| View previous topic :: View next topic |
| Author |
Message |
rogue
Tux's lil' helper
Joined: 15 May 2002
Posts: 99
Location: Falls Church, VA
|
 Posted: Wed Sep 10, 2003 7:14 pm Post subject: ssh X11 forwarding w/root problem |
 |
|
I have 2 gentoo boxes (grendel and hrothgar) and I want to be able to use X apps from one box on the other. I already have this working fine for the most part. I can ssh to hrothgar from grendel as a user and it will forward the X connection fine. The problem comes, however, if on hrothgar I then "su -" and switch to root. As root, I can no longer run any X apps and I get the error:
| Code: | X11 connection rejected because of wrong authentication.
X connection to localhost:11.0 broken (explicit kill or server shutdown). |
I think it might be because root doesn't have a .Xauthority file, but I'm not sure. Searching the forums didn't seem to help because most posts are concerned with just getting ssh X11 forwarding working the way I already have it working.
Anyone have any ideas?
_________________
(rob) |
|
| Back to top |
|
 |
sschlueter
Guru
Joined: 26 Jul 2002
Posts: 578
Location: Dortmund, Germany
|
| Posted: Wed Sep 10, 2003 9:24 pm Post subject: |
|
|
You can either log in as root directly, or if you don't want to be able to do this, you can log in as a user via ssh -X <user>@<server> and then ssh -X root@localhost. So root must be able lo log in from localhost but not from other hosts. If you like this nested-ssh-solution, you have to set up your sshd like this:
in /etc/ssh/sshd_config
| Code: |
PermitRootLogin yes
AllowUsers <user> <user2> root@127.0.0.1
|
PS.
I'm not sure why but the pam_xauth module doesn't work in this case. |
|
| Back to top |
|
|
rogue
Tux's lil' helper
Joined: 15 May 2002
Posts: 99
Location: Falls Church, VA
|
| Posted: Thu Sep 11, 2003 1:07 am Post subject: |
|
|
thanks.
pain in the ass that i can't just su from an existing ssh session, but i guess i don't need to be root often enough on that box so the extra hassle of opening another ssh session isn't too much of a big deal.
_________________
(rob) |
|
| Back to top |
|
|
christsong84
Veteran
Joined: 06 Apr 2003
Posts: 1003
Location: GMT-8 (Spokane)
|
| Posted: Thu Sep 11, 2003 5:56 am Post subject: |
|
|
| rogue wrote: | thanks.
pain in the ass that i can't just su from an existing ssh session, but i guess i don't need to be root often enough on that box so the extra hassle of opening another ssh session isn't too much of a big deal. |
as long as your user is part of the wheel group, you should technically be able to su just fine in ssh...at least I've had no problems. Everything I can do on the box itself I can do through ssh...just a thought.
_________________
while(true) {self.input(sugar);}  |
|
| Back to top |
|
|
rogue
Tux's lil' helper
Joined: 15 May 2002
Posts: 99
Location: Falls Church, VA
|
| Posted: Thu Sep 11, 2003 6:46 am Post subject: |
|
|
| christsong84 wrote: | | as long as your user is part of the wheel group, you should technically be able to su just fine in ssh...at least I've had no problems. Everything I can do on the box itself I can do through ssh...just a thought. |
my problem isn't being able to be root..that works fine..i can switch users at will.
the problem is, as root, i am not able to have X applications forwarded through a connection that was initiated by a non-root user.
for example:
| Code: | [02:44:05] rbattle@grendel rbattle $ ssh rbattle@hrothgar
Last login: Wed Sep 10 21:02:27 2003 from 192.168.0.114
[02:44:15] rbattle@hrothgar rbattle $ xload &
[1] 19415
[02:44:25] rbattle@hrothgar rbattle $ su -
Password:
[02:44:28] hrothgar root # xload
X11 connection rejected because of wrong authentication.
X connection to localhost:10.0 broken (explicit kill or server shutdown).
[02:44:29] hrothgar root # |
_________________
(rob) |
|
| Back to top |
|
|
m4chine
Apprentice
Joined: 12 Mar 2003
Posts: 271
Location: Ventura, CA, USA
|
| Posted: Mon Oct 20, 2003 12:46 am Post subject: |
|
|
I get the same error. I have been shelling into my server for a while, and running xmms through xforwarding on my laptop so i get display on it instead. Something must have changed and now i cannt xforward.
| Code: | sniped@mainframe sniped $ xmms
debug1: client_input_channel_open: ctype x11 rchan 2 win 65536 max 16384
debug1: client_request_x11: request from 127.0.0.1 38133
debug1: channel 1: new [x11]
debug1: confirm x11
X11 connection rejected because of wrong authentication.
debug1: channel 1: free: x11, nchannels 2
Gdk-ERROR **: X connection to localhost:10.0 broken (explicit kill or server shutdown). |
wierd, any suggestions welcomed.
