.xauth followed by random numbers

Question

According to my own experience, su - user used to break SSH X11 authentication. There are plenty of posts on the web explaining how to use xauth list and xauth add to copy the MIT-COOKIE between sessions.

However, for some reason this is no longer necessary.

When I login using ssh -X usera@host, I see the following as usual:

-rw------- 1 usera usera 63 Jul 25 18:17 .Xauthority

When I do su - userb, the system automatically creates and uses the following:

-rw------- 1 userb userb 63 Jul 25 18:18 .xauthpNLBVw

The new .xauth file contains a copy of the MIT-COOKIE of the previous user, thus allowing me to run X11 apps. It's not necessarily a bad idea, but how is this accomplished. I've tried RHEL 5- 7 and it's the same on all those systems, even though nothing has changed that would explain this new behavior.

Any ideas? Thanks!

Answer 1

This is implemented by the pam_xauth.so module which you can find documented in man pam_xauth. If you look in the last line of /etc/pam.d/su you should find a line

session         optional        pam_xauth.so

which runs the module when you do su - userb. In the environment, variable XAUTHORITY will be set to the temporary file with the copied cookie. This file is removed at the end of the session.

Interestingly, if usera only wants to forward their display cookie to a given set of users, they can be listed in ~usera/.xauth/export. Similarly, userb can list the users it will accept cookies from in ~userb/.xauth/import.