3

I have a raspberry pi 4 (4gb) as my local machine and am trying to ssh in to an ubuntu laptop with X11 forwarding.

I can connect just fine but I have the classic empty $DISPLAY variable and I'm not sure why. -X and -Y flags don't help.

Additionally, when I try to connect with ssh -v -X -Y user@host I don't see the expected debugging message about "Requesting X11 forwarding". Also, even if I set the $DISPLAY variable manually:

DISPLAY=<raspberrypi_ip>:0

I still receive the following when ssh into the server and trying to run xclock

xclock
Error: Can't open display:

Here are some details

Server side (ubuntu laptop)

/etc/ssh/sshd_config

X11Forwarding yes
X11DisplayOffset 10

which xauth

/usr/bin/xauth

Client Side (raspberry pi)

~/.ssh/config

ForwardX11 yes
ForwardAgent yes
1
  • 1
    Don't use both -X and -Y, it makes no sense. Do you have ForwardX11Trusted in sshd_config? If not, I suggest you use only -Y. If yes, -X and -Y are the same. Jul 10, 2020 at 9:16

1 Answer 1

3

Setting $DISPLAY variable to an IP address won't work unless you also run xhost on the X server (which is the Pi, aka "Client Side") to add the remote host to the authorized hosts list. You will also need to generate an Xauthority file using xauth generate, copy that file to the server and add the token on the "Server Side" using xauth merge. I think you will have to restart the X server on the Pi as well.

However, what you want most of the time is to use localhost forwarding, where $DISPLAY is set to a local unix socket (e.g. localhost:10.0). In this case, xauth should be called to add the cookie which you get from ssh on connection, and the most common reason why ssh didn't do it for you automatically is that it hasn't receive the cookie in the first place.

Check ~/.ssh/rc (or /etc/ssh/sshrc if the first file doesn't exist) on the "Client Side": it must contain something equivalent to

echo add $DISPLAY $proto $cookie | xauth -q -

Note that equivalent doesn't imply any degree of similarity, e.g. xauth -q - << EOF $stuff EOF could be equivalent.

If the xauth command is there, then you likely didn't get the cookie. Verify that you have X11UseLocalhost=yes on the "Server Side": most guides on setting the X11 forwarding simply assume it's there. You also need localhost (and inet6:localhost if you use IPv6) to be present in /etc/X0.hosts on the "Client Side".

In any case, remember to set up pam_xauth on the "Server Side" if you want to run GUI apps remotely as any user, not just the one you logged in with: make sure it is installed and edit /etc/pam.d/su to add the line

session optional pam_xauth.so

P.S. There appear to be problems with pam_xauth, as a workaround, you could add the following lines to ~/.bashrc:

if [[ -n $SSH_CONNECTION ]]; then
    sudo touch /root/.Xauthority
    sudo xauth add $(xauth list | tail -1)
fi

This shares your Xorg cookie with a specific user (root).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.