Many Ways to Start an Xserver | Hacker News Reader

Many Ways to Start an Xserver

nixers.net

76 pointsgbrown_15 comments

This has been a pain point for me in the past, but I guess it's just part of how the ecosystem works.

I would personally rewrite the article as "Too many ways to start an Xserver"

Author here! I'm fantastically pleased to see our small nixers community get this much attention. If you're interested in similar discussions, be sure to join us on the forums and IRC (freenode #nixers_net).

X11 has always seemed weird to me, from an architectural and interface perspective, compared to the Unix platform it's built on.

I suppose it's the impedance mismatch between the "Worse is Better" Unix crowd and the "purity of interface" MIT crowd (http://dreamsongs.com/WorseIsBetter.html)

This article was useful in showing the interface between the Unix side and the X11 side.

Too bad that one can’t figure out a way to login into 4 separate X-Windows/PCs using a single/sign-on.

I’ve stared at SASL, SAML, and PAM but the precipice is too steep.

Closest thing I could think of is to remote SSH into the other three and fire up its X session.

Unfortunately your best bet is going to be LDAP and PAM.

https://arthurdejong.org/nss-pam-ldapd/setup

Done that. I should have asked “can it do auto-login” into multiple X-window/PC sessions after the first login.

With the right xinit / display manager config I don't see why not.

SSSD+LDAP is what we use in 2020. If you have an existing Active Directory backend you can use that. You can also do the reverse, which is an OpenLDAP or FreeIPA backend on Linux and use pGina to authenticate Windows boxes if needed.

We do this at work, and have everything from Windows desktops, Linux desktops and servers, and almost all our 3rd party applications using the same accounts and passwords.

Plus one for pGina, a really nice piece of software, login auth on your LDAP, then script mounts of drive if any and you avoid having a full Active Directory.

I was listening at a conference call about security in my area of work and someone said that 100% of the pen-tests done in the past year on various entities got full control of the Active Directory.

At the conference call I mentionned that we do without AD and with pGina, the senior security officer said it was not a bad idea when possible :).

Yeah a full AD doesn't make sense for us, as we only have a handful of Windows VM's and the rest is Linux. But if you're running an environment with 100's or 1000's of Windows desktops/servers you're probably stuck with AD if you want to be able to manage that lot.

Does that include AUTO-login on all systems? (That’s what I’ve been trying to do but cannot edit my original comment to reflect that).

You can store SSH keys in LDAP if you wish, which would enable fairly automated SSH logins if you're running ssh-agent on the client side.

If it's for a home system where you want to be able to log in to everything without an SSH key or password, that sounds like kind of a bad idea.

The closed-source variant would be

https://www.evidian.com/products/authentication-manager/logi...

I clicked this link expecting to find obscure ways to start an Apple Xserve.

One of the many reason I stick with Wayland.

Reply on news.ycombinator.com