X11 connection rejected because of wrong authentication

Question

First of all what I want to do:

I want to login to a server via ssh. Then change change the user via sudo su user and start some application on my screen.

Some collegues do it by

su user
export DISPLAY=<IP>:0

an it works.

---

I connect to a server via ssh -X user@server. Then I start a X11 application. This works fine (although there are warnings).

Warnings:

libEGL warning: DRI3: failed to query the version
libEGL warning: DRI2: failed to authenticate
qt.qpa.xcb: QXcbConnection: XCB error: 1 (BadRequest), sequence: 414, resource id: 1897, major code: 155 (Unknown), minor code: 1

---

If I run sudo su (or sudo su user) and start the program or run it via sudo myprogram there is an error.

Error:

X11 connection rejected because of wrong authentication.
qt.qpa.xcb: could not connect to display localhost:11.0
qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
    This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem.

Available platform plugins are: eglfs, linuxfb, minimal, minimalegl, offscreen, vnc, xcb.

Aborted

---

I found some articles about this problem.

X11 forwarding fails when switching users

ssh connection. X11 connection rejected because of wrong authentication

---

So extend the /etc/pam.d/su file and the /etc/pam/sudo file by

session  optional  pam_xauth.so 

And later I changed /etc/ssh/sshd_config by adding:

X11Forwarding yes

and restarting the sshd by systemctl restart ssh.service. ssh -T says x11forwarding yes

But nothing changed.

Does anybody know what to do? Its important to check some changes on the users program configurations after making changes.

Answer 1

Since many people will come here with the same error message, not realising it's unrelated to the use of su, I'd like to point out that similar symptoms now occur for a very different reason:

Anything installed with Snap wont work. So xeyes and xclock might work, but a new install of chromium-browser or firefox on Ubuntu wont.

The workaround is to simply do: export XAUTHORITY=$HOME/.Xauthority before running the remote X11 application.

• Ref 1: https://forum.snapcraft.io/t/x11-forwarding-using-ssh/2381
• Ref 2: https://forum.snapcraft.io/t/x11-connection-rejected-because-of-wrong-authentication/16528/3

Answer 2

Insecure option:

On the host from which you log in, execute

xhost +

or, only a little more secure

xhost <IP you want to log in to>

This will allow connections from the remote host.

Why is this insecure? Any program and user from that host (or any program/user from any host, with xhost +) will be able to access your screen and read all key presses on the machine you execute xhost on.

More secure option:

Add the authorisation key for your X11 server to the remote machine:

On the local machine, list the necessary "magic cookie":

# xauth list
hostname/unix:0  MIT-MAGIC-COOKIE-1  0123456789abcdef0123456789abcdef

On the remote machine, add the secret to your ~/.Xauthority file, easiest again with xauth:

# setenv DISPLAY <ORIGIN_IP>:0
# xauth add <ORIGIN_IP>:0 MIT-MAGIC-COOKIE-1 0123456789abcdef0123456789abcdef

Please note that X11 protocol data between these machines is still unencrypted and therefore prone to attacks.

Answer 3

Assuming user1 is the original user (whose password you know) and user2 is the target user (unknown password), I can get this to work:

% ssh -Y user1@target-box
Password: xxxxxxxxxxxxx

user1@target-box% sudo -u user2 bash
Password: xxxxxxxxxxxxx

user2@target-box% cp  ~user1/.Xauthority  ~user2

user2@target-box% xterm &

Note that this also assumes the correct sshd config you spelled out in your post.