topic Re: X authentication question (points!) in Operating System - HP-UX

X authentication question (points!)

Christian Deutsch_1 — Mon, 09 Jul 2007 07:41:10 GMT

Hi folks,

I have 2 servers behind a firewall, wall17.

HP-UX server has tunnelled X connection (ssh -X) to my X server (a VNC X server).

I want to display an xclock window from a Solaris server (solserv) on my (tunnelled) HP-UX server's display. I did: xhost solserv on the HP-UX server and set DISPLAY on solserv to point to the HP-UX server's display, but when I tried to open xclock I got:

"X11 connection rejected because of wrong authentication." in the HP-UX server's terminal.

Can someone explain to me how I can get authentication to work here?

Points will be awarded for all helpful answers!

Thanks, Christian

P.S.I really want to get this to work, so trying to use solserv's tunnelled X connection is not a good option for me unless you have an idea how I can really speed that connection up.

Re: X authentication question (points!)

Steven E. Protter — Mon, 09 Jul 2007 08:29:15 GMT

Shalom,

Ideas:

xhost +
# Maybe there is a name resolution issue.
Does the user exist on both systems?
# Maybe it really is an authentication issue.
Check the syslog on the Solaris system.
# Always helpful
See about compressing the data stream with solserv's tunnelled X solution.

SEP

Re: X authentication question (points!)

Christian Deutsch_1 — Mon, 09 Jul 2007 08:46:56 GMT

Shalom Steve,

syslog is empty.

But /var/adm/messages has:

Jul 6 11:27:01 tcsun15 sshd[566]: [ID 800047 auth.error] error: Bind to port 22 on :: failed: Address already in use.

But I couldn't figure out what that means.

In any event the solution for me for the time being was to download a new JRE version (1.6 vs. 1.4.2), maybe Java was the main problem anyway in my setup.

Thanks, Christian

Re: X authentication question (points!)

Ivan Ferreira — Mon, 09 Jul 2007 16:40:38 GMT

Normally, just by using ssh -X should be enough, no xhost or DISPLAY commands needed.

Check your X11Forwarding option in ssh config file.

Re: X authentication question (points!)

Ivan Ferreira — Mon, 09 Jul 2007 17:16:23 GMT

Also, check the permissions and ownership of your $HOME/.Xauthority file.

Re: X authentication question (points!)

Jov — Mon, 09 Jul 2007 18:09:27 GMT

Can you clarify in your setup tou have 2 servers (HP-UX and Solaris) or 3 Servers (HP-UX, Solaris and your X-Server)??

Assuming the former, the problem is you're using Ssh X forwarding and you're setting your display as if there is not Ssh X forwarding/tunnelling.

When Ssh X (or any form of) tunnelling is configured, you have to set your display to locahost:.

Check which port X forward port is configured to start at in your sshd.conf file on your HP-UX server, then set the display for it, then run xclock.

Jov

Re: X authentication question (points!)

Christian Deutsch_1 — Tue, 10 Jul 2007 01:54:09 GMT

Ivan, I'm not sure you took enough time to understand the problem, maybe I did not express myself clearly enough. Permissions for .Xauthority are 600 root: on both systems (I am root on both systems). X tunnelling works fine for both Solaris and HP-UX systems but I thought maybe network throughput is better on the HP-UX system, that was why I wanted to try using the X DISPLAY on the HP-UX system (which is actually tunnelled using ssh, there is no X server running on the HP-UX system).

Jov, your assumption was wrong, I have 2 servers, HP-UX and Solaris, and an X server which is on a third system (tunnelled through the firewall to the HP-UX server using ssh).

As I mentioned in my previous reply to this post, I "fixed" the problem for now by updating my Java version on the Solaris server so I'm not in urgent need of an answer to the "X11 connection rejected" question. I just thought maybe someone would know right away what the problem might be.

Re: X authentication question (points!)

Heironimus — Tue, 10 Jul 2007 10:06:50 GMT

If you have a connection to server1 with X forwarding your DISPLAY on server1 will usually be something like localhost:10.0. In that case you can not set your DISPLAY on another machine to server1:10.0 because the only forwarded X11 port will be on server1's loopback interface. Once you get ssh to forward on the external interface instead you'll have to export the xauth cookie on server1 and import it on server2 to grant server2 access to the fake X session ssh creates.

The basic idea of exporting your DISPLAY probably wouldn't have helped your problem anyway. Sending the display data directly from server2 to desktop or relaying through server1 will send the same amount of data over the wire, you just add a hop. Unless you're changing the network path in a significant way it would probably perform the same or slightly worse.

If network bandwidth really was the problem ssh compression might help. You could also tunnel a VNC client connection though ssh instead of the X connection, VNC sends less data than a native X11 client.

Re: X authentication question (points!)

Christian Deutsch_1 — Wed, 11 Jul 2007 01:30:30 GMT

Right on target, Heironimus, wonderful!

Thankyou!

On hpuxserv I did:

# xauth extract - hpuxserv:10.0 > /tmp/mitcookie.hpuxserv
# scp /tmp/mitcookie.hpuxserv solserv:/tmp

On solserv I did:

# xauth merge - < /tmp/mitcookie.hpuxserv
# DISPLAY=hpuxserv:10.0
# xclock