0

So here's my situation: I work for my school as a tech. One of our servers has a firewall problem and isn't accepting connections from outside the network.

I tried to SSH into one of the servers that IS working, and then SSH into the problem server from that using Mac's Terminal:

ssh -X11 -2 root@goodserver.domain.tld # runs some Linux (don't remember which distro)
ssh -X11 -2 root@badserver.domain.tld # runs Ubuntu 11.04

If I try to run nautilus, I get "X11 connection rejected because of wrong authentication." four times in a row, then "Could not parse arguments: Cannot open display:"

I could wait for IT to fix the firewall issue but I have some work I need to get done the sooner the better, and using the command line slows things down quite a bit.

Sidenote: I don't think goodserver has X11 installed.

Anarko_Bizounours
  • 966
  • 8
  • 20
Jake Petroules
  • 251
  • 3
  • 11
  • trying to use X11 over multiple ssh 'hops' won't work. –  Aug 02 '11 at 00:05
  • Aw. Well fortunately I just got our Lion server running so I can screen share to that and then `ssh -X11` to the other server from that. Post your comment as an answer and I'll accept it. – Jake Petroules Aug 02 '11 at 00:15
  • 1
    Never say never, @BCV. – womble Aug 02 '11 at 00:36
  • Are you sure the option is `-X11`? I always use `-X`. (And I just tried this, it seems to work. Of course, not with `root`.) (The `-X11` is about the same as `-X -1 -1`, and the `-1` you undo with `-2` afterwards.) – Paŭlo Ebermann Aug 02 '11 at 01:21

3 Answers3

4

Using ProxyCommand like @womble told you works. For me another way works, too. I also need to occasionally run remote X programs from a computer that's behind another server, so I need to connect from my laptop to a server and from there to my final destination. I do it like this:

ssh -YC me@myserver

and then from the server

ssh -YC me@myanothercomputer

So I use -YC instead of -X. Even the -Cis not needed, it's just compression, it helps me a bit if I'm behind a slow connection.

Janne Pikkarainen
  • 31,852
  • 4
  • 58
  • 81
  • some background: `-Y` means "trusted connection". X11 servers have extensions, like Xrandr. Some of these extensions can allow someone with X permissions to sniff local events (mouse movements, etc.) So these extensions are disabled by default unless `-Y` is used. On other ssh clients like Solaris', all connections are trusted so `-Y` doesn't exist. Personally, I've only ever needed this when running some Java apps. And in the OP's case I think vanilla `-X` would work if he had X installed on the middle server. But +1 – Michael Lowman Aug 02 '11 at 12:48
3

You can do this, but not the way you think. What you want to do is use the SSH ProxyCommand configuration option (see ssh_config(5) for examples) to allow you to make an SSH connection directly from your local machine to the destination, tunneling the SSH connection inside one or more other connections. You're not making multiple "hops", just a series of tunnels.

womble
  • 96,255
  • 29
  • 175
  • 230
1

Sidenote: I don't think goodserver has X11 installed.

I think this is the problem - ssh -X will try to forward any remote incoming X connections to the local X server, and this seems to be impossible if there is no local X library and such. (It might be that SSH actually uses the X library for the cookie rewriting.)

I just tried your commands, and it worked fine - but here the intermediate server had the X binaries, too. (It has no monitor, though.)

So, use the proposal by womble: use one SSH connection to goodserver, create a tunnel in this connection, and then run a second connection through this tunnel. (I normally do this using the JSch SSH client library for Java, but it is also possible with command line SSH.)

ssh -L localhost:2222:badserver:22 -N root@goodserver &
ssh -X -p 2222 root@localhost

You might need the -o NoHostAuthenticationForLocalHost=yes for the second command to avoid your SSH client to howl if you already have another key for localhost stored in your known hosts file.

Paŭlo Ebermann
  • 253
  • 1
  • 8