Skip to content

Commit

Permalink
Add explanation for using unix sockets.
Browse files Browse the repository at this point in the history
  • Loading branch information
Joerger committed Jan 28, 2022
1 parent 715364c commit 35220e5
Showing 1 changed file with 9 additions and 0 deletions.
9 changes: 9 additions & 0 deletions rfd/0051-x11-forwarding.md
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,15 @@ to the open socket during an X Client request. X Authorization data will be set
the user's default xauthfile (`~/.Xauthority`) by calling
`xauth add <$DISPLAY> <x11-req.proto> <x11-req.cookie>`.

Note: The OpenSSH implementation uses tcp sockets `localhost:6010 - localhost:7009`.
Due to the re-exec model of Teleport SSH sessions, if we opened tcp sockets such as
these, we'd either have to open them in the root process as the process user, or open
them as the Session user and implement a new RPC layer to forward the requests between
the parent and child processes. Instead, we have chosen to use unix sockets, which we
can change the ownership of after the fact with `chown`. This also has the side effect
of ensuring that X11 forwarding sockets for OpenSSH Server and Teleport do not overlap
in cases where both are running on the same machine.

### Security

There are four points of contact which concern security within the X11 forwarding flow
Expand Down

0 comments on commit 35220e5

Please sign in to comment.