X11 forwarding

[Heinz W Genhart]

Hi community

our customer will introduce more security. So we will put the production systems within a secured zone. The only way to access machines within the secured zone will be SSH. The zone is parted form the rest of the network by a Firewall.

We are using Windows(!) PC's with WRQ Reflection to access a administrator's OpenVMS machine within the secured zone. This is the only machine reachable from outside the zone (lets call this machine VMS1).

If I connect to VMS1 from my PC with reflection SSH, I can login and I can start a Motif application e.g. DECW$CLOCK, which then is displayed on my PC's screen. So far so good.

If I connect with SSH from VMS1 to another OpenVMS Machine within the secured zone and then try to start a Motif application, then I get the following error.

X connection to _WSA39: broken (explicit kill or server shutdown).
X Error of failed request: BadConnection (fatal error on display connection)
Major opcode of failed request: 1 (X_CreateWindow)
Serial number of failed request: 0
Current serial number in output stream: 0
%XLIB-E-ERROREVENT, error event received from server
Xlib: client uses different protocol version (11) than server (0)!
X Toolkit Error: Can't Open display
%DWT-F-NOMSG, Message number 03AB8204

If we replace VMS1 with a Solaris machine there is no problem to do the things described above.

Does somebody know how we can solve the problem with OpenVMS?

OpenVMS Version 7.3-2 with TCPIP V5.4 ECO 5

Thanks in advance

Heinz

[John Gillings]

Heinz,

> and then try to start a Motif
>application, then I get the following
>error.

What is your display set to? Is it set explicitly or does something try to figure out your ultimate source automatically (ie: the address of your PC)?

See what SHOW DISPLAY says, and what's different between VMS1 and Solaris.

X11 can be forwarded through a firewall. It usually uses port 6000.

[John Travell]

Are the VMS machines running the same version of DECwindows ? It certainly looks like the connection is not being setup correctly.
It looks to me like you are trying to go :-
PC to VMS1, display back to the PC (ok).
VMS1 to other_VMS, display back to PC (bad).
Can Other_VMS see your PC ?
If so, then you need to ensure that Other_VMS has the correct address to send the display back to.
If not, you would need VMS1 to act as a relay for the DECwindows traffic. Can VMS do this ? I don't know, but you certainly need to ensure that you fully understand what path the DECwindows traffic will need to follow to get back to your PC.
JT:

[Thomas Ritter]

This clue maybe useful

Xlib: client uses different protocol version (11) than server (0)!

Try on each vms host

$ ssh -h and check the version

From our host

dsa1:[sys0.syscommon.][sysexe]tcpip$ssh_ssh2.exe: SSH Secure Shell OpenVMS (V5.5) 3.2.0 on COMPAQ AlphaServer DS20E 666 MHz - VMS V7
.3-2
© Copyright 1976, 2003 Hewlett-Packard Development Company, L.P.
All rights reserved.

[Jansen_8]

There are several ways to have X display on a different machine. I have no idea which one you try:
1) just forwarding (default port 6000) by setting "SET DISPLAY/TRANS=tcpip/Node=VMS1/crea"
2) using DECNET by settting "SET DISPLAY/TRANS=DECNET/Node=VMS1/crea"
3) by tunneling through SSH. by making the connection to VMS with "SSH +x VMS1" or "SSH +X VMS1".

Option 3) has the advantage that only port 22 (SSH) should be open in the firewall.
I have no idea which option you tried.

You always have to check that for the machine who tries to open has the right to write to the X-session. (look for "security" in the X-session menus"

Jouk

[Heinz W Genhart]

Hi Community

Thanks for your answers, but I think I have to clarify some things:

We are in a Banking environment and the only protocols allowed are Secure Protocols.
The people which support the Operating System and the Applications are using PC's with Reflection X.
The PC's are located on a LAN segment which we call the administrating LAN

All the OpenVMS Machines (those with the application) are in a secure zone, secured by a firewall.
We have one and only one OpenVMS Machine in this secure zone to which we have access from the administrating LAN

PC with Reflection X
|
|
Firewall
|
|(SSH)
|
Access Machine (OpenVMS 7.3-2, TCPIP V5.4 ECO5, Motif 1.3-1)
|
|(SSH)
|
Production Machine (OpenVMS 7.3-2, TCPIP V5.4 ECO5, Motif 1.3-1)


On the PC I start a Reflection SSH Session to the access machine.

access_machine$ SHOW DISPLAY

Device: WSA17: [super]
Node: access_machine.domain
Transport: TCPIP
Server: 12
Screen: 0

If I start a DECWindows Application (e.g. DECW$CLOCK) now, it works fine, I see the clock on my PC's display.

