2

First of all what I want to do:

I want to login to a server via ssh. Then change change the user via sudo su user and start some application on my screen.

Some collegues do it by

su user
export DISPLAY=<IP>:0

an it works.


I connect to a server via ssh -X user@server. Then I start a X11 application. This works fine (although there are warnings).

Warnings:

libEGL warning: DRI3: failed to query the version
libEGL warning: DRI2: failed to authenticate
qt.qpa.xcb: QXcbConnection: XCB error: 1 (BadRequest), sequence: 414, resource id: 1897, major code: 155 (Unknown), minor code: 1

If I run sudo su (or sudo su user) and start the program or run it via sudo myprogram there is an error.

Error:

X11 connection rejected because of wrong authentication.
qt.qpa.xcb: could not connect to display localhost:11.0
qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
    This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem.

Available platform plugins are: eglfs, linuxfb, minimal, minimalegl, offscreen, vnc, xcb.

Aborted

I found some articles about this problem.

X11 forwarding fails when switching users

ssh connection. X11 connection rejected because of wrong authentication


So extend the /etc/pam.d/su file and the /etc/pam/sudo file by

session  optional  pam_xauth.so 

And later I changed /etc/ssh/sshd_config by adding:

X11Forwarding yes

and restarting the sshd by systemctl restart ssh.service. ssh -T says x11forwarding yes

But nothing changed.

Does anybody know what to do? Its important to check some changes on the users program configurations after making changes.

3
  • Any reason why instead of using su user2, you cannot do a second ssh -X user2@server in a different terminal window?
    – dirkt
    Oct 21, 2021 at 12:26
  • @dirkt Because I would need the password of "user2" then.
    – Andy A.
    Oct 21, 2021 at 13:07
  • 1
    Use ssh keys instead of the password? Or maybe even a group key for testing? The problem really is that the forwarding socket and auth information can be specific to the user. You can start looking at Xauthority permissions and permissions on the socket, but letting ssh set up everything for you is a lot simpler.
    – dirkt
    Oct 21, 2021 at 13:34

2 Answers 2

1

Insecure option:

On the host from which you log in, execute

xhost +

or, only a little more secure

xhost <IP you want to log in to>

This will allow connections from the remote host.

Why is this insecure? Any program and user from that host (or any program/user from any host, with xhost +) will be able to access your screen and read all key presses on the machine you execute xhost on.

More secure option:

Add the authorisation key for your X11 server to the remote machine:

On the local machine, list the necessary "magic cookie":

# xauth list
hostname/unix:0  MIT-MAGIC-COOKIE-1  0123456789abcdef0123456789abcdef

On the remote machine, add the secret to your ~/.Xauthority file, easiest again with xauth:

# setenv DISPLAY <ORIGIN_IP>:0
# xauth add <ORIGIN_IP>:0 MIT-MAGIC-COOKIE-1 0123456789abcdef0123456789abcdef

Please note that X11 protocol data between these machines is still unencrypted and therefore prone to attacks.

7
  • Ah, there is 'my_computer' -->ssh--> 'me@remote_computer' -->sudo su--> 'root@remote_computer'. Where I have to set xhost + and how to get off again (xhost -?).
    – Andy A.
    Oct 22, 2021 at 10:15
  • xhost + on the machine with X11, where you sit. Yes, undo by xhost -. Better use the second option. though. Keys are per-user so use xhost add ... as the one that starts the X11 program to be displayed.
    – Ned64
    Oct 22, 2021 at 10:17
  • xhost + doesn't work. But I'm a fool. I forgot export DISPLAY=<myIP>:0. Then I get another error... (Qt libraries - but I think I'ts another theme).
    – Andy A.
    Oct 22, 2021 at 11:09
  • After export DISPLAY <ORIGIN_IP>:0 and xauth add <ORIGIN_IP> MIT... there is an bad display name "123.123.123.123" in "add" command. If I add ":0" at the end of the IP it is executed. xauth list gives then my_computer:0 MIT.... But connection is still refused.
    – Andy A.
    Oct 22, 2021 at 11:26
  • Sorry, added the missing ":0". You could try xauth add my_computer/unix:0 01234... but it works without it for me. Please check the shell syntax, btw, by testing echo $DISPLAY. Perhaps the syntax is export DISPLAY=<origin_ip>:0 so with equals sign. You can also try xauth add $DISPLAY 0123... (always replacing 0123... with your secret of course).
    – Ned64
    Oct 22, 2021 at 18:31
0

Assuming user1 is the original user (whose password you know) and user2 is the target user (unknown password), I can get this to work:

% ssh -Y user1@target-box
Password: xxxxxxxxxxxxx

user1@target-box% sudo -u user2 bash
Password: xxxxxxxxxxxxx

user2@target-box% cp  ~user1/.Xauthority  ~user2

user2@target-box% xterm &

Note that this also assumes the correct sshd config you spelled out in your post.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.