🚀 go-pugleaf

In article <CKD.92Nov4141022@loiosh.eff.org> ckd@eff.org (Christopher Davis) writes:
>Scott> == gordon@ug.cs.dal.ca (Scott King) writes:
>Cliff> == Cliff Hathaway <cliff@cs.arizona.edu> 
>
> Scott> I have recently come across a program on the net that will allow
> Scott> a user to continuously monitor a window (including the root
> Scott> window) on another machine.  The disturbing part of it is that
> Scott> you seem to be able to do this to any machine without even
> Scott> having an account on it or having to set up permission to do so
> Scott> with xhost.  Is there a way to protect a machine from people
> Scott> using such programs? If so, how?
>
>Note that just using xhost/xauth won't do it all, if you're on a Sun.
>You also need to set up /etc/fbtab (see fbtab(5)) so that raw access to
>the frame buffer is blocked out.
>
This seems that it would fix the problem on a Sun.  What about an HP.  In my
original post, I neglected to mention that the machine that I was able to 
"watch" without even an account on the machine was an HP.  I am not to
familiar with HP's so I'm not sure what is going on.  Does anyone have any
insights that they could add to make this problem a little clearer?

On the Sun I found that you had to set xhost to be able to watch the screen.
The problem was that someone logged in to the machine from another one
could set the DISPLAY environment variable to the machine they logged into,
setup xhost and watch the display remotely using the window watching program.
Does the suggestion that Mr. Davis presented above prevent users not logged
in to the console from setting up xhost and their DISPLAY variable and then
directing output to the console (or reading it)?

- Scott