7

I cannot use X applications on one of my servers. (The same client succeeds in connecting to other servers so the problem is not on the client side).

I connect with ssh -vvv -Y -4 jet (tried also with -X instead of -Y, same problem) to force IPv4 (which solves already a previous error). But then when I start an application requiring X I get the following:

debug1: client_input_channel_open: ctype x11 rchan 3 win 65536 max 16384
debug1: client_request_x11: request from 127.0.0.1 42026
debug2: fd 7 setting O_NONBLOCK
debug3: fd 7 is O_NONBLOCK
debug1: channel 1: new [x11]
debug1: confirm x11
debug2: X11 connection uses different authentication protocol.
X11 connection rejected because of wrong authentication.
debug2: X11 rejected 1 i0/o0
debug2: channel 1: read failed
debug2: channel 1: close_read
debug2: channel 1: input open -> drain
debug2: channel 1: ibuf empty
debug2: channel 1: send eof
debug2: channel 1: input drain -> closed
debug2: channel 1: write failed
debug2: channel 1: close_write
debug2: channel 1: output open -> closed
debug2: X11 closed 1 i3/o3
debug2: channel 1: send close
debug2: channel 1: rcvd close
debug2: channel 1: is dead
debug2: channel 1: garbage collecting
debug1: channel 1: free: x11, nchannels 2
debug3: channel 1: status: The following connections are open:
  #0 client-session (t4 r0 i0/0 o0/0 fd 4/5 cc -1)
  #1 x11 (t7 r3 i3/0 o3/0 fd 7/7 cc -1)

xterm Xt error: Can't open display: JET:10.0

xauth list gives me

JET:11  MIT-MAGIC-COOKIE-1  8d5c49524a122751ec382da3613c9408
JET:10  MIT-MAGIC-COOKIE-1  6582c5c546ca979132e2d32c64ef481d

echo $DISPLAY gives me

JET:10.0

So I have cookies for this display.

My SSH version on the server is:

OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010

From various solutions found on the web there was something like 

xauth generate $DISPLAY MIT-MAGIC-COOKIE-1

but when I run this command I get the same error than when I run a X program (even if I rm ~/.Xauthority just before).

I haven't sudoed after ssh, I auth via a private key. My server is on CentOs and I have the following ssh server configuration sudo cat /etc/ssh/sshd_config|egrep -v "^#"

ListenAddress 0.0.0.0
Protocol 2
SyslogFacility AUTHPRIV
LogLevel DEBUG3
PasswordAuthentication yes
ChallengeResponseAuthentication no
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
X11Forwarding yes
X11DisplayOffset 10
X11UseLocalhost no
Subsystem   sftp    /usr/libexec/openssh/sftp-server

Any hint on what could cause this?

jolivier
  • 197

2 Answers2

9

The following resolved the issue for me, cf. ssh-x11-not-working by azat:

The reason ssh X forwarding wasn't working was because I have a /etc/ssh/sshrc config file.

The end of the sshd(8) man page states: 

 If ~/.ssh/rc exists,
runs it; else if /etc/ssh/sshrc exists, runs it; otherwise runs xauth

So I add the following commands to /etc/ssh/sshrc (also from the sshd man page) on the server side:

    # example sshrc file
    if read proto cookie && [ -n "$DISPLAY" ]; then
             if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then
                     # X11UseLocalhost=yes
                     echo add unix:`echo $DISPLAY |
                         cut -c11-` $proto $cookie
             else
                     # X11UseLocalhost=no
                     echo add $DISPLAY $proto $cookie
             fi | xauth -q -
    fi

And it works!

Note: edited to make the two sets of backticks clearer in the example sshrc. Be careful when copying!

spazm
  • 127
Heinrich Hartmann
  • 241
2

I'm just taking a shot in the dark here, but since you're having xauth issues, maybe it has to do with the trusted X11 forwarding. Have you tried taking the same steps from an ssh connection made via ssh -vvv -X -4 jet?

Anthony DiSanti
  • 255