No more X11 forwarding in ssh -Y or ssh -X, why? [SOLVED]

rsa4046 · Last edited by rsa4046 on Thu Dec 18, 2008 3:15 am; edited 1 time in total

I've got the same apparent problem as in this post , in that ssh X forwarding (which used to work some time ago) now doesn't. In the sample below, L and R prompts designate the machine (local or remote):

coolsnowmen · Veteran Joined: 30 Jun 2004 Posts: 1479 Location: No.VA

can you try removing both local and remote ~/.Xauthority files, and then ssh -XY again.

also try with

rsa4046 · Posted: Wed Dec 17, 2008 5:04 pm Post subject:

Thanks for the reply coolsnowmen. I've tried your suggestion, but with no success :cry:

: Here's what I did:
On remote machine:

all

On local machine, similar sequence:

Code:

$ ssh remotehost -Y
Warning: No xauth data; using fake authentication data for X11 forwarding.
Last login: Wed Dec 17 10:33:36 2008 from <snip>
/usr/bin/xauth: creating new authority file /home/rolf/.Xauthority
$ xterm
Xlib: connection to "localhost:10.0" refused by server
Xlib: Invalid MIT-MAGIC-COOKIE-1 key
xterm Xt error: Can't open display: localhost:10.0
$ xhost +
Xlib: connection to "localhost:10.0" refused by server
Xlib: Invalid MIT-MAGIC-COOKIE-1 key
xhost: unable to open display "localhost:10.0"

At the moment, /etc/ssh/sshd_config on the remote machine has only

Devport · Guru Joined: 15 Dec 2004 Posts: 361

Did you update to glibc-2.9 ( I have xauth problems using gksu since the update ).

rsa4046 · Posted: Wed Dec 17, 2008 6:23 pm Post subject:

Devport · Guru Joined: 15 Dec 2004 Posts: 361

Okay now I am pretty sure that it is caused by glibc-2.9 which cant be downgraded to double check ...

https://bugs.gentoo.org/show_bug.cgi?id=251338

I added a topic about downgrading glibc - I am pretty sure your X over ssh will work again with glibc < 2.9.

https://forums.gentoo.org/viewtopic-p-5318819.html#5318819

rsa4046 · Posted: Wed Dec 17, 2008 7:02 pm Post subject:

Devport · Guru Joined: 15 Dec 2004 Posts: 361

rsa4046 · Posted: Wed Dec 17, 2008 7:11 pm Post subject:

Devport · Guru Joined: 15 Dec 2004 Posts: 361

Done. I emerged glibc-2.8 by masking 2.9 and modifying the glibc ebuild as mentioned in your link. A simple emerge -av1 glibc worked just fine. gksu is working again and I suppose your X over ssh would work as well. Even though it worked fine for me be careful and do at least a quickpkg glibc before downgrading.

rsa4046 · Posted: Wed Dec 17, 2008 8:52 pm Post subject:

Devport, I will give this a try tonight and post back. Thanks again for your help. Cheers, Rolf
_________________
I love gentoo, but I am certainly no guru, despite what it says above.

rsa4046 · Posted: Thu Dec 18, 2008 3:14 am Post subject:

Devport, an update:

Devport · Guru Joined: 15 Dec 2004 Posts: 361

I am glad it worked for you too. And your topic made me solve my issue as well since I was as of then unsure if glibc-2.9 was the cause. I even answered to your topic almost immediatly but deleted it again because I was unsure ... :lol:

robbyjo · Guru Joined: 06 Apr 2003 Posts: 462

Is the newer glibc-2.9_p20081201-r2 solves this problem yet? The following bug thread:
https://bugs.gentoo.org/251338

indicates that the bug still stands. But post #6 of that thread seems to indicate it's solved. Can anyone confirm? I don't want to experience the nightmare of downgrading glibc.

rsa4046 · Posted: Thu Mar 26, 2009 10:37 pm Post subject:

Here's what I have with glibc-2.9 on a local and remote machine: untrusted forwarding fails

Princess Nell · l33t Joined: 15 Apr 2005 Posts: 918

Hhm. I have the same problem, but am using glibc-2.8_p20080602-r1.

robbyjo · Guru Joined: 06 Apr 2003 Posts: 462

I finally took the plunge. You need to add the following lines in your /etc/ssh/ssh_config:

urcindalo · Posted: Thu Nov 05, 2009 5:50 pm Post subject:

dmpogo · Advocate Joined: 02 Sep 2004 Posts: 3286 Location: Canada

Untrusted forwarding is essentially broken. One should use the trusted one

So

ForwardX11Trusted yes

is ssh config files or

ssh -Y somebody@somewhere

on command line.

urcindalo · Posted: Thu Nov 05, 2009 11:05 pm Post subject:

holmberm · n00b Joined: 02 Aug 2010 Posts: 2 Location: Sweden

This may be slightly OT, and in an old thread no less...

Could any of you well informed gurus give a verbose explanation about the state of X forwarding over ssh? I've read all I could find on the subject but I don't know what to use. man ssh says that ssh -Y can make attackers able to monitor keystrokes etc. (when is this a realistic threat? Certain kinds of hosts?). But the rest of the world (including dmpogo and some people on https://bugs.gentoo.org/237778) say that ssh -X is unsafe/broken/evil, and I don't know what to make of it. Please enlighten me;)

FreakNigh · n00b Joined: 20 Aug 2006 Posts: 38

For me the final change I had to make was modify -

~/.ssh/config

and add in -

ForwardX11Trusted yes
ForwardX11 yes

Also pretty sure I had to recompile openssh with +X.

mole · Tux's lil' helper Joined: 07 Nov 2009 Posts: 81

Old thread, posting a tip here as it might save someone a lot of time...

If you have an SSD and mount /tmp and /var/tmp using tmpfs to save disk wear, it will likely break X forwarding over SSH.

Once I mounted /tmp and /var/tmp normally, X forwarding worked over SSH again.

hkmaly · n00b Joined: 13 Jul 2006 Posts: 45