DISPLAY variables on X with SSH

darklogik_org · 01-18-2004, 10:46 PM

On Mandrake, I could be logged in to my machine, walk across the room, log in with SSH from my G4 (under the same username) and run programs from the linux machine in Apple's X11. However, with Slackware this is not the case.

I believe the problem lies with my DISPLAY variables. X forwarding is definately on, and if I set my display variable to 0:0, I can run programs on the Slackware boxes screen from the G4 (NOT very useful). If I set the DISPLAY variable to anything else, I just get a generic "can't open display" error.

How can I define new displays, perhaps two for each user (one for local and one for ssh)?

cheers
mark

jschiwal · 01-19-2004, 12:11 AM

When I'm at my laptop (hplt), and using ssh, I can run x programs on my desktop (matrix) after changing the DISPLAY variable to matrix:0.0 . However I also use Mandrake, but I don't think that would matter.

moses · 01-19-2004, 12:14 AM

Have you checked that the sshd_config settings for the Slackbox are identical to those on the Mandrake box? Are the ssh_config settings the same for the users on Slack and MDK? Is the user the same for both boxes (identical on the G4)?
What are your settings for the sshd_config on the Slackbox? on the MDK?
What are your settings for ssh_config on the G4?
You shouldn't have to change DISPLAY variables at all. Are you sure that MDK isn't setting the DISPLAY env variable for you when you ssh in?
For /etc/sshd_config:

Code:

X11Forwarding yes
X11UseLocalhost yes
X11DisplayOffset 10

for /etc/ssh_config or ~/.ssh/ssh_config:

Code:

ForwardX11 yes

jschiwal · 01-19-2004, 12:31 AM

Maybe I should try it without changing my DISPLAY variable.

my ssh_config has

Code:

X11Forwarding yes

but the lines
X11UseLocalHost yes
X11DisplayOffset 10
are commented out.

darklogik_org · 01-19-2004, 01:13 AM

Sorry, I should clarify. The slackware and the mandrake boxes are one and the same! I uninstalled mandrake for slackware, as it was much... well.. better!

my sshd_config on the slackware machine now has:

X11Forwarding yes #this was set to no and commented out, but i changed it anyway
X11DisplayOffset 10
X11UseLocalHost

my ssh_config on the slackware machine now has:

ForwardAgent no #just to make sure, i just noticed this was set to YES!
ForwardX11 yes #for connecting to other machines

I always connect from the G4 using:

$ ssh -Xv linuxlogik

So it's not really necessary to turn on X forwarding in the G4's ssh_config.

I'll give these new settings a go and post back.
cheers
mark

darklogik_org · 01-19-2004, 01:21 AM

I logged in and typed "gimp" as a test.

Gtk-WARNING**: cannot open display

It says the same generic-type error for any other program requiring X.

Oh to answer a previous question: The user accounts share the same username but not the same password. I use a keypair system to login.

mark

notAcoolNick · 01-19-2004, 04:21 AM

sorry for stupid question but...
is xhost set?

darklogik_org · 01-19-2004, 07:32 AM

xhost?

It may have crossed your mind that I've never actually had to manually configure X11 before. Mandrake did it for me, and Apple's X11 was configured too.

mark

notAcoolNick · 01-19-2004, 11:56 AM

dude,
my suggestion to you would be to add the following to you X startup script (be it .xinitrc if you start X manually or .xsession if you use *dm)

xhost name_of_your_local_box #you will need to run X apps as su
xhost remote_host_1
xhost remote_host_2

etc.
this might help.

moses · 01-20-2004, 11:19 PM

The whole point of X forwarding in ssh is not to set xhost. xhost is a security flaw (not that X forwarding under ssh is much better, but it's better).
A (potentially silly) question: Do you have X11 running on the Mac before you ssh over? ssh ignores the forward (and thus doesn't set up the DISPLAY environment variable) if you don't have X11 running when it's invoked. Is it possible that your DISPLAY env. var. on the Mac isn't being set for some reason? I know it worked on the MDK box, but that doesn't mean MDK didn't do something funky with your logins (I don't know, anyone?).

from man ssh:

Quote:

If the ForwardX11 variable is set to ``yes'' (or, see the description of
the -X and -x options described later) and the user is using X11 (the
DISPLAY environment variable is set), the connection to the X11 display
is automatically forwarded to the remote side in such a way that any X11
programs started from the shell (or command) will go through the
encrypted channel, and the connection to the real X server will be made
from the local machine. The user should not manually set DISPLAY. For-
warding of X11 connections can be configured on the command line or in
configuration files.

