I'm using Ubuntu 13.04 on a Lenovo X220.

Why do I have so many .Xauthority.* files in my home directory? I.e

.Xauthority .Xauthority.0JW6UW .Xauthority.2HWRVW .Xauthority.2TA6VW .Xauthority.49F8VW .Xauthority.4E27UW .Xauthority.7CLTVW .Xauthority.8JGGXW .Xauthority.96SAVW .Xauthority.AOUFVW .Xauthority.ASDOVW .Xauthority.CGVJXW .Xauthority.E0ZSVW .Xauthority.E5VZWW .Xauthority.FE64UW .Xauthority.FIHDWW .Xauthority.HL45VW .Xauthority.HYCCVW .Xauthority.ILUEWW .Xauthority.JXJHVW .Xauthority.K1QJXW .Xauthority.KXSOVW .Xauthority.LEKEVW .Xauthority.M48WVW .Xauthority.M6QTVW .Xauthority.MW6NWW .Xauthority.N57TWW .Xauthority.O5HAWW .Xauthority.OIC5VW .Xauthority.P2RPVW .Xauthority.Q0FRVW .Xauthority.QW01WW .Xauthority.RDW5WW .Xauthority.T0TLWW .Xauthority.TSO4WW .Xauthority.U6R9VW .Xauthority.V3KAWW .Xauthority.W8Z1WW .Xauthority.XDLGVW .Xauthority.XOOHWW.Xauthority.XUICVW

They are all zero bytes except the first, with timestamps all over the place.

What are these, and are they safe to delete?

  • As per community policy (meta.askubuntu.com/questions/4216/…) - this is a confirmed bug and as such is off-topic. The bounty has been returned.
    – fossfreedom
    Jun 1, 2013 at 20:57
  • Do you have an SSH server running on this machine?
    – Seth
    Jun 7, 2013 at 18:04
  • 1
    I have this problem, and every once in a while I use rm ~/.Xauthority.*. No problems have occurred so far. As far as I can tell it is probably safe to delete them.
    – daboross
    Jun 7, 2013 at 19:48
  • I should note that I delete them while not logged into an X session. I go to tty 1 (ctrl alt f1) and delete them from there, then restart gdm.
    – daboross
    Jun 7, 2013 at 19:49
  • 1
    As per community policy (meta.askubuntu.com/questions/4216/…) - this is a confirmed bug and as such is off-topic. The bounty has been returned.
    – fossfreedom
    Jun 11, 2013 at 10:09

4 Answers 4


These are the "cookies" of the X client to allow connection to the X server (displays). It's very clearly explained in the wiki:

xauth is a mechanism for enforcing access controls on X servers (displays). When an X server is started, it is given a randomly-generated "cookie". This cookie is written to a file owned and readable by the user whose session the X server is running. No other users can read that file. When an X client (application) is started, it attempts to read and use the cookie to authenticate itself with the server. If this "xauth" authentication fails, the application is not allowed to connect to the server and show windows on the X display.

The command

$ xauth list

will show the cookies available to the current session:

selene/unix:0  MIT-MAGIC-COOKIE-1  c2438e7c2858f142e0b81d6b4fe3867b
localhost.localdomain/unix:0  MIT-MAGIC-COOKIE-1 

Traditionally, the location for each users' cookies has been ~/.Xauthority: the X server writes its cookies to that file as it starts up, and xauth (and other X clients) look in that file for authentication cookies.

Source: https://wiki.ubuntu.com/RemoteXHowTo

And as is shown here, it seems that is a bug of lightdm that doesn't remove the old cookies and pollutes the /home directory.


In fact, I have this problem as you and also with .goutputstream files as is shown in this other bug:


Then yes, you can delete them because if you don't have a cookie to connect to a X server, you are going to create one new.


Seems its a bug that a few people experience with lightdm

So follow this link and when they solve it you will have your answer.


So installing gdm window manager might avoid the issue. As I don't have the problem I cannot test that.


For those -- like me -- wishing to get rid of this "pollution" in the user directory, an interim solution could be placing something like the following (executable) script file (which assumes you are the first user after root) into the /etc/cron.daily directory:

USER="$(users | awk -F ' ' '{print $2}')"
ls /home/"$USER"/.Xauthority.* > /home/"$USER"/.Xauthority-Files.txt
NFILES="$(grep -c Xauthority /home/"$USER"/.Xauthority-Files.txt)"
echo -e "$(date +"%x %R"): "$NFILES" .Xauthority.* files deleted" >> "$LOG"
rm -f /home/"$USER"/.Xauthority.*
rm -f /home/"$USER"/.Xauthority-Files.txt
exit 0

NOTE: This updated script keeps a log file named ".Xauthority-Files.log" so that you can follow up if a recent update has put an end to this bug, and then remove the script when it's no longer needed.


@user196886 suggests an alternative script, saying "I don't want to muck about with the USER variable, I only want the home directories of graphical login users (UID>500), with a home in /home I need privileges to delete other users files, I am happy to see what I am deleting and will confirm manually. My log file is just called Xa.log, $h is a home directory, $b a basename abbreviation to log and delete with."

And the script suggested is:

for h in `awk -F: '$3 >500 && /home/ {print $6}' /etc/passwd`; do b=$h/.Xauthority;[ -f $b.* ] && ls -l $b.* >>Xa.log && sudo rm -i $b.*; done

I recently found numerous .Xauthority.ZY43OW as well as numerous .goutputstream.DF55OZ files in my home directory (the 6 character file extensions were of course all different). I opened one in a the text editor and it contained a Chinese character text string. I tried running it through a translator and it said something about tenant farmers. I have a horrible suspicion these files represent some attempt to take control of my PC. I can't think of any other reason why I should have numerous Chinese character strings hiding on my PC.

  • Welcome to Ask Ubuntu. First of all, this post is a comment and not an answer. Once you have 50 reputation points, you can post comments, but otherwise please refrain from posting in answer section unless the post contains a potential solution to the asked question. Second, please read Meer Borg and Leo's answers - these files are result of a bug. Aug 14, 2018 at 12:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .