topic Re: X tunneling in Operating System - HP-UX

X tunneling

Belinda Dermody — Mon, 16 Jan 2006 16:06:01 GMT

I have two systems one in VA and the other Tx going through a firewall. As root I can connect via Putty to my HP system and start up a xterm and have it run/display on my HP system back here in VA.
But if I log into the TX system via Putty as sybase and try to run execute Xterm command I get the following error message on my terminal here in VA

Vail:/usr/sybase: xterm
Xlib: connection to "10.89.1.20:10.0" refused by server
Xlib: PuTTY X11 proxy: wrong authentication protocol attempted
Error: Can't open display: 10.89.1.20:10.0
Error: Couldn't find per display information
Vail:/usr/sybase:

I do a echo $DISPLAY on both systems as root and sybase and they both come up as the same, I use the same Putty load configuration just log into the remote system as either root or sybase and I bring up the host X application on the local host as root and then sybase. In other words I do the same for either user and it works for root but not for sybase.

Re: X tunneling

Ivan Ferreira — Mon, 16 Jan 2006 16:11:53 GMT

Normally, connection to "10.89.1.20:10.0" refused by server, these errors means that the is not authorized to use the display. If you where on a Unix client, you should have to issue the xhost command or xauth to permit the access.

Re: X tunneling

Belinda Dermody — Mon, 16 Jan 2006 16:20:28 GMT

Question: Why does it work for root and not sybase ?????

Re: X tunneling

Zinky — Mon, 16 Jan 2006 16:23:05 GMT

Where is the DISPLAY 10.89.1.20:10.0 ? On your VA HP-UX machine (which probly is an a Workstation with a Graphics Head/Full X) or a PC running a PC-based X-Server?

Re: X tunneling

Sandman! — Mon, 16 Jan 2006 16:27:13 GMT

James,

What does the output of xhost show you?

# xhost

cheers!

Re: X tunneling

Belinda Dermody — Mon, 16 Jan 2006 16:27:57 GMT

The 10.89.1.20:0.0 is displayed when I do a echo $DISPLAY on the remote system in TX (which I connect to via Putty and have X-tunneling turned on). I am running Kea-X application on my PC which I connect to my local HP server and the echo DISPLAY show my PC address plus .bcharrispub.com:0.0

Re: X tunneling

Belinda Dermody — Mon, 16 Jan 2006 16:29:17 GMT

xhost command from my VA server...

$ xhost
access control disabled, clients can connect from any host

Re: X tunneling

Zinky — Mon, 16 Jan 2006 16:35:39 GMT

As I suspect - you're using a PC based X-Server.

Somewhere in your Kea_X menus, you should have the option to set its security. Set it so the server you are connecting to is allowed to DISPLAY.

I am still wondering though - the error mesage in your post says 10.89.1.20:10.0. If Are you sure your Kea-X DISPLAY session is :0.0 or :10.0?

Re: X tunneling

Ivan Ferreira — Mon, 16 Jan 2006 16:41:53 GMT

Ensure that you have configured:

X11Forwarding yes

In /opt/ssh/etc/sshd_config

Re: X tunneling

Belinda Dermody — Mon, 16 Jan 2006 16:44:36 GMT

Like I stated earlier, when I do the echo $DISPLAY when I root on the TX and the Va system they shown the same as the user sybase $DISPLAY.
sybase or root userid on TX server connection via Putty DISPLAY=10.89.1.20:10.0

sybase or root userid on VA server connection via Kea-X Terminal DISPLAY=.bcharrispub.com:0.0

Re: X tunneling

Sandman! — Mon, 16 Jan 2006 16:46:44 GMT

James,

Maybe the problem lies with your .Xauthority file. What is your Remote X11 authentication protocol set to in PuTTY. It should match the one in your .Xauthority file for user sybase.

cheers!

Re: X tunneling

Belinda Dermody — Mon, 16 Jan 2006 16:46:48 GMT

Xforwarding is set to yes other wise I wouldn't be able to bring up the xterm as root.

Re: X tunneling

Zinky — Mon, 16 Jan 2006 16:51:34 GMT

Have you found that Kea-X setting for display security? What does it is set to? Can you try setting it to allow all to display?

