[SOLVED] .xauth* and .serverauth* being created "randomly"

[gorg86]

Hello folks,

I just noticed a strange behaviour on my machine when I was monitoring my disk usage with iotop (LXDE was running at that time):
In my root folder are files being created/changed named .xauth***** (* = random alphanumeric) and in the home directory of the normal user happened the following:

[Hu]

For historical reasons, the X server process runs with effective UID root even when you start it from a user shell. This is undesirable from a security perspective and there are efforts afoot to replace it with a different problem. For now, seeing X running as root is not necessarily an indication you did anything wrong.

For the .xauth files in root's home directory, I believe there is a PAM module pam_xauth.so that is responsible for this. Its purpose is to make it easier to misuse the system, by forwarding your user's X11 auth cookies to the root user, so that you can then easily run X11 client programs as root. If you do not run X11 programs as root (and you should not), you can eliminate this forwarding by disabling the line session optional pam_xauth.so in /etc/pam.d/su.

[gorg86]

Thanks for the explanation.
I disabled that liine and .xauth* in the root directory is gone now.