
Running From INIT
Though X will usually be run by dtlogin from init, it is possible to run X directly from init. For
information about running X from
dtlogin
, see the
dtlogin
man page.
To run X directly from
init
, it is necessary to modify
/etc/inittab
and
/etc/gettydefs
. Detailed information
on these files may be obtained from the
inittab(4)
and
gettydefs(4)
man pages.
To run X from init on display 0, with a login
xterm
running on
/dev/ttypf
, in init state 3, the following
line must be added to
/etc/inittab
:
X0:3:respawn:env PATH=/bin:/usr/bin/X11:/usr/bin
xinit -L ttyqf -- :0
To run X with a login hpterm, the following should be used instead:
X0:3:respawn:env PATH=/bin:/usr/bin/X11:/usr/bin
xinit hpterm =+1+1
-n login -L ttyqf -- :0
In addition, the following line must be added to
/etc/gettydefs
(this should be a single line):
Xwindow# B9600 HUPCL PARENB CS7 # B9600 SANE PARENB CS7 ISTRIP IXANY
TAB3
00#X login: #Xwindow
There should not be a getty running against the display whenever X is run from
xinit
.
Granting Access
The sample server implements a simplistic authorization protocol,
MIT-MAGIC-COOKIE-1
which uses
data private to authorized clients and the server. This is a rather trivial scheme; if the client passes
authorization data which is the same as the server has, it is allowed access. This scheme is inferior to
host-based access control mechanisms in environments with unsecure networks as it allows any host to
connect, given that it has discovered the private key. But in many environments, this level of security is
better than the host-based scheme as it allows access control per-user instead of per-host.
In addition, the server provides support for a DES-based authorization scheme,
XDM-
AUTHORIZATION-1
, which is more secure (given a secure key distribution mechanism), but as
DES
is
not generally distributable, the implementation is missing routines to encrypt and decrypt the
authorization data. This authorization scheme can be used in conjunction with
XDMCP's
authentication
scheme,
XDM-AUTHENTICATION-1
or in isolation.
The authorization data is passed to the server in a private file named with the
-auth
command line
option. Each time the server is about to accept the first connection after a reset (or when the server is
starting), it reads this file. If this file contains any authorization records, the local host is not
automatically allowed access to the server, and only clients which send one of the authorization records
contained in the file in the connection setup information will be allowed access. See the Xau manual
Graphics Administration Guide for HP-UX 10.20
Page 151