Setting $DISPLAY
variable to an IP address won't work unless you also run xhost
on the X server (which is the Pi, aka "Client Side") to add the remote host to the authorized hosts list. You will also need to generate an Xauthority
file using xauth generate
, copy that file to the server and add the token on the "Server Side" using xauth merge
. I think you will have to restart the X server on the Pi as well.
However, what you want most of the time is to use localhost forwarding, where $DISPLAY
is set to a local unix socket (e.g. localhost:10.0
). In this case, xauth
should be called to add the cookie which you get from ssh
on connection, and the most common reason why ssh
didn't do it for you automatically is that it hasn't receive the cookie in the first place.
Check ~/.ssh/rc
(or /etc/ssh/sshrc
if the first file doesn't exist) on the "Client Side": it must contain something equivalent to
echo add $DISPLAY $proto $cookie | xauth -q -
Note that equivalent doesn't imply any degree of similarity, e.g. xauth -q - << EOF $stuff EOF
could be equivalent.
If the xauth
command is there, then you likely didn't get the cookie. Verify that you have X11UseLocalhost=yes
on the "Server Side": most guides on setting the X11 forwarding simply assume it's there. You also need localhost
(and inet6:localhost
if you use IPv6) to be present in /etc/X0.hosts
on the "Client Side".
In any case, remember to set up pam_xauth
on the "Server Side" if you want to run GUI apps remotely as any user, not just the one you logged in with: make sure it is installed and edit /etc/pam.d/su
to add the line
session optional pam_xauth.so
P.S. There appear to be problems with pam_xauth
, as a workaround, you could add the following lines to ~/.bashrc
:
if [[ -n $SSH_CONNECTION ]]; then
sudo touch /root/.Xauthority
sudo xauth add $(xauth list | tail -1)
fi
This shares your Xorg cookie with a specific user (root
).
-X
and-Y
, it makes no sense. Do you haveForwardX11Trusted
insshd_config
? If not, I suggest you use only-Y
. If yes,-X
and-Y
are the same.