The :10 I now understand to mean you have X11 forwarding indeed.

Re: X tunneling

Belinda Dermody — Tue, 17 Jan 2006 09:25:14 GMT

Sorry guys, went home after a long day, but back at it. Nelson, the Kea-X security file would be the same for either the root account or the sybase account, because I bring up the local X application and login in as either root or sybase.

The error seems to be generated from the Remote site when I initiate the xterm from the putty session. I removed the .Xauthority file on the remote site for sybase user but I still get the same error and the .Xauthority file is re-created.

Re: X tunneling

Zinky — Tue, 17 Jan 2006 09:31:08 GMT

If your sshd_config file indeed shows you have X11 Forwarding set to on (which the :10 in your echo of $DISPLAY indicates) -- then the problem may be exactly that.. your KeaX -- which DISPLAY is defaulted to :0. I wonder if KeaX has a facility for security to allow all acces for whatever DISPLAY instances -- i.e. :10 ?

Can you try:

ssh from your PC/Kea-X station as root
echo $DISPLAY
su - to Sybase
set DISPLAY to your PC/Kea-X machine's IP/DNS suffixed with :0.0
xterm

Also:

telnet (not PUTTY ssh) to the HP TX/VA machines as sybase
set DISPLAY to yourPC/Kea-X suffixed with :0.0
xterm

Re: X tunneling

Belinda Dermody — Tue, 17 Jan 2006 09:43:31 GMT

Kind of understand what you stated Nelson, but what I do not understand is

The echo $DISPLAY results on the local and the remote host are EXACTLY the same as the userid of root and sybase.

We do not have telnet active for connection to TX, I can only get to it via ssh connection.

Re: X tunneling

Zinky — Tue, 17 Jan 2006 09:57:24 GMT

"The echo $DISPLAY results on the local and the remote host are EXACTLY the same as the userid of root and sybase."

I am confused: when you say local - your VA HP-UX host? and remote means - your TX host? And this is with respect to your Kea-X pc?

Can you post exactly (cut and paste) the results of:

ssh to your TX or VA host as root
echo $DISPLAY
env |grep SSH

BTW, which node does IP 10.89.1.20 refer to? I don't think you've ever confirmed which machine is it.

Re: X tunneling

Belinda Dermody — Tue, 17 Jan 2006 11:21:47 GMT

Nelson, appreciate all your assistance in this matter, it is really driving me grayer and grayer.

Tahoe: /root ssh 10.89.1.20 echo $DISPLAY
198.212.9.19:10.0

Tahoe: /root ssh 10.89.1.20 env |grep SSH
SSH_CONNECTION=198.212.9.19 64702 10.89.1.20 22
SSH_CLIENT=198.212.9.19 64702 22
Tahoe: /root

OK the 10.89.1.20 is in TX, and the local host is here in VA on Tahoe (where the Kea-X is running.

Re: X tunneling

Zinky — Tue, 17 Jan 2006 11:47:25 GMT

James, I am a bit confused with your environment but I think we're closer.

"OK the 10.89.1.20 is in TX, and the local host is here in VA on Tahoe (where the Kea-X is running."

How do you establish your X-Windows environment via Kea-X? Correct me if I am wrong but it seems you:

Launch Kea-X on your PC (IP-?)
Connect (via SSH/Putty built into Kea-X?) to connect to your local host - TAHOE. xterm or Full CDE session.

Can you on Tahoe as root:

TAHOE:root# echo $DISPLAY

What does DISPLAY show?

From TAHOE, you ssh to that TX machine for which you get a DISPLAY of the TX machine with :20 - which is proof the TX machine has X11 forwarding.

Re: X tunneling

Belinda Dermody — Tue, 17 Jan 2006 12:13:40 GMT

Nelson, sorry. I launch Kea-X from my pc and it is straight X connection to tahoe and I log in. I shows up as a straight /bin/sh connection

as root on my Kea-X (tahoe) session
echo $DISPLAY
va6its202061.bcharrispub.com:0.0

from root on tahoe
# ssh 10.89.1.20 echo $DISPLAY
va6its202061.bcharrispub.com:0.0
#