Re: XDM Insecurity revisited

[jbuhler () SPEAKEASY ORG (Jeremy Buhler)]

> On the Red Hat side, for a standard Red Hat 6 using gdm 
> not xdm, edit /etc/X11/gdm.conf and set it to
> [xdcmp]
> Enable=0

Regular xdm has an equivalent switch, though it's not
documented anywhere but in the source code.  Add the
following resource to your xdm-config file (usually found
in the X11R6 tree in lib/X11/xdm):

! SECURITY: do not listen for XDMCP or Chooser requests
DisplayManager.requestPort:     0

Or, start xdm with the flag '-udpPort 0' .