215 lines
6.9 KiB
HTML
215 lines
6.9 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of XHOST</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>XHOST</H1>
|
|
Section: User Commands (1)<BR>Updated: xhost 1.0.7<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
xhost - server access control program for X
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>xhost</B>
|
|
|
|
[[+-]name ...]
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
The <I>xhost</I> program
|
|
is used to add and delete host names or user names to the list allowed
|
|
to make connections to the X server. In the case of hosts, this provides
|
|
a rudimentary form of privacy control and security. It is only sufficient
|
|
for a workstation (single user) environment, although it does limit the
|
|
worst abuses. Environments which require more sophisticated measures should
|
|
implement the user-based mechanism or use the hooks in the
|
|
protocol for passing other authentication data to the server.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
<I>Xhost</I> accepts the following command line options described below. For
|
|
security, the options that affect access control may only be run from the
|
|
"controlling host". For workstations, this is the same machine as the
|
|
server. For X terminals, it is the login host.
|
|
<DL COMPACT>
|
|
<DT id="1"><B>-help</B>
|
|
|
|
<DD>
|
|
Prints a usage message.
|
|
<DT id="2"><B>[+]</B><I>name</I>
|
|
|
|
<DD>
|
|
The given <I>name</I> (the plus sign is optional)
|
|
is added to the list allowed to connect to the X server.
|
|
The name can be a host name or a complete name (See
|
|
<FONT SIZE="-1"><B>NAMES</B>
|
|
|
|
</FONT>
|
|
for more details).
|
|
<DT id="3"><B>-</B><I>name</I>
|
|
|
|
<DD>
|
|
The given <I>name</I> is removed from the list of allowed
|
|
to connect to the server. The name can be a host name or a complete
|
|
name (See
|
|
<FONT SIZE="-1"><B>NAMES</B>
|
|
|
|
</FONT>
|
|
for more details).
|
|
Existing connections are not broken, but new
|
|
connection attempts will be denied.
|
|
Note that the current machine is allowed to be removed; however, further
|
|
connections (including attempts to add it back) will not be permitted.
|
|
Resetting the server (thereby breaking all connections)
|
|
is the only way to allow local connections again.
|
|
<DT id="4"><B>+</B>
|
|
|
|
<DD>
|
|
Access is granted to everyone, even if they aren't on the list
|
|
(i.e., access control is turned off).
|
|
<DT id="5"><B>-</B>
|
|
|
|
<DD>
|
|
Access is restricted to only those on the list
|
|
(i.e., access control is turned on).
|
|
<DT id="6"><I>nothing</I>
|
|
|
|
<DD>
|
|
If no command line arguments are given,
|
|
a message indicating whether or not access control is currently enabled
|
|
is printed, followed by the list of those allowed to connect.
|
|
This is the only option that may be used from machines other than
|
|
the controlling host.
|
|
</DL>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>NAMES</H2>
|
|
|
|
A complete name has the syntax
|
|
``family:name'' where the families are
|
|
as follows:
|
|
<P>
|
|
|
|
<PRE>
|
|
|
|
inet Internet host (IPv4)
|
|
inet6 Internet host (IPv6)
|
|
dnet DECnet host
|
|
nis Secure RPC network name
|
|
krb Kerberos V5 principal
|
|
local contains only one name, the empty string
|
|
si Server Interpreted
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
The family is case insensitive.
|
|
The format of the name varies with the family.
|
|
<P>
|
|
|
|
When Secure RPC is being used, the
|
|
network independent netname (e.g., "nis:unix.<I>uid</I>@<I>domainname</I>") can
|
|
be specified, or a local user can be specified with just the username
|
|
and a trailing at-sign (e.g., "nis:pat@").
|
|
<P>
|
|
|
|
For backward compatibility with pre-R6 <I>xhost</I>,
|
|
names that contain an at-sign (@) are assumed to be in the nis family.
|
|
Otherwise they are assumed to be Internet addresses. If compiled to support
|
|
IPv6, then all IPv4 and IPv6 addresses returned by <A HREF="/cgi-bin/man/man2html?3+getaddrinfo">getaddrinfo</A>(3) are added to
|
|
the access list in the appropriate inet or inet6 family.