_________________
never trust a man who can count to 1023 on his fingers.
-m4chine |
|
| Back to top |
|
|
m4chine
Apprentice
Joined: 12 Mar 2003
Posts: 271
Location: Ventura, CA, USA
|
| Posted: Mon Oct 20, 2003 1:12 am Post subject: |
|
|
Solved* the problem was that i wasnt forcefully useing ssh2 protocol on my client. My server was only allowing ssh2 due to security reasons, and my laptop was trying to use ssh1. Change whatever Protocol is set to in /etc/ssh/ssh_config to "Protocol 2". Again, this is on the client side.
_________________
never trust a man who can count to 1023 on his fingers.
-m4chine |
|
| Back to top |
|
|
Shiner_Man
Apprentice
Joined: 09 Mar 2004
Posts: 180
|
| Posted: Sat May 15, 2004 8:16 pm Post subject: |
|
|
I'm having the same issue here:
| Code: | [vince@home ~]# ssh vince@degoba
Password:
vince@Degoba vince $ su
Password:
root@Degoba vince # gtk-iptables
X11 connection rejected because of wrong authentication.
Gdk-ERROR **: X connection to localhost:10.0 broken (explicit kill or server shutdown).
root@Degoba vince #
|
I tried changing /etc/ssh/ssh_config to make sure protocol 2 was specified but that didn't work:
| Code: |
# Host *
# ForwardAgent no
ForwardX11 yes
# RhostsRSAAuthentication no
# RSAAuthentication yes
# PasswordAuthentication yes
# HostbasedAuthentication no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# Port 22
Protocol 2
# Cipher 3des
# Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
# EscapeChar ~
|
Any ideas as to why I can't forward X applications as root?
_________________
My Site |
|
| Back to top |
|
|
Regor
Guru
Joined: 06 Aug 2002
Posts: 545
Location: 39° 2' 48" N, 120° 59' 2" W
|
| Posted: Sun May 16, 2004 9:49 am Post subject: |
|
|
Give something like this a shot. This is taken from the /root/.bashrc of the machine I ssh into.
| Code: | if [ -f ~USER/.Xauthority ]
then
export XAUTHORITY=~USER/.Xauthority
export DISPLAY=localhost:10.0
fi |
Substitute both instances of "USER" with the username you ssh into.
_________________
Sometimes the appropriate response to reality is to go insane.
-Philip K. Dick, Valis |
|
| Back to top |
|
|
orionrobots
Apprentice
Joined: 07 Oct 2003
Posts: 289
Location: London, Uk
|
| Posted: Wed Jul 14, 2004 10:46 am Post subject: |
|
|
I wander if that script could be done in such a way that when a user(with the correct wheel authority) su'd in as root, the XUATHORITY was passed along with DISPLAY(which is already passed through).
Is there an arg to the su command to do this?
I know that the curent environment is passed through, but if you specify '-' then the root environment will replace it.
For now - I am happy to use Regors script - it works well enough..
_________________
Danny Staple, curator of http://orionrobots.co.uk
Adopt an unanswered post initiative https://forums.gentoo.org/search.php?search_id=unanswered |
|
| Back to top |
|
|
dju`
Retired Dev
Joined: 11 Feb 2003
Posts: 370
|
| Posted: Fri Nov 12, 2004 7:59 pm Post subject: |
|
|
| i would also be interested about a way to automatically set XAUTHORITY right. |
|
| Back to top |
|
|
Regor
Guru
Joined: 06 Aug 2002
Posts: 545
Location: 39° 2' 48" N, 120° 59' 2" W
|
| Posted: Fri Nov 12, 2004 10:37 pm Post subject: |
|
|
Not too long ago, I learned about x11-misc/sux, which - despite its name - most definately does not suck! It's an su wrapper that takes care of all the X authentication transfer for you. Check it out!
_________________
Sometimes the appropriate response to reality is to go insane.
-Philip K. Dick, Valis |
|
| Back to top |
|
|
abeowitz
n00b
Joined: 17 Mar 2003
Posts: 20
Location: Seattle
|
| Posted: Sun Nov 14, 2004 3:58 am Post subject: ssh DISPLAY="localhost:10.0" |
|
|
| step back on your PAM version. I emerged pam-0.77-r2.ebuild and did the etc-update and things work normally again. |
|
| Back to top |
|
|
L.U.
Tux's lil' helper
Joined: 28 Jun 2004
Posts: 119
Location: North Carolina, U.S.
|
| Posted: Sun Nov 14, 2004 4:45 am Post subject: |
|
|
Hello, I know next to nothing about this particular topic, and may just be wasting space here however; I saw this topic earlier today and I wandered if it might not be related.
https://forums.gentoo.org/viewtopic.php?t=249744
_________________
In linux, getting your computer to do what you want is a science. In windows, it's an art form... |
|
| Back to top |
|
|
|
Networking & Security
