Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am on Ubuntu 14.04 and trying to get my head around ForwardX11 vs ForwardX11Trusted.

My default ssh_config contains the following lines:

#   ForwardX11 no
#   ForwardX11Trusted yes

Further, man ssh_config tells me that:

1.   command-line options
2.   user's configuration file (~/.ssh/config)
3.   system-wide configuration file (/etc/ssh/ssh_config)

and that ForwardX11.default == no and ForwardX11Trusted.default == yes.

Now my questions:

  1. I take it that 1. takes precedence over 2. over 3. None is specified, thus the default settings should be applied, i.e. ForwardX11Trusted == yes. If I SSH into a remote machine without the -Y or -X option, X11 forwarding does not work.

  2. If I specify -X, X11 forwarding works but it seems to be in trusted mode?

  3. If I set

    ForwardX11 no
    ForwardX11Trusted no

    in /etc/ssh/ssh_config, I can now choose the mode correctly with the -X and -Y command line options. But, while the forwarding causes roughly .5 MBit of traffic in -Y mode, it hogs 6-10 MBit in -X mode.

  4. If I explicitly set

    ForwardX11 yes

    SSH still ignores the ssh_config file. I still need to specify ssh -X [...].

  5. Why does SSH seem to ignore both the default settings and the config file?

share|improve this question

I found this page useful: https://padraic2112.wordpress.com/2007/07/09/bad-security-201-remote-x-sessions-over-ssh/

It basically answers your question #2:

If ForwardX11Trusted is set to “yes”, then the commands ssh -X and ssh -Y are functionally equivalent. If ForwardX11 and ForwardX11Trusted are both set to “yes”, then the command flags are not only equivalent, they’re unnecessary… that is

ssh user@host command = ssh -X user@host command = ssh -Y user@host command

If ForwardX11 is set to “yes” and ForwardX11Trusted is set to “no”, then

ssh user@host command = ssh -X user@host command =/= ssh -Y user@host command

Unfortunately, I have no insight on your other observations.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.