Say a computer is booted to its desktop manager (SDDM, in this case) and you want to send a command over ssh to make that computer log in as a particular user as if they logged in with the keyboard at the computer. I'm not talking about X forwarding.

The computer in question is a Linux desktop that I allow my kids to use for controlled time periods. I have it set up so I can set time limits and lock and unlock sessions (using loginctl) using commands over ssh from my phone. In order for them to use the computer after boot, my wife or I have to first log in locally at the computer. Only then can we control screen lock. I don't know that loginctl can be used to start a user session--just to switch, lock, and terminate them.

This problem is the same as asking "what command can I type on tty2 to make SDDM on tty1 log in as a specific user on tty1" (or it would also be acceptable to log-in to KDE on another tty as long as focus changed to that tty automatically.) SSH is actually irrelevant, I guess. SSH is just the implementation of the technique that I need, which could also be done locally.


This question is probably related to:

Remotely start session on display :0 and Starting x11vnc remotely when X server is already running

For this answer, I will assume systemd as service manager, SDDM as desktop manager, and x11vnc as VNC server. For different resources, adaptation is not involved.

If you have booted your computer remotely, through wake-on-lan, for example, and have no physical access to your keyboard as to enter the user password on KDE's login screen, you will not be able to open the X display through SSH by simply starting a VNC session, such as

$ x11vnc --display $DISPLAY

The output of the command will be somehow verbose, but reading through it you will find something on the lines of

20/12/2019 19:32:35 *** XOpenDisplay failed ($DISPLAY) *** x11vnc was unable to open the X DISPLAY: "$DISPLAY", it cannot continue. *** 

because there is no X-session authenticated yet.

If we read further through the output, we will find

** If NO ONE is logged into an X session yet, but there is a greeter 
login program like "gdm", "kdm", "xdm", or "dtlogin" running, you
will need to find and use the raw display manager MIT-MAGIC-COOKIE 
file. Some examples for various display managers:

gdm: -auth /var/gdm/:0.Xauth -auth /var/lib/gdm/:0.Xauth
kdm: -auth /var/lib/kdm/A:0-crWk72
     -auth /var/run/xauth/A:0-crWk72
xdm: -auth /var/lib/xdm/authdir/authfiles/A:0-XQvaJk
dtlogin: -auth /var/dt/A:0-UgaaXa

That is what we need to do, find and use the raw display manager MIT-MAGIC-COOKIE file.

Along the output of

$ systemctl status sddm

we will find something like

CGroup: /system.slice/sddm.service
        |-650 /usr/bin/sddm
        `-660 /usr/lib/Xorg -nolisten tcp -auth /var/run/sddm/{$somelongstring} -background none -noreset -displayfd 17 -seat seat0 vt1

Simply fetch x11vnc the aforementioned cookie file,

# x11vnc --display $DISPLAY -auth /var/run/sddm/{$somelongstring}

Note that such operation needs to be executed as root.

Now you will have an X11 VNC server running on your machine, and will be able to unlock the greeter screen from a VNC connection through any device, which may be your smartphone as well.

Perhaps someone can come up with a simpler and/or easier solution, where SSH and VNC connections are not needed, and a line of command would suffice. This approach, however, is rather fast and should solve your problem.

For different service managers, desktop managers, and VNC servers, the commands here have to be adapted accordingly.

  • thanks for posting a response, a-sf-d. VNC is a solution, but not one my wife will be able to use, I think. Thanks for the tip as to how to obtain the auth file location for sddm using systemctl status. I'd need to put together a script to parse this output for the auth file location and start a vnc server using it, and use a vnc client app on my phone. I wonder if the command that would allow me to log in for the first time is specific to sddm (or whichever desktop manager I might choose to use in the future.). – jdoggsc Dec 23 '19 at 15:34
  • The location of the authentication file is unchanged, so you may just repeat the last command in my original answer for subsequent VNC sessions initialization through SSH. For GDM3, KDM, or other desktop managers, you would only need to change the cookie file location. I recognize SSH to launch VNC server and authenticate the session remotely through VNC connection is a somewhat bothersome process to just unlock your greeter screen. I will look further into automatically authenticating and unlocking the greeter screen with a single command. I anyways think you should give this answer a try. – a-sf-d Dec 23 '19 at 16:10
  • Thank you again for your response. I have noticed that each time a sddm session is initialized the location of the auth file is different. Or cookie file. I might be confusing which is which, here. I have done it manually a few times already and have been able to use VNC to connect to the greeter screen and log in. The solution, as you said, works, and I intend to use it for the time being--but it is not ideal for a long-term solution. I appreciate your guidance and have already been learning much from you about x-session authentication, which I didn't understand at all before yesterday. – jdoggsc Dec 24 '19 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.