4

By default, recent versions of OpenSSH automatically set ForwardX11Timeout to 20 minutes if you set ForwardX11Trusted to no.

This means that 20 minutes after you start your ssh connection, you can't open any more X clients, because the authentication token has expired. Especially bad if you try to use this with long-lived connections and ControlMaster.

I've tried disabling by setting to 0 (does not work, causes instant expiration) and by setting to a really long value (do not do this, it will crash your X server. Limit is somewhere between 3 and 4 weeks).

How can I completely disable the timeout?

7
  • Judging by source it seems to be unimplemented feature in OpenSSH. In which case the right way is to ask upstreams. As for the crashing X server - that seems to be a bug therein.
    – peterph
    Commented Jan 2, 2014 at 15:12
  • @peterph Feel free to post as an answer. "No, you can't" definitely answers the question... Yeah, I know the X thing is a bug in the server, its already reported. Probably. Xorg has the bug marked secret.
    – derobert
    Commented Jan 2, 2014 at 15:15
  • Is the secret thing real? I thought your were joking in the chatroom.
    – slm
    Commented Jan 2, 2014 at 15:22
  • 1
    @slm not a joke, it appears to be bugs.freedesktop.org/show_bug.cgi?id=27134 ... that bug is secret. Normally that'd be used for a undisclosed security issue. But that doesn't appear to be the case here, so I'm not sure why its secret.
    – derobert
    Commented Jan 2, 2014 at 15:24
  • @derobert crashes are often treated ass security problems unless proven otherwise, since There is often something more sinister lurking behind it (no matter how ridiculous the requirements for anything more severe than crashing your own workspace might be).
    – peterph
    Commented Jan 2, 2014 at 16:44

2 Answers 2

3

At the present time it seems you can't reliably disable the time out completely. Nevertheless the patch needed shouldn't be too much intrusive so if you are able to update/recompile your ssh there should be a way out of it. You might want to watch this question on the upstream mailing list for possible replies.

2

There was a patch 2018-04 and discussion 2018-06 but my search of mailing list archive by subject lines alone suggests it was not yet accepted as of 2019-04.

Duplicating some related info I posted at https://superuser.com/a/1429080/1027014 just now -

The maximum timeout is uint_max of milliseconds minus some slack, just over 24 days. OpenSSH_7.4p1 will accept ssh -o ForwardX11Timeout=2147423s -X ... which is the best answer I can make now. ForwardX11Timeout above this may crash the XServer in some version combinations.

On MacOS with XQuartz, I have seen Warning: untrusted X11 forwarding setup failed: xauth key data not generated and upon digging further, /opt/X11/bin/xauth: timeout in locking authority file /var/folders/..../xauthfile .

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .