IRIS

Please check that your X Window system is secure.

X Windows is a networking and display protocol environment using a GUI
(graphical user interface). Common X Window servers include XFree86
and Xorg in UNIX style systems and Exceed, WinAXE, Cygwin’s Xwin on
Microsoft Windows systems.

In January 2007, it was discovered that there were keystroke logs on a
system at another University containing data from nine systems in
EECS. Eight of the systems were running various versions of the
Microsoft Windows operating system and one was running linux. We must
assume these keystroke logs contained all passwords used on these
hosts as well as all passwords used to connect to other hosts. It is
suspected that all 9 of the systems had insecure X Window Systems.

IRIS advises usng a layered approach to securing your X Window
System. Access to the X server should be controlled. Typically UNIX
style systems by default do control access to the X server, but a user
can overide the default. Typically Exceed on Windows by default allows
any remote host access to the X server; this is a bad thing.

In addition to controlling access to the X server by utilizing proper
configuration of the X Window system and using the related tools
properly, another layer of security can be added. A properly
configured host based firewall blocking unauthorized remote
access to the X server, typically 6000/tcp, is also recommended.

John Kim from the campus SNS (System and Network Security) group has
written a good knowledge base article concerning securing X Window
systems. The article contains details about configuring Exceed, the
Microsoft Windows firewall and the Symantec Client Security firewall at

http://kb.berkeley.edu/kb1185

It is also recommended that X traffic be encrypted for
example through an encrypted ssh tunnel.

If you need further help with securing your X Windows system please
contact your computer support person(s) or the EECS Helpdesk
(help@eecs, 395 Cory 9am-5pm, 313 Soda 10am-5pm, 642-7777).

The imap server became unresponsive and had to be rebooted.

IDSG is sorry for any inconvenience this may have caused.

Everything should be back to normal now.

The EECS department Helpdesk and IRIS do not yet support the recently released Mac OS X 10.5 (Leopard). We will probably be unable to do so until January 2008 at the earliest, and possibly longer.

Further, we strongly discourage all departmental users and sysadmins from upgrading any machines to Leopard for anything other than testing purposes. There are a couple of fairly serious flaws with how Leopard interacts with our environment. Most notably, Leopard doesn’t work with
coeus or project, our file servers. Our support engineer at Apple has been notified, and we’ll be working with him to solve the problem.

Also of note, there are a number of serious bugs in Leopard’s X11 server. It’s my understanding that Apple’s X11 developers are working very hard on fixing them. Until an update is released, anyone who uses X11 on Mac OS should hold off on an upgrade.

We realize holding off on an upgrade can be frustrating—several of us in IRIS use MacOS as our primary desktop. Once we have solutions to the highest priority problems with Leopard, help@eecs will be able to answer your questions.

For those of you who may have already upgraded and find yourselves in dire straits, the following may help. The below information is highly technical in nature, and this is all the help we can offer right now:

The file servers—if you’re comfortable using the command line, the smbclient utility does appear to still work with the NetApps, assuming you have a kerberos ticket. Of course, if you’re comfortable with the command line, it’s probably easier to just ssh/sftp to argus or your favorite shell account machine. Syntax for smbclient is…

smbclient //coeus.eecs.berkeley.edu/USERID -k

where USERID is your login, like ‘fraser’ or ‘adj’, and the ‘-k’ is to do kerberos authentication. Remember, smbclient does not mount the remote volume, it just gives you an ftp-like interface for transfering files to/from it.

X11—Among other problems, it does not work with Spaces. They’ve upgraded the codebase to X.org’s X11R7.2, but it looks like little-to-no QA was done. The following mailing list archive (look at the posts over the past couple of days) contains some information from one of Apple’s X11 developers, including totally unofficial patches:

[http://lists.apple.com/archives/X11-users/](http://lists.apple.com/archives/X11-users/)
[Read more…] about Mac OS X 10.5 (Leopard) not supported in EECS