I am on Ubuntu 14.04 and trying to get my head around ForwardX11 vs ForwardX11Trusted.

My default ssh_config contains the following lines:

#   ForwardX11 no
#   ForwardX11Trusted yes

Further, man ssh_config tells me that:

1.   command-line options
2.   user's configuration file (~/.ssh/config)
3.   system-wide configuration file (/etc/ssh/ssh_config)

and that ForwardX11.default == no and ForwardX11Trusted.default == yes.

Now my questions:

  1. I take it that 1. takes precedence over 2. over 3. None is specified, thus the default settings should be applied, i.e. ForwardX11Trusted == yes. If I SSH into a remote machine without the -Y or -X option, X11 forwarding does not work.

  2. If I specify -X, X11 forwarding works but it seems to be in trusted mode?

  3. If I set

    ForwardX11 no
    ForwardX11Trusted no

    in /etc/ssh/ssh_config, I can now choose the mode correctly with the -X and -Y command line options. But, while the forwarding causes roughly .5 MBit of traffic in -Y mode, it hogs 6-10 MBit in -X mode.

  4. If I explicitly set

    ForwardX11 yes

    SSH still ignores the ssh_config file. I still need to specify ssh -X [...].

  5. Why does SSH seem to ignore both the default settings and the config file?

  • Some answers in related question unix.stackexchange.com/questions/107547/… . The bonus question about X11 forwarding wasting hundreds of kilobit/sec of network traffic is interesting - may be worth asking separately?
    – mcast
    Apr 24, 2019 at 12:58

2 Answers 2


Per #4, are you editing the right file? The ~/.ssh/config file to change is the one on the client (where the keyboard is, usually).

As for #2 (and 3), remember that ForwardX11Trusted doesn't imply ForwardX11. ForwardX11Trusted just means that if you turn on forwarding (whether via config file or command line) then the forwarded connection will be trusted.

  • So what is the difference between Trusted and non-Trusted modes? Feb 17, 2016 at 3:34
  • 1
    Hmm, you original question indicates you read the man page, so you've seen the description of ForwardX11Trusted in ssh_config(5). Perhaps it will help to understand that a trusted X11 client application has access to more than just its window; it can affect the whole X11 server and read data belonging to other windows. Consider xdpyinfo or xkill, for example. I consider the distinction bogus, though; I've never been able to use X11 except with ForwardX11Trusted=yes. The distinction is relatively recent and IMO immature. Feb 18, 2016 at 18:26

I found this page useful: https://padraic2112.wordpress.com/2007/07/09/bad-security-201-remote-x-sessions-over-ssh/

It basically answers your question #2:

If ForwardX11Trusted is set to “yes”, then the commands ssh -X and ssh -Y are functionally equivalent. If ForwardX11 and ForwardX11Trusted are both set to “yes”, then the command flags are not only equivalent, they’re unnecessary… that is

ssh user@host command = ssh -X user@host command = ssh -Y user@host command

If ForwardX11 is set to “yes” and ForwardX11Trusted is set to “no”, then

ssh user@host command = ssh -X user@host command =/= ssh -Y user@host command

Unfortunately, I have no insight on your other observations.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .