Day 4 - Running X and Remote Displays

📌 Key Takeaways

• If you booted into text mode, launch X with startx. To boot into graphics, set graphical.target as the default.
• The DISPLAY environment variable decides "which screen to draw on". The format is host:display.screen.
• The local screen is usually :0.0.
• Access permission is handled by xhost (per host) and xauth (per user).
• The safe way for a remote GUI is ssh -X. xhost + is dangerous because it opens access to anyone.

Two Ways to Start X

startx                 # start an X session

systemctl get-default                      # current default mode
systemctl set-default graphical.target     # boot into graphics
systemctl set-default multi-user.target    # boot into text

• The pairing runlevel 3 is text and 5 is graphical is still asked as is today.
• Servers are often run in text mode to save resources.

What startx Actually Does

   startx  ──►  xinit  ──►  runs the X server  +  runs ~/.xinitrc
                                                   (if absent, /etc/X11/xinit/xinitrc)

   # example of ~/.xinitrc
   xterm &          launches a terminal in the background and
   exec twm         finally runs the window manager

• startx is a script that calls xinit conveniently. What actually launches the X server and the first client is xinit.
• In ~/.xinitrc you write the programs to run after X comes up. If the user file is absent, the system file (/etc/X11/xinit/xinitrc) is used.
• When the last program ends, X ends too. So put the window manager or desktop environment on the last line, and send the earlier ones to the background with &.
• When you log in through a display manager, it is the display manager, not .xinitrc, that starts the session. .xinitrc is startx's partner.

Changing It Right Now vs. Changing It from the Next Boot

• set-default only changes the default for the next boot, and the current screen stays as it is. To switch now, use isolate.
• Of the seven runlevels in the Red Hat family, memorize the axis 0 shutdown · 1 single-user · 3 text · 5 graphical · 6 reboot. Only 3 and 5 relate to X.
• Even on the graphical screen, you can switch to a text console with a combination like Ctrl+Alt+F3 (which number is the text console differs by distribution). When X has frozen, log in there and clean up.

DISPLAY — Which Screen to Draw On

   DISPLAY = hostname : display-number . screen-number
 
      192.168.0.10 : 0 . 0
           │         │   │
           │         │   └── screen number (when there are multiple monitors)
           │         └────── display number (X server number)
           └──────────────── host where the X server is (omit for local)

echo $DISPLAY                          # :0
export DISPLAY=192.168.0.10:0.0        # I will display on that computer's screen
xclock &                               # the clock appears on the other screen

• Omitting the host means local. That is why you normally see just :0.
• To display on a remote screen, you must set DISPLAY on the client side and grant access on the server side. Both are needed.

The Three Slots One by One

• The colon (:) cannot be dropped, but what comes after the dot (.) may be. So :0 is a valid value, and 0.0 or 0:0 are invalid.
• The display number ties to the port number. The X server accepts network connections on TCP 6000 + display number. :0 is port 6000 and :1 is port 6001.
• Instead of the environment variable, you can also specify it just once with the -display option — xclock -display 192.168.0.10:0.0.

What Do You Type on Which Computer

What is easy to confuse in remote display is where you type the commands. Assume my PC with the screen is 192.168.0.10 and the remote server running the program is 192.168.0.20.

• In xhost, write the address of "the party to let in", and in DISPLAY, write the address of "where the screen is". The two addresses point to opposite sides.
• DISPLAY is set on the side running the program. It is not set on the side with the screen.

• For security, the X server on modern distributions is by default started so that it does not accept network (TCP) connections at all. Connecting directly with DISPLAY and xhost is something to know as a principle, and in practice use the ssh -X below.

Access Control — xhost and xauth

The X server does not let just anyone open a window on its screen.

xhost                       # current allow list
xhost +192.168.0.20         # allow only that address
xhost -192.168.0.20         # block that address
xhost +                     # allow everyone  ← dangerous!
xhost -                     # block everyone
xauth list                  # list of magic cookies

⚠️ xhost + opens your screen to every computer. Others can peek at your screen or put up fake windows. Do not use it except for testing. It appears on the exam as a "security-risky command" too.

• The authentication method xauth uses is MIT-MAGIC-COOKIE-1. A connection works only if the cookie stored in the ~/.Xauthority file matches.