The DISPLAY value set by ssh will point to the server machine, but with a
display number greater than zero. This is normal, and happens because
ssh creates a ``proxy'' X server on the server machine for forwarding the
connections over the encrypted channel.

ssh will also automatically set up Xauthority data on the server machine.
For this purpose, it will generate a random authorization cookie, store
it in Xauthority on the server, and verify that any forwarded connections
carry this cookie and replace it by the real cookie when the connection
is opened. The real authentication cookie is never sent to the server
machine (and no cookies are sent in the plain).

darklogik_org · 01-20-2004, 11:39 PM

Thanks a lot everyone, I will get round to trying all of your suggestions very soon.

I was actually wondering about that comment that X over ssh isn't much better....?

I use protocol 2 and the keypair system with STRONG passphrases (Horrible multi-symbol, uppercase-lowercase plus numbers). How can X forwarding through ssh be insecure? Surely it gets encrypted exactly the same as everything else? I'm not worried about speed as I have fast ethernet and the machine can only be accessed from behind the router (local network).

mark

moses · 01-20-2004, 11:45 PM

The X11 protocol isn't secure, so if someone can crack your remote host (the one you ssh in to), it's possible that, if you are using X11 tunneling, they can crack your local system.

Quote:

X11 forwarding should be enabled with caution. Users with the
ability to bypass file permissions on the remote host (for the
user's X authorization database) can access the local X11 display
through the forwarded connection. An attacker may then be able
to perform activities such as keystroke monitoring.

Security is, at best, only as strong as the weakest link in the chain. . .

darklogik_org · 01-21-2004, 12:22 AM

Oh sorry, I'm aware of that, but surely that would be the case with any service involving logins. I know that my boxes are mostly secure, my G4 is not running ANY services at all, you can't ssh into it or anything. I am behind a very strong hardware firewall (A nice big draytek!) and I have logs printed to hardcopy. Each machine is also running a basic firewall. I run daily security scripts to check file permissions and make sure all my software is up to date. Other than unplugging the router and keeping the machines switched off in a cupboard, there's not much more I can do!

As to your questions: I almost guarantee that Mandrake was doing something with logins. X11 is always running on my machine when I log in to a Linux box because it's just more convenient that way (in case I need to run any X apps).

mark

moses · 01-21-2004, 01:18 PM

Quote:

Originally posted by darklogik_org
Oh sorry, I'm aware of that, but surely that would be the case with any service involving logins. I know that my boxes are mostly secure, my G4 is not running ANY services at all, you can't ssh into it or anything. I am behind a very strong hardware firewall (A nice big draytek!) and I have logs printed to hardcopy. Each machine is also running a basic firewall. I run daily security scripts to check file permissions and make sure all my software is up to date. Other than unplugging the router and keeping the machines switched off in a cupboard, there's not much more I can do!

Correct! The best thing you can do to keep your system safe it so make regular backups so that WHEN you are cracked, you can at least recover some of your system.

Quote:

As to your questions: I almost guarantee that Mandrake was doing something with logins. X11 is always running on my machine when I log in to a Linux box because it's just more convenient that way (in case I need to run any X apps).

mark

When you log in to the Mac, printenv DISPLAY
If that's not set (or not set correctly), this is probably the problem.
ssh in to the Slack box and printenv DISPLAY. If this isn't localhost:11.0 (it should NOT be mac.name.org:0.0), it's not forwarding X11 through the ssh tunnel.

darklogik_org · 01-22-2004, 01:31 PM

Quote:

Originally posted by moses
Correct! The best thing you can do to keep your system safe it so make regular backups so that WHEN you are cracked, you can at least recover some of your system.

And weekly backups of home folders!

Something VERY odd has happened... erm... it's just started working. I've been too busy lately to really play with settings but now it just works. Gimp forwarded first time!

I wonder now if it was a file permission problem, because I modified a script recently (to actually lock things down more!). Apart from that I've done nothing else..!

Ah well, thanks for the help everyone. Off to bed.
mark