|
|
<P>
|
|
|
|
The local family specifies all the local connections at once. However,
|
|
the server interpreted address "si:localuser:<I>username</I>" can be
|
|
used to specify a single local user. (See the
|
|
<I><A HREF="/cgi-bin/man/man2html?7+Xsecurity">Xsecurity</A></I>(7) manual page for more details.)
|
|
<P>
|
|
|
|
Server interpreted addresses consist of a case-sensitive type tag and a
|
|
string representing a given value, separated by a colon. For example,
|
|
"si:hostname:almas" is a server interpreted address of type <I>hostname</I>,
|
|
with a value of <I>almas</I>. For more information on the available forms
|
|
of server interpreted addresses, see the <I><A HREF="/cgi-bin/man/man2html?7+Xsecurity">Xsecurity</A></I>(7)
|
|
manual page.
|
|
<P>
|
|
|
|
The initial access control list for display number <B>n</B>
|
|
may be set by the file <I>/etc/X</I><B>n</B><I>.hosts</I>, where
|
|
<B>n</B> is the display number of the server. See <I><A HREF="/cgi-bin/man/man2html?1+Xserver">Xserver</A></I>(1)
|
|
for details.
|
|
<A NAME="lbAG"> </A>
|
|
<H2>DIAGNOSTICS</H2>
|
|
|
|
For each name added to the access control list,
|
|
a line of the form "<I>name</I> being added to access control list"
|
|
is printed.
|
|
For each name removed from the access control list,
|
|
a line of the form "<I>name</I> being removed from access control list"
|
|
is printed.
|
|
<A NAME="lbAH"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<A HREF="/cgi-bin/man/man2html?7+X">X</A>(7), <A HREF="/cgi-bin/man/man2html?7+Xsecurity">Xsecurity</A>(7), <A HREF="/cgi-bin/man/man2html?1+Xserver">Xserver</A>(1), <A HREF="/cgi-bin/man/man2html?1+xdm">xdm</A>(1), <A HREF="/cgi-bin/man/man2html?1+xauth">xauth</A>(1), <A HREF="/cgi-bin/man/man2html?3+getaddrinfo">getaddrinfo</A>(3)
|
|
<A NAME="lbAI"> </A>
|
|
<H2>ENVIRONMENT</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="7"><B>DISPLAY</B>
|
|
|
|
<DD>
|
|
to get the default host and display to use.
|
|
</DL>
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
<P>
|
|
|
|
You can't specify a display on the command line because
|
|
<B>-display</B>
|
|
|
|
is a valid command line argument (indicating that you want
|
|
to remove the machine named
|
|
<I>``display''</I>
|
|
|
|
from the access list).
|
|
<P>
|
|
|
|
The X server stores network addresses, not host names, unless you use
|
|
the server-interpreted hostname type address. If somehow you change a
|
|
host's network address while the server is still running, and you are
|
|
using a network-address based form of authentication, <I>xhost</I> must
|
|
be used to add the new address and/or remove the old address.
|
|
<A NAME="lbAK"> </A>
|
|
<H2>AUTHORS</H2>
|
|
|
|
Bob Scheifler, MIT Laboratory for Computer Science,
|
|
<BR>
|
|
|
|
Jim Gettys, MIT Project Athena (DEC).
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="8"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="9"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="10"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="11"><A HREF="#lbAE">OPTIONS</A><DD>
|
|
<DT id="12"><A HREF="#lbAF">NAMES</A><DD>
|
|
<DT id="13"><A HREF="#lbAG">DIAGNOSTICS</A><DD>
|
|
<DT id="14"><A HREF="#lbAH">SEE ALSO</A><DD>
|
|
<DT id="15"><A HREF="#lbAI">ENVIRONMENT</A><DD>
|
|
<DT id="16"><A HREF="#lbAJ">BUGS</A><DD>
|
|
<DT id="17"><A HREF="#lbAK">AUTHORS</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:30 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|