Reading xhost Output

$ xhost
access control enabled, only authorized clients can connect
$ xhost +192.168.0.20
192.168.0.20 being added to access control list
$ xhost
access control enabled, only authorized clients can connect
INET:192.168.0.20
$ xhost +
access control disabled, clients can connect from any host

• + is "open" and - is "close". It is confusing because the result of xhost + is access control disabled, but it means "turn off access control = everything is open".
• What xhost opens is that whole computer. If you allow 192.168.0.20, every user logged in to that server can access my screen. That is the real content of the phrase "weak security because it is per host".
• xhost settings last only while the X server is on. They disappear when you log out.

xauth — Only Those with the Cookie

$ xauth list
mypc/unix:0  MIT-MAGIC-COOKIE-1  5e3c1a9f0b7d4c2e8a6f1d3b9c0e7a42

• The X server decides a cookie when it starts and accepts only clients that present the same value. The cookie is in ~/.Xauthority, and this file is readable only by its owner, so other users cannot know the value. That is why it becomes per-user control.
• To use it from another computer, you must move the cookie into the ~/.Xauthority there. Take it out with xauth extract and put it in with xauth merge, or write it directly with xauth add.
• To change the file to use, specify it with the XAUTHORITY environment variable.

Remote GUI — ssh -X

ssh -X user@server-address # X11 forwarding
gedit                      # it is the server's program but appears on my screen

• SSH carries the X traffic for you through an encrypted tunnel. DISPLAY is also set automatically.
• There is no need to open xhost, so it is much safer. It is the standard method for a remote GUI.
• -Y is trusted mode and has looser restrictions.

What Happens Inside ssh -X

$ ssh -X alice@192.168.0.20
$ echo $DISPLAY
localhost:10.0
$ xclock &

   My PC (X server, :0)                         Remote server 192.168.0.20
        ▲                                            xclock
        │                                               │  DISPLAY=localhost:10.0
        │                                               ▼
     ssh client ◄═══ encrypted SSH connection ═══►  fake display :10 made by sshd

• The remote server's DISPLAY is set not to my PC's address but to localhost:10.0. This is because sshd creates a fake display number 10 inside the remote server itself, and passes the X traffic that comes into it to my PC's real X server over the SSH connection.
• Since the X traffic rides on one SSH connection that is already open, there is no need to open my PC's X server to the network or to use xhost. SSH also arranges the cookie on its own.
• You must not set DISPLAY again by hand. If you enter with ssh -X and then run export DISPLAY=192.168.0.10:0.0, you abandon the encrypted path and try a direct connection.

Comparing the Three Remote Display Methods

• xauth only screens "who connects" and does not hide the traffic. Only ssh -X provides encryption as well.

Config Files and Commands

xorg.conf

   /etc/X11/xorg.conf     X server config file
 
   Section "Files"         font and module paths
   Section "Module"        modules to load
   Section "InputDevice"   keyboard · mouse
   Section "Monitor"       monitor frequencies
   Section "Device"        graphics card
   Section "Screen"        Monitor + Device combination, resolution
   Section "ServerLayout"  overall layout

• Nowadays auto-detection works well, so this file often does not exist at all. You create it only when needed.
• You can generate a draft with Xorg -configure.

   Section "Screen"
       Identifier   "Screen0"
       Device       "Card0"           ← points to the name of a Section "Device"
       Monitor      "Monitor0"        ← points to the name of a Section "Monitor"
       DefaultDepth 24
       SubSection "Display"
           Depth    24
           Modes    "1920x1080"
       EndSubSection
   EndSection

• Every section is opened with Section "name" and closed with EndSection. Each section is named with Identifier, and other sections point to that name to link up.

• Device is not "devices in general" but the graphics card. Keyboard and mouse are separate under InputDevice. Choosing by the name alone gets it wrong.
• Screen pairs one Device with one Monitor. That is why the resolution is written in Screen, not in the graphics card section.

• When the graphical screen does not come up, look for lines starting with (EE) in Xorg.0.log. That marks an error (Error). (WW) is a warning.

Frequently Used X Commands

• After running xkill, the cursor turns into an X and it kills the window you click. Use it to clean up a frozen program.

• Tell xdpyinfo and xwininfo apart by the middle letters of the name — dpy is display (the whole screen), and win is window (one window).
• xdpyinfo is for viewing, xrandr is for changing. The word resolution appears on both sides, so look at whether it is "checking" or "changing".
• xkill is the X server cutting off the connection to the client that owns the window. Unlike kill from Week 6, which sends a signal by PID, you do not need to know the PID; just point at the window.

Tomorrow we tie this week's X Window System together on a single sheet.

📖 Glossary

• startx: The command that starts an X session in text mode.
• DISPLAY: The environment variable that specifies the screen to output to. The format is host:display.screen.
• xhost: The command that allows or blocks access to the X server per host (IP).
• xauth: The command that controls access per user using magic cookies.
• MIT-MAGIC-COOKIE-1: The authentication method xauth uses. The cookie is stored in ~/.Xauthority.
• X11 forwarding: The feature that safely carries X traffic through an SSH tunnel. Used with ssh -X.
• xorg.conf: The X server's config file. Located in /etc/X11/.
• xkill: The command that force-kills the program of the window you click.