I then connect by SSH from the access_machine to the production_machine

$ SSH production_machine
$ SHOW DISPLAY

Device: WSA1416: [user]
Node: production_machine.domain
Transport: TCPIP
Server: 11
Screen: 0

The display definition is correct. It will use port 6011 (6000+'server_number')
to connect to the SSH tunnel on the production_machine.

But if I start now a DECWindows Application I get the following error:
XIO: fatal IO error 65535 (network partner disconnected logical link) on X server "_WSA1416:"
after 0 requests (0 known processed) with 0 events remaining.


But I did some other tests too.

Instead to use our OpenVMS access_machine, I used the access machine of our Unix guys, which is a Sun Solaris box. Doing exactly same as described above, (but a Sun machine instead of an OpenVMS 7.3-2 machine as access_node) everything works fine!


Last but not least I tested the same thing, but I used an OpenVMS 8.2 machine as access_machine it does not work too, but I get a different error message which is:
X connection to _WSA40: broken (explicit kill or server shutdown).
X Error of failed request: BadConnection (fatal error on display connection)
Major opcode of failed request: 1 (X_CreateWindow)
Serial number of failed request: 0
Current serial number in output stream: 0
%XLIB-E-ERROREVENT, error event received from server
Xlib: client uses different protocol version (11) than server (0)!
X Toolkit Error: Can't Open display
%DWT-F-NOMSG, Message number 03AB8204


Something is wrong on OpenVMS, but what.

Another problem is, that my customer (I'm an external consultant) plans to migrate from OpenVMS to Red Hat! We are in a really critical situation. It's very important, that we can solve this problem (and some other problems too). If not, that would be another management argument for skipping OpenVMS out of the Bank as soon as possible!

Thanks for your help

Heinz

[Hoff]

The usual command from Mac OS X is ssh -X, and don't touch DISPLAY or DECW$DISPLAY or SET DISPLAY once you're logged into the remote node; the host node with the X Windows clients.

According to the OpenVMS ssh manual, -X and port forwarding isn't directly supported by the OpenVMS ssh client. Dig up AA-RVBUA-TE off the HP website for details, and for the sequence used to provide an equivalent of the ssh -X port forwarding.

Here's the URL to the manual:

h71000.www7.hp.com/doc/732FINAL/aa-rvbua-te/aa-rvbua-te.pdf

Looks to be Chapter 5, circa page 40.

[Wim Van den Wyngaert]

You can always try http://www.process.com/tcpip/ssh.html but that will cost you some money.

Wim

[Wim Van den Wyngaert]

I just tried the X11 tunnel based upon putty and multinet SSH. It works.

Start putty.
Enter the node name in 'Session' 'Host name'.
Activate "x11 forwarding" in "Connection" "SSH" "X11".
Enter your session manager startup command in "Connection" "SSH" "Remote command".

Now start reflection (I used kea!X) without starting something in the application manager (XDM disabled).

Then use button "Run" in putty. Within seconds the SM should appear.

Closing putty will close the session manager.

Wim

[Heinz W Genhart]

Hi community

using Process's TCPware is no option for us.
The HP implementation of SSH does not support X11 forwarding.
The problem become even worse, when different versions (V73.2 .. V8.3) are involved. It's a great pity that HP is using SSH2 instead of OpenSSH for it's SSH implementaion.

We solved the problem, by using a Sun Solaris box as access machine. On the PC we start a X11 Server (Reflection). Then we connect with (Putty or Reflection) SSH to the Solaris box and from there we use again SSH to the target OpenVMS machine. This way we are able to start a X11 Application on the VMS box which then will be displayed on the PC's X11 server.

Thanks for your help

Regards

Heinz