SSH forwarding X connection from 3rd host

[Alex Fournier]

Hi, I have my ssh setup in such a way that I can run a session and forward X for applications that run locally on the server to which my ssh connection is established.

What I would like to do is to have other servers use the fake display setup by sshd so that they can display to my laptop through the already established tunnel.

SSH client ---> Server A -------> Server B
SSH telnet
<-------
X to A:10.0

By setting X11UseLocalhost to no, I was expecting to be able to do this.

Unfortunately, when I start an app such as hpterm on server B with DISPLAY=ServerA:10.0, I get the following error:

X connection to ServerA:10.0 broken (explicit kill or server shutdown)

On ServerA, when running sshd with -d flag, I get the following upon running my app on ServerB:

debug1: channel 2: new [X11 connection from ServerB port 49180]
debug1: channel 2: open confirm rwindow 30000 rmax 16384
debug1: channel 2: rcvd close
debug1: channel 2: output open -> drain
debug1: channel 2: close_read
debug1: channel 2: input open -> closed
debug1: channel 2: obuf empty
debug1: channel 2: close_write
debug1: channel 2: output drain -> closed
debug1: channel 2: send close
debug1: channel 2: is dead
debug1: channel 2: garbage collecting
debug1: channel_free: channel 2: X11 connection from ServerB port 49180, nchannels 3

Any idea why this is happening and any suggestion to make this work?

[Massimo Bianchi]

You must forward the autentication agent, like this

ssh -t user@server ssh -A -g -t user@server2


I use similar settings to forward port for connecting to oracle behind firewalls.

Massimo

[Alex Fournier]

Here's what I found out about why this is happening:

When creating the fake local display on ServerA, sshd assigns a magic cookie to it. This cookie must be used by all clients to this fake X server. The cookie can be view by using "xauth list" in you ssh session to ServerA.

How to get it to work:
Add the cookie to the Xauthority file on ServerB so that it will use this cookie when connecting to the fake X server on ServerA. You can do this by using "xauth add" and using the cookie information retrieve from the "xauth list" done on ServerA.

Once this was done, applications running on ServerB were able to use the fake X server on ServerA and be forwarded for display on my laptop.

Alex

[Roger Crettol]

Hi !

I have been using a similar configuration with OpenSSH running on
(Linux) -> (HPUX-A) -> (HPUX-B)
and had no problems to run X apps on HPUX-B using the XServer on Linux.

Then I moved to a similar setup, with the middle host running the commercial SSH software, and I couldn't get HPUX-B to use the XServer on Linux.

I guess Massimo's reply would have helped me
.... grant him the due points.

-rg-