12

I remember reading that servers do not have a GUI because X11 is a security risk. Why?

4 Answers 4

8

Ubuntu's community documentation explains the real reasons why it's not recommended to run a GUI on a production server system:

Most Ubuntu Server developers do not recommend installing X on a server. There are multiple reasons for not installing a GUI.

Some reasons to not install a GUI include:

  1. You'll have more code subject to security vulnerabilities, more packages that need updating, and more server downtime.
  2. X11 and desktop packages are not supported for the full 5 year lifecycle of the LTS server release.
  3. Performance may suffer because resources (memory, hard disk space, CPU, etc.) will be consumed by the GUI.
  4. It is best practice to only install needed software on a production server.
  5. The GUI may include other network services that are inappropriate for a server.
    1. One of the goals of Ubuntu Desktop Edition is to make it easier for users to use Linux. When installing some desktop environments, services that you may not specifically want will be installed. For example avahi-daemon, which is used to help configure networking, adds another open port and may introduce unwanted DNS conflicts with a .local domain.

So for the most secure server it is best to not install a GUI.

"ServerGUI" by "Contributors to the Ubuntu documentation wiki", reproduced here as permitted by CC-BY-SA 3.0.

Contrary to somewhat common misconception, X11 being a server really has nothing to do with why running a GUI on a production server is considered to be non-ideal from a security perspective. X11 is virtually never configured by default to be accessible over a network anymore, on any operating system. No version of Ubuntu has ever had X11 run a network-accessible server in the default configuration. (To access X11 on Ubuntu via TCP, you have to forward it though SSH or manually reconfigure the server.)

Furthermore, even if X11 did run a network-accessible server, this would not be a reason not to have it installed on a production server system. Anyone running a production server is presumably capable of configuring it for their needs and auditing it to make sure undesirable services are not running. (If they cannot, that will pose a far greater threat to their security than would be created by having a GUI installed.) Even if X11 had to have a port listening on a physical network interface (which is not the case), the port could easily be blocked by reconfiguring the built-in netfilter using iptables (or a higher-level frontend like ufw).

In contrast, the problems listed above are not so easy to overcome by reconfiguration.

3
  • 1
    10.04 had a different support lifetime for server vs. desktop, 12.04 and later do not. Also, an idle gui does not consume any cpu, and the ram it uses will be swapped out.
    – psusi
    Jan 14, 2014 at 4:00
  • @psusi The point about the support lifecycle change is a good one. As for CPU and RAM issues, (1) I disagree from experience that an idle GUI never consumes CPU, and (2) if a GUI is running, then when someone is working at the local machine, they're likely using it, whether they want to or not, and that will cause it to consume more CPU and memory resources. However, points 1, 4, and 5 really are (and probably always have been) the most significant reasons to consider not having a GUI run on a production server, and they are independent of support lifecycle or resource utilization issues. Jan 15, 2014 at 6:20
  • May I add that Xorg also runs as root by default.
    – Wadih M.
    Apr 7, 2018 at 5:54
5

Every running process is a security risk. Particularly those which listen on a network port (X11 does).

General good practise is not to run anything on a server that doesn't absolutely need to be there, and X11 certainly doesn't need to be on a server that you'll SSH into.

I doubt the article you read was talking about a specific vulnerability in X11 (it would have been fixed if so, vulnerabilities don't tend to hang around unfixed for long), but rather just general good practise.

4
  • 2
    On most modern Linux distributions (like Ubuntu) the X server by default doesn't listen on a network port but only accepts local connections via domain sockets. Feb 6, 2012 at 11:35
  • @FlorianDiesch Even On the unconfigured one from server?
    – Amith KK
    Feb 6, 2012 at 11:55
  • Big +1 for mentioning that X11 is a network server. Feb 6, 2012 at 11:57
  • 2
    Amith: Yes. xinit/startx uses -nolisten tcp by default Feb 6, 2012 at 12:13
5

This is because the X Window System poses a serious security risk if it is not properly secured. An X11 "display" is the X11 server running on your desktop, and includes the screen, keyboard and mouse. If your X11 display is insecure, it will allow a program running anywhere on the Internet to connect to it and the connection may be completely invisible to you. Once connected, that program has full access to your display, which means that it can:

  • View and copy your screen's contents, using standard X11 utility programs;
  • Monitor your keystrokes;
  • Remotely control any browser on your desktop and forge keystrokes as if you were typing them yourself (although not all X11 applications are susceptible to this).

A thumb rule is NOT to use xhost + -- It completely disables your display's security.

A good way is to forward X is through ssh.


Taken from : http://www2.slac.stanford.edu/computing/security/xwindow/

4
  • 1
    This article is some 10 years old. Is the information still valid? Feb 6, 2012 at 11:32
  • 1
    Mostly, yes... because AFAIK we have the xhost + command
    – Amith KK
    Feb 6, 2012 at 11:55
  • xhost + can't override -nolisten tcp though, just open you up to any connection from the localhost.
    – alanc
    Mar 10, 2013 at 20:06
  • would these issues be solved by starting a xserver for each application individually?
    – phil294
    May 13, 2018 at 16:50
-6

The real reason is so admins can think of themselves as super smart by running stuff from the command line. There is no security risk of running a GUI on Ubuntu server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .