I have some X client program which needs access to an X server. It is only able to access the X server by TCP, not by other methods like unix domain sockets. It will run on the same host as the server, to make things easy.

So, how can I make my Xorg server to listen on TCP port 6000, but only for connections from localhost?

I found How to make X.org listen to remote connections on port 6000?, which explains how to enable access for remote hosts, but I don't really want remote access (for security reasons, mainly).

I thought about somehow forwarding the default transport to TCP, but I didn't really find information about what the default transport is.

(I'm using kdm as my display manager here, but I think I can transfer solutions for either display manager, or even switch the display manager.)

Any ideas?

This is on 11.04 on a mixed Kubuntu-Ubuntu-XUbuntu installation (originally Kubuntu, but I added ubuntu-desktop and xubuntu-desktop. On boot it is now saying Xubuntu 11.04). I'm now using the gnome-classic desktop, I think, from KDM.

  • For all wondering what is this X client: It is in fact a Java SSH implementation (JSch) which tries to do X forwarding to another host. Java can't really access unix domain sockets, I think. The same problem would also apply to another (now paused) project of mine, where I wanted to implement an X client in pure Java (e.g. by reading/writing a socket, not using some windowing library). – Paŭlo Ebermann May 8 '11 at 18:57
  • @Paulo, java actually can use unix domain sockets (you can write native library which will provide access to needed syscalls, or just find already written). But then, fwiw, you effectively lose the main benefit of java: high portability. So if you needed really hard, you could pretty easily write X client library in java which would work over PF_LOCAL. Note also that TCP over loopback interface has much higher overhead than the standard unix socket. – ulidtko May 9 '11 at 3:51
  • Yes, I found some libraries, but this won't help me as long as I don't know the actual UDS-address. Is this documented somewhere? – Paŭlo Ebermann May 9 '11 at 11:48
  • 1
    @Paulo, unix domain sockets typically use the filesystem's namespace. Their addresses are filenames. The respective file nodes are "special socket files". On my system I have numerous connections to /tmp/.X11-unix/X0 — this is an example of AF_UNIX address (use netstat -x to see your own). The X11 protocol specification should determine the exact addresses to connect to. And you really MUST read it if you are writing client library for that protocol. – ulidtko May 10 '11 at 0:18
  • 1
    /tmp/.X11-unix/X0 exists as a socket here (OpenSUSE), too, I'll check again at home (on the Ubuntu system named in the question). Now I only have to see how to forward this to a TCP socket at 6000. – Paŭlo Ebermann May 10 '11 at 12:57

Looks like a workaround would be the use of socat. Here is a command line which seems to work, if the X server does not already run on TCP:

socat -d -d TCP-LISTEN:6000,fork,bind=localhost UNIX-CONNECT:/tmp/.X11-unix/X0

Then I can do

xlogo -display localhost:0

Strangely, it does not seem to work if I let it listen on 6001 and then specify the display localhost:1 instead of localhost:0 - I get No protocol specified. Seems I'll have to read the X protocol again. (And over JSch it then quits with Invalid MIT-MAGIC-COOKIE-1 key, but this is another problem.)

  • Yes!! I had been looking for a way to make xserver-allow-tcp=true after X had already been started with -nolisten tcp in /etc/X11/xinit/xserverrc without restarting. Only in my case, bind= to allow my external hosts. – Marcos Apr 13 '15 at 10:16

The Xorg code currently doesn't have any option for controlling which interfaces to listen on. It shouldn't be hard to add, but it should be even easier to simply configure your firewall to block incoming connections to port 6000 from other machines.


Just some other thoughts ...

  1. Allow it but block with xhost (and/or network filtering)

The traditional way to do this is for the X server to listen on the TCP socket and use xhost to determine which hosts are allowed to connect. See man page for xhost(1). (Additionally, of course, IP address and port filtering would help here too, as previous suggestions have noted.)

  1. Only listen on local interface

Per alanc's comment above, there's no code there now , but nearly!

Remember that (almost) all hosts have at least two interfaces, the loopback interface lo0 (always and the normal ethernet eth0 (or wlan0 or whatever, which let's say is and many have more. Usually TCP/IP servers (ie, X server) will allow incoming connections to any of their IP addresses on any of their interfaces, but most software will let you specify an IP address if you want. The actual work is done by bind(2), which takes either INADDR_ANY ( or a real IP address.

The Xorg server implements -name local-address but unfortunately this is only for XDMCP (see file os/xdmcp.c which implements it correctly as far as I know.) The actual connection for the X protocol, I believe, is done by SocketINETCreateListener in the file /usr/include/X11/Xtrans/Xtranssock.c, which sets the address to INADDR_ANY and then binds to it without further processing. What would be needed is the -from flag (which is dealt with by os/xdmcp.c as FromAddress) to somehow connect through to variable 'sockname' just before SocketCreateListener() in Xtranssock.c. The problem, of course, is that all the transport things are really done in a transport-neutral way so it's a bit tricky to get the information into Xtranssock.c.

File paths and so on might vary, was looked at with Ubuntu 10.04 LTS, and note that the function names in Xtranssock.c changed by a macro TRANS. http://cgit.freedesktop.org/xorg/xserver/tree/os/xdmcp.c

Hope that's of some use.

Kind regards


  • For now, I'm using the magic cookie authentication, thus even connections from the same host will not be allowed. xhost would widen the access, not shrink it down. – Paŭlo Ebermann Jun 1 '11 at 19:07
  • And I don't think I'll hack into my X server, but thanks for the suggestion on where to do so. – Paŭlo Ebermann Jun 1 '11 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.