mxconns - an X11 connection monitor
mxconns [options]
mxconns is an X11 proxy, i.e., a virtual X11 server (or «display") which can be used as a protective front end for your real X11 server. Each time an X11 application connects to this virtual display, mxconns asks you if the new connection should be accepted. If so, mxconns relays the connection through to your real X11 display.
mxconns can optionally inspect the X requests sent by the X client and prompt the user when it detects dangerous ones (like spying the keyboard). It can also silently replace these dangerous requests by inoffensive ones (NoOp).
mxconns can easily be used to enhance the security of your X server. To do so, secure your display with xhost(1) and/or xauth(1), start mxconns and use only the virtual display that it created when you start remote and/or untrusted X clients.
mxconns does not send anything on its standard output (stdout) except when the -verbose option is used. In this case, it prints the virtual display that it created. All the other messages (errors, debugging) go to stderr.
mxconns can be started automatically by putting in your ~/.xsession file something like:
XDISPLAY=`mxconns -verbose -fork -hunt` export XDISPLAY
You can then use $XDISPLAY to start untrusted X clients and the error (and debugging) messages will go to the Xsession log file...
mxconns displays the list of all the X11 connections being relayed in a scrollable window. You can close an active connection by doubleclicking on it (you'll be asked for a confirmation). Warning: if you close the mxconns window you kill the program but you also close all the active connections!
You can also select a connection by clicking on it and change its flags with the help of a popup menu that is available when pressing the right mouse button. The menu also allows you to get some information about a connection: start time, number of X packets relayed, names of the windows opened by this X client...
Each connection has its own set of flags, telling mxconns what to do. The initial flags are set by the -icf option and/or the configuration file and can be changed by hand later using the user interface.
The recognised flags are:
mxconns supports the following command line options:
-config path -debug string -dispno number specify the display number of the virtual display to be-fork -hunt -icf string -ident -iname string -verbose with the -hunt option
-xsock These options (as well as some standard X options) can also be set using X resources. For instance, you can put in your ~/.Xresources something like:
mxconns can be given the path of a configuration file, using the -config option.
Each line of the configuration file should contain:
host [action] [flag...]
where
action can be `ask' (default), `allow' or `deny'
Empty lines and lines starting with # are ignored.
The configuration file is parsed each time a new connection is detected. The corresponding flags are set for the connection and the corresponding action is taken.
Warning: because the `allow' action will give access to your X server without any confirmation, mxconns will make sure that at least the `safe' flag is on.
X(1), Xsecurity(1), xauth(1), xhost(1).
The original code and ideas came from «der Mouse" (mouse@collatz.mcrcim.mcgill.edu), with his programs xconns and xc.
Vaughan Clarkson (vaughan@ewd.dsto.gov.au) modified xconns to use Xt and Motif (both for the user interface and for the internal loop). The result is mxconns version 1.*.
Lionel Cons (lionel.cons@cern.ch) enhanced mxconns for its use at CERN, this gave mxconns version 2.*.
The version 3.* of mxconns is a complete rewrite from scratch using ideas from the programs above as well as other similar ones like xmon or xroute.
Lionel Cons <lionel.cons@cern.ch>.
This program belongs to CERN (http://www.cern.ch), see the COPYRIGHT file included in the mxconns distribution for more information (http://cern.ch/mxconns/COPYRIGHT).