xhost(1) - NetBSD Manual Pages

Command:
Section:
Arch:
Collection:
>>>



XHOST(1)						 XHOST(1)



NAME

       xhost - server access control program for X


SYNOPSIS

       xhost [[+-]name ...]


DESCRIPTION

       The  xhost program is used to add and delete host names or
       user names to the list allowed to make connections to  the
       X  server.  In the case of hosts, this provides a rudimen
       tary form of privacy control and	 security.   It	 is  only
       sufficient  for	a  workstation (single user) environment,
       although it does limit  the  worst  abuses.   Environments
       which require more sophisticated measures should implement
       the user-based mechanism or use the hooks in the	 protocol
       for passing other authentication data to the server.

       For  better  security use authority cookies (see xauth(1))
       instead. Combine it with a secure X11 forwarder	like  SSH
       (see ssh(1)) for connections over an insecure network.


OPTIONS

       Xhost accepts the following command line options described
       below.  For security, the options that effect access  con
       trol  may  only	be  run from the "controlling host".  For
       workstations, this is the same machine as the server.  For
       X terminals, it is the login host.

       -help   Prints a usage message.

       [+]name The  given  name	 (the  plus  sign is optional) is
	       added to the list allowed  to  connect  to  the	X
	       server.	 The  name  can	 be a host name or a user
	       name.

       -name   The given name is removed from the list of allowed
	       to  connect to the server.  The name can be a host
	       name or a user name.  Existing connections are not
	       broken,	 but  new  connection  attempts	 will  be
	       denied.	Note that the current machine is  allowed
	       to   be	 removed;  however,  further  connections
	       (including attempts to add it back)  will  not  be
	       permitted.  Resetting the server (thereby breaking
	       all connections) is the only way	 to  allow  local
	       connections again.

       +       Access is granted to everyone, even if they aren't
	       on the list (i.e., access control is turned  off).

       -       Access  is  restricted  to  only those on the list
	       (i.e., access control is turned on).

       nothing If no command line arguments are given, a  message
	       indicating   whether  or	 not  access  control  is



X Version 11		   Release 6.6				1





XHOST(1)						 XHOST(1)


	       currently enabled is printed, followed by the list
	       of  those  allowed  to  connect.	 This is the only
	       option that may be used from machines  other  than
	       the controlling host.


NAMES

       A  complete  name has the syntax ``family:name'' where the
       families are as follows:

       inet	 Internet host
       dnet	 DECnet host
       nis	 Secure RPC network name
       krb	 Kerberos V5 principal
       local	 contains only one name, the empty string

       The family is case insensitive.	The format  of	the  name
       varies with the family.

       When  Secure  RPC  is  being used, the network independent
       netname (e.g., "nis:unix.uid@domainname")  can  be  speci
       fied, or a local user can be specified with just the user
       name and a trailing at-sign (e.g., "nis:pat@").

       For backward compatibility with pre-R6 xhost,  names  that
       contain	an  at-sign (@) are assumed to be in the nis fam
       ily.  Otherwise the inet family is assumed.


DIAGNOSTICS

       For each name added to the access control list, a line  of
       the  form  "name	 being	added  to access control list" is
       printed.	 For each name removed from  the  access  control
       list,  a	 line of the form "name being removed from access
       control list" is printed.


FILES

       /etc/X*.hosts


SEE ALSO

       X(7), Xsecurity(7), Xserver(1), xauth(1), xdm(1), ssh(1)


ENVIRONMENT

       DISPLAY to get the default host and display to use.


BUGS

       You can't specify a display on the  command  line  because
       -display is a valid command line argument (indicating that
       you want to remove the machine named ``display'' from  the
       access list).

       The  X  server  stores  network addresses, not host names.
       This is not really a bug.  If somehow you change a  host's
       network	address	 while the server is still running, xhost
       must be used to add the new address and/or remove the  old
       address.



X Version 11		   Release 6.6				2





XHOST(1)						 XHOST(1)



AUTHORS

       Bob Scheifler, MIT Laboratory for Computer Science,
       Jim Gettys, MIT Project Athena (DEC).






















































X Version 11		   Release 6.6				3