0

I have an Ubuntu server on the local net I can ssh to an run say gedit. It works just fine.

And a remote Red Hat 7 through a VPN connection which fails. I connect with the command:

ssh -X -o ForwardX11=yes -o ForwardX11Trusted=yes rhsrv

and then I get the fail:

$ gedit 
(gedit:3085): Gtk-WARNING **: 23:13:00.902: cannot open display: 10.255.255.202:0

To verify I run a few commands:

# is DISPLAY set?
$ echo $DISPLAY 
10.255.255.202:0

# Exists the .Xauthority ?
$ strings ~/.Xauthority
MIT-MAGIC-COOKIE-1

$ xauth list
rhsrv:10  MIT-MAGIC-COOKIE-1  43f5b66044bf4645cde63c22213a0c28

$ xauth info
Authority file:       /home/joe/.Xauthority
File new:             no
File locked:          no
Number of entries:    1
Changes honored:      yes
Changes made:         no
Current input:        (argv):1

# Is route back to client pc open? yes:
$ ssh 10.255.255.202 22
joe@10.255.255.202's password:

# IPv6 problems? no:
$ sudo egrep "^(X|Ad)" /etc/ssh/sshd_config
AddressFamily inet
X11Forwarding yes
X11UseLocalhost no

$ rpm -qa | grep x11
xorg-x11-apps-7.7-7.el7.x86_64
xorg-x11-font-utils-7.5-21.el7.x86_64
xorg-x11-fonts-Type1-7.5-9.el7.noarch
xorg-x11-xauth-1.0.9-1.el7.x86_64

I have tried to rm ~/.Xauthority to get a fresh file with no luck.

I have tried ssh -Y without luck.

After changing /etc/ssh/sshd_config I have run:

# systemctl reload sshd
# systemctl restart sshd
# cat /var/run/sshd.pid | xargs kill -1

On the client pc I ran a verbose task ssh -vv and looked in the output rhsrv file for clues but it looks jolly good:

$ egrep "(Req|[Xx]11)" rhsrv
debug1: Requesting no-more-sessions@openssh.com
debug2: x11_get_proto: /usr/bin/xauth  list :0 2>/dev/null
debug1: Requesting X11 forwarding with authentication spoofing.
debug2: channel 0: request x11-req confirm 1
debug1: Requesting authentication agent forwarding.
debug2: X11 forwarding request accepted on channel 0

Another user on this internal network and server reports no problem while running Emacs in GUI. His routing to the server is a bit different as he connect to the network interface ens192 (172.23.x.x) where I connect to the alias ens193 (10.x.x.x). His $DISPLAY variable says:

$ echo $DISPLAY
pd9993b1.example.org:0

So he has a valid reverse DNS lookup while I don't. It was expected that the $DISPLAY should read something like localhost:10.0 but despite of that he runs GUI fine.

The routing is like this (but should not be relevant):

$ /sbin/routel 
     target         gateway source    proto  scope    dev tbl
    default     172.23.10.1          static        ens192 
10.255.0.0/ 16  10.255.20.1          static        ens193 

Is there any logfile or something I have missed to look for?

  • Display zero is nearly always the local display. ssh X11 forwarding spoofs the display... usually the default display number of :10 or something like that... which seems to actually match your xauth cookie... so, something seems confused about the information in the question... – RubberStamp Jan 7 at 22:45
  • 10.255.255.202:0 is wrong. Are you setting this in .profile or .bash_profile or similar? It should read something like localhost:10.0 to point to your tunnel. – Stephen Harris Jan 7 at 22:57
  • Yes that $DISPLAY looked a bit odd to me but I have not done anything to change it. I am cooperating this server with other people so I might ask around if anybody knows about it. I have tried export DISPLAY=localhost:10.0 but did not change anything. A grep DISPLAY -Is /etc/* did not show anything either. Or in the homedir grep DISPLAY ~/.* -Is . – hschou Jan 7 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.