Ubuntu 20.04: Eliminating '-auth' in Xorg process list

Removing the -auth argument from the Xorg process list is technically impossible and highly discouraged because it breaks the authentication mechanism required for secure client connections. Instead of attempting to disable this critical security feature, you should focus on securing your display manager configuration or using VNC with proper key-based authentication to achieve remote access without exposing the session to unauthorized control.

Understanding the Role of Xorg Authentication

The X Window System relies heavily on the MIT-MAGIC-COOKIE-1 authentication protocol to ensure that only authorized clients can interact with the display server. When you run the command ps aux | grep Xorg, you will typically see arguments such as -auth /run/xauth/. This path points to a temporary file containing the magic cookie used to verify the identity of connecting applications. Attempting to remove this flag entirely means the X server starts without verifying who is trying to connect to it. In older versions of X or specific embedded configurations, there might have been options like -ac (disable access control), but even then, some form of authorization handling remains integral to the modern Xorg stack. The previous advice suggesting a --no-auth flag was incorrect because no such standard option exists in Ubuntu 20.04’s Xorg package. Removing authentication effectively turns your desktop into an open system where any local user or potentially malicious script could inject keystrokes, capture screenshots, or execute commands without permission.

Why You Should Not Disable Auth

Security best practices dictate that the display server must always authenticate connections. If you disable auth, you expose your graphical session to:

• Keystroke Logging: Any process running under your user account can read input events.
• Screen Capture: Malware can take screenshots of your active desktop.
• Session Hijacking: An attacker could clone your session or control your mouse pointer.

This risk is particularly acute if you are setting up remote access solutions. Many users seek to remove -auth because they are struggling with VNC or RDP connections failing due to permission issues. However, the correct solution lies in configuring the remote tool correctly, not in weakening the core display server. For instance, if you are experiencing issues with remote desktop tools, check our guide on VNCServer shows grey screen on port 1, but desktop environment works on other ports to resolve connectivity problems without compromising security.

Properly Configuring Remote Access

If your goal is to allow remote management of your Ubuntu 20.04 desktop, you should use established protocols that handle authentication securely. GNOME Display Manager (GDM) and Wayland/Xorg have built-in mechanisms for secure remote sessions.

Using xrdp with Proper Keys

The most common method for Windows-like remote access on Linux is xrdp. When installed correctly, xrdp does not require disabling Xorg auth. Instead, it manages its own session keys. Ensure that:

1. You have installed xrdp via sudo apt install xrdp.
2. The xrdp service is enabled and started.
3. Your user is added to the ssl-cert group if necessary for certificate access.

If you encounter signature verification issues during installation, refer to How to Solve The Following Signatures Couldn't be Verified Because the Public Key is Not Available: NO_PUBKEY EB3E94ADBE1229CF to fix repository signing problems before proceeding.

VNC Configuration with TightVNC or TigerVNC

For VNC, avoid starting vncserver as root or bypassing display manager controls. Instead, configure tigervnc or x11vnc to attach to the existing display managed by GDM. This approach preserves the -auth file because the VNC server inherits the permissions from the logged-in user session. To set this up:

• Install x11vnc: sudo apt install x11vnc.
• Create a password file for the VNC connection: x11vnc -storepasswd.
• Run x11vnc pointing to the current display: x11vnc -display :0 -rfbauth ~/.vnc/passwd.

This method ensures that the Xorg process retains its -auth argument, maintaining the integrity of the session while allowing remote viewing.

Securing Your Ubuntu Environment

Beyond remote access, ensuring your Xorg setup is secure involves regular updates and proper firewall rules. Ubuntu 20.04 includes AppArmor profiles for Xorg that restrict what the display server can do. Disabling auth would likely conflict with these profiles, causing unexpected crashes or security warnings. For a comprehensive overview of hardening your server against external threats, including network interface configuration and service isolation, see Securing an Ubuntu Server for Development Purposes. While this guide focuses on servers, the principles of least privilege apply equally to desktop environments.

Conclusion

You cannot and should not eliminate the -auth parameter from the Xorg process list in Ubuntu 20.04. It is a fundamental component of the X Window System's security model. Instead of looking for ways to break this mechanism, invest time in properly configuring remote desktop tools like xrdp or x11vnc. These tools are designed to work within the existing security framework, providing safe and reliable remote access without exposing your system to unnecessary risks. By respecting the authentication requirements of Xorg, you maintain a stable and secure computing environment.

Frequently Asked Questions

Can I use the -ac flag to disable Xorg authentication?

The -ac flag disables access control, which allows any client to connect without a magic cookie. However, this is considered insecure and is not recommended for modern desktops as it leaves your session vulnerable to local attacks. Most modern distributions ignore or restrict this flag for safety reasons.

Why does my VNC viewer show a grey screen?

A grey screen often indicates that the VNC server cannot authenticate with the display manager or that the resolution is unsupported. Check if the VNC service is running under the same user context as the desktop session, and ensure that the display manager (like GDM) is not locking the session exclusively.

Is it safe to run Xorg without a display manager?

Running Xorg directly without a display manager like GDM or LightDM is possible but risky. Without a display manager, you lose automatic session management and may face challenges with user permissions and resource allocation. It is better to use the display manager and configure remote access through it.

How do I find the Xorg auth file location?

You can find the auth file by running ps aux | grep Xorg and looking for the -auth argument. The path usually looks like /run/xauth/. Do not delete or modify this file manually, as doing so will crash the current X session.

What happens if I try to start Xorg with --no-auth?

The --no-auth flag does not exist in standard Xorg builds. Attempting to use it will result in an "Unrecognized option" error from the X server. The system expects either valid authentication files or the deprecated -ac flag, neither of which should be disabled in production environments.