2

I am trying to configure X11 forwarding through SSH on my home server.

The server is running Debian Jessie (hostname moonraker) in a headless configuration.

My client is running OS X 10.10. I have used X11 forwarding on other servers before on this client, so I don't think the issue is with my Mac.

The exact error message I recieve after running xclock is:

X11 connection rejected because of wrong authentication.
Error: Can't open display: localhost:10.0

After some googling, I have verified the following:

1) $ ls -lA ~/.Xauthority

-rw------- 1 ssunder ssunder 55 Sep 21 21:53 /home/ssunder/.Xauthority

2) $ grep X11 /etc/ssh/sshd_config

X11Forwarding yes
X11DisplayOffset 10
X11UseLocalhost yes

3) My client's ~/.ssh/config contains:

ForwardX11 yes
ForwardX11Trusted yes

4) $ xauth list

moonraker/unix:10  MIT-MAGIC-COOKIE-1  d7e2e4a8c5aa4430bfcc2abb436940d2

5) Running sshd with debug level 2: # cat /var/log/auth.log | grep sshd | tail -n 100 | less

Sep 21 22:19:57 moonraker sshd[20089]: debug1: X11 connection requested.
Sep 21 22:19:57 moonraker sshd[20089]: debug2: fd 10 setting TCP_NODELAY
Sep 21 22:19:57 moonraker sshd[20089]: debug2: fd 10 setting O_NONBLOCK
Sep 21 22:19:57 moonraker sshd[20089]: debug1: channel 3: new [X11 connection from ::1 port 34632]
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: open confirm rwindow 2097152 rmax 16384
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: rcvd eof
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: output open -> drain
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: obuf empty
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: close_write
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: output drain -> closed
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: rcvd close
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: close_read
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: input open -> closed
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: send close
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: is dead
Sep 21 22:19:57 moonraker sshd[20089]: debug2: channel 3: garbage collecting
Sep 21 22:19:57 moonraker sshd[20089]: debug1: channel 3: free: X11 connection from ::1 port 34632, nchannels 4

Any idea what else I should check?

2 Answers 2

4

If the user on your server has a custom .ssh/rc file, or you have a non-standard /etc/ssh/sshrc file, then the xauth stuff won't get setup correctly.

From the sshd man page:

 If the file ~/.ssh/rc exists, sh(1) runs it after reading the environment
 files but before starting the user's shell or command.  It must not pro‐
 duce any output on stdout; stderr must be used instead.  If X11 forward‐
 ing is in use, it will receive the "proto cookie" pair in its standard
 input (and DISPLAY in its environment).  The script must call xauth(1)
 because sshd will not run xauth automatically to add X11 cookies.

If you need a custom rc file, simply add this to it, also from the man page:

    if read proto cookie && [ -n "$DISPLAY" ]; then
            if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then
                    # X11UseLocalhost=yes
                    echo add unix:`echo $DISPLAY |
                        cut -c11-` $proto $cookie
            else
                    # X11UseLocalhost=no
                    echo add $DISPLAY $proto $cookie
            fi | xauth -q -
    fi
5
  • I realized that I had a call to w in my sshrc file. I moved that to my .bashrc and this solved the problem. Thanks! Commented Sep 22, 2015 at 14:50
  • Wow. Thanks. This was my issue too. I guess this is uncommon enough that no one else thought to mention it.
    – isaaclw
    Commented Apr 8, 2018 at 4:28
  • What is "a call to w"?
    – tgunr
    Commented Jul 17, 2019 at 17:12
  • @tgunr w is a command on many Linux distros. Wikipedia Commented Mar 8, 2020 at 16:53
  • Actually, w = who
    – tgunr
    Commented Mar 9, 2020 at 17:24
0

Checking that the disk is full should be the first step when this error message is encountered.

When the disk is full, ssh can not add the key to .Xauthority. This causes authentication error.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .