A colleague makes a stubborn remote display problem go away by running `xhost +` on their workstation, with nothing after the plus sign. Your security review flags it. What has that command actually done?
LPIC-1 Exam 102-500, objective 106. User interfaces and desktops medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct Turned access control off entirely, so a client on any host may connect to that X server until the session ends.
Correct. A bare plus sign means every host, not one host. With access control disabled, any machine that can reach TCP port 6000 may open windows on the display, read the screen and log every key press.
Not correct Turned access control on, so that only hosts already named in the access list may connect.
Wrong — that is `xhost -`, the bare minus sign. The plus and minus signs enable and disable access control when used alone, and add or remove one name when used with an argument.
Not correct Added the local machine to the access list, so that only local clients may connect.
Wrong. Local clients connect over a Unix domain socket and are already permitted. Adding the local host explicitly would be `xhost +localhost`, and it would not restrict anyone else.
Not correct Generated a fresh MIT-MAGIC-COOKIE-1 entry in ~/.Xauthority for each host in the list.
Wrong. Cookies are the other, per-user access control mechanism and they are managed with xauth, not xhost. xhost never touches the authority file.
Why
X has two access control mechanisms. Host-based control, managed with xhost, trusts a whole machine and cannot distinguish users on it; `xhost +` disables it altogether and is the single most common way an X display is left wide open. Cookie-based control, managed with xauth against ~/.Xauthority, is per user and per display, and it is what ssh X11 forwarding sets up for you. Prefer forwarding over xhost, and if you must use xhost, name the host.
Where this comes from
- Cited
- manual page xhost(1)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 106 and space the ones you get wrong.
More questions on this objective
- In the X Window System architecture, which statement correctly describes the roles of the X server and an X client? machine-checked
- From your desktop workstation you run `ssh -X admin@fileserver` and then start `xterm` in that session. The xterm window appears on your workstation's screen. Which machine is running the X server in this arrangement, and which is running the X client? machine-checked
- In a bash shell, type the complete command that sets and exports the environment variable X clients read to find their display, so that they connect to screen 0 of display 0 on the local machine. machine-checked
- Type the command, with no arguments and no options, that prints whether host-based access control is currently enabled on your X server together with the list of hosts and users allowed to connect. machine-checked
- An X11-forwarded ssh session authorises the remote client to talk to your local X server without you ever running an xhost command. Which mechanism provides that authorisation? machine-checked
- A display manager is the program that presents the graphical login screen and starts the user's session after authentication. Which three of the following are display managers? (Choose three.) machine-checked