X11Forwarding defaults to off

[Jeff Waugh]

I'd love to be able to tell people to ssh -X without any setup requirements
(which requires X11Forwarding on in sshd_config). Are there any security
concerns with this?

[Matt Zimmerman (mdz)]

I've wondered about this myself. There are good reasons for it to be disabled
on the client side by default, but I don't see why it should be disallowed by
the server if the client requests it

[Colin Watson (cjwatson)]

"When X11 forwarding is enabled, there may be additional exposure to the server
and to client displays if the sshd proxy display is configured to listen on the
wildcard address (see X11UseLocalhost below), however this is not the default."
(sshd_config(5))

I think I'm happy to enable X11 forwarding by default on the server side.

The change to openssh-server.postinst is simple, although it'll only affect new
installations because we aren't using ucf yet. OK to upload?

[Jeff Waugh (jdub)]

i'm happy with it, upload approved

[Colin Watson (cjwatson)]

openssh (1:3.8.1p1-10ubuntu2) warty; urgency=low

  * Set X11Forwarding to yes in the default sshd_config (new installs only).
    At least when X11UseLocalhost is turned on, which is the default, I
    believe that the security risks of using X11 forwarding are risks to the
    client, not to the server (closes: Warty #1429).

 -- Colin Watson <email address hidden> Mon, 20 Sep 2004 14:02:59 +0100