1st question :

for example if I am from serverA , i do a :

xclock -display serverB:0.0

it wont work,

but I ssh to server B , then I type the above command again, it will work

Both server A anc B are linux box.

Am I right to say If I am going to export display from one server to another, i must be authenticated 1st?

2nd question :

this time, serverC is a windows box with reflection X installed.

if I am going to do a xclock -display serverC:0.0 , it work without even quthentication!

Thanks.

On serverB use the xhost command to allow serverA to open X-Windows on it.

xhost +serverA

or just
xhost +

To allow any machine to open X-Windows to it.

X emulators such as reflectionX and eXceed essentially allow all connections unless you configure them not to.

it doesn't work.

anything i need to take note?

It uses ports 6000 through 6010 for X displays. if something (e.g. a firewall) is blocking these it won't allow them to come through. On Windows XP I had to open those ports in the Windows firewall to get XP to allow for X windows to come up.

If the machines are in different subnets it may be the switches or routers between them are blocking the ports.

If there is a firewall blocking those ports that you can't get changed (e.g. the network guy tells you to go to heck) you can look into ssh x-tunneling wherein it actually uses an ssh (port 22) session you've opened from the client to the server. At that point it sets a special DISPLAY value and comes back over the original ssh connection rather than via the 6000 ports.