1

According to my own experience, su - user used to break SSH X11 authentication. There are plenty of posts on the web explaining how to use xauth list and xauth add to copy the MIT-COOKIE between sessions.

However, for some reason this is no longer necessary.

When I login using ssh -X usera@host, I see the following as usual:

-rw------- 1 usera usera 63 Jul 25 18:17 .Xauthority

When I do su - userb, the system automatically creates and uses the following:

-rw------- 1 userb userb 63 Jul 25 18:18 .xauthpNLBVw

The new .xauth file contains a copy of the MIT-COOKIE of the previous user, thus allowing me to run X11 apps. It's not necessarily a bad idea, but how is this accomplished. I've tried RHEL 5- 7 and it's the same on all those systems, even though nothing has changed that would explain this new behavior.

Any ideas? Thanks!

Improve this question
3

This is implemented by the pam_xauth.so module which you can find documented in man pam_xauth. If you look in the last line of /etc/pam.d/su you should find a line

session         optional        pam_xauth.so

which runs the module when you do su - userb. In the environment, variable XAUTHORITY will be set to the temporary file with the copied cookie. This file is removed at the end of the session.

Interestingly, if usera only wants to forward their display cookie to a given set of users, they can be listed in ~usera/.xauth/export. Similarly, userb can list the users it will accept cookies from in ~userb/.xauth/import.

Improve this answer
  • Thanks a lot! That answers my question. – Dude Jul 25 '19 at 19:27
  • @Dude please tick the checkbox beside the answer to signal that it works for you -- this will help future readers. – bishop Jul 25 '19 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.