$DISPLAY variable to an IP address won't work unless you also run
xhost on the X server (which is the Pi, aka "Client Side") to add the remote host to the authorized hosts list. You will also need to generate an
Xauthority file using
xauth generate, copy that file to the server and add the token on the "Server Side" using
xauth merge. I think you will have to restart the X server on the Pi as well.
However, what you want most of the time is to use localhost forwarding, where
$DISPLAY is set to a local unix socket (e.g.
localhost:10.0). In this case,
xauth should be called to add the cookie which you get from
ssh on connection, and the most common reason why
ssh didn't do it for you automatically is that it hasn't receive the cookie in the first place.
/etc/ssh/sshrc if the first file doesn't exist) on the "Client Side": it must contain something equivalent to
echo add $DISPLAY $proto $cookie | xauth -q -
Note that equivalent doesn't imply any degree of similarity, e.g.
xauth -q - << EOF $stuff EOF could be equivalent.
xauth command is there, then you likely didn't get the cookie. Verify that you have
X11UseLocalhost=yes on the "Server Side": most guides on setting the X11 forwarding simply assume it's there. You also need
inet6:localhost if you use IPv6) to be present in
/etc/X0.hosts on the "Client Side".
In any case, remember to set up
pam_xauth on the "Server Side" if you want to run GUI apps remotely as any user, not just the one you logged in with: make sure it is installed and edit
/etc/pam.d/su to add the line
session optional pam_xauth.so
P.S. There appear to be problems with
pam_xauth, as a workaround, you could add the following lines to
if [[ -n $SSH_CONNECTION ]]; then
sudo touch /root/.Xauthority
sudo xauth add $(xauth list | tail -1)
This shares your Xorg cookie with a specific user (