ssh X11 forwarding issue

Question

I have put ForwardX11 in my ~/.ssh/config and then I start a X11 application like this:

ssh -f user@host 'someapp; sleep 1'

This works fine.

The application someapp has a button which opens a viewer application via a shell script viewer.sh. When I press the button the viewer comes up.

This is all good and as expected, but if I do

ssh -2 -f user@host 'someapp; sleep 1'

there's trouble. someapp starts very well, but if I click the button the viewer doesn't show up.

As the viewer is called via a shell script, I replaced the call with xclock and the situation was exactly the same - I think the viewer is not to blame. The situation is the same on Linux and AIX.

The reason I need -2 is that I finally want to use connection multiplexing and this does only work with version 2. The reason for the sleep 1 is that it didn't work otherwise;-)

To add more confusion, with

ssh -2 -f user@host 'xterm &; app; sleep 1'

the viewer works as long as the xterm is open. When I close xterm ssh -v outputs the following

debug1: channel 1: FORCE input drain
debug1: channel 0: free: client-session, nchannels 3
debug1: channel 1: free: x11, nchannels 2

and from that moment the viewer doesn't show when I press the button.

I also replaced the viewer application with a script that writes the $DISPLAY variable to a file. The variable is always set correctly.

"The reason I need -2" -- I hope you are not saying you would use SSH1 otherwise... — u1686_grawity, Nov 13 '09 at 13:07
@grawity: Oh my, people still use ftp where I come from... don't ask... — user1863, Nov 13 '09 at 14:48
@bbuser: FTP isn't that bad - widely supported, reliable, has SSL/TLS support, and so on. And SSH1 is considered obsolete almost everywhere. (But I'm not going to argue about this now.) — u1686_grawity, Nov 13 '09 at 15:41
@grawity: I agree, I just thought you were hinting at security issues in ssh1. — user1863, Nov 13 '09 at 15:47

score 2 · Answer 1 · answered Nov 30 '09 at 18:40

2

Have you tried ForwardX11Trusted instead of ForwardX11? ForwardX11Trusted is a newer options which allows "trusted" connections. This means that your local X server will let the remote connection do more.

This article discusses in more detail what's going on and what you might open yourself up to if you use this instead ForwardX11.

answered Nov 30 '09 at 18:40

Doug Harris

27,333
17
78
105

1

I tried *ForwardX11Trusted yes* in addition (not instead) of ForwardX11 yes. This is what I understand from the (very intersting) article you linked to. Sadly it didn´t change anything. – user1863 Dec 07 '09 at 09:44

score 2 · Accepted Answer · answered Dec 13 '09 at 18:56

The SSH connection you are initiating stays up only as long as:

The commands you've specified are running.
There are active X11 connections.

In your case, when you specify "someapp; sleep 1", this means that after "someapp" exits, there is a 1 second time window in which a new X11 connection must be established, before the connection is terminated.

SSH cannot know by itself when it should terminate, if someapp starts another application in the background, which will only later connect to the X display - hence you need to work out something to give it that information. Like a wrapper script that doesn't exit until the program spawned by the launcher exits.

Or just say "sleep 1day" and be happy.

Thank you Nakedible, that makes a lot of sense, and even better: It works:-) — user1863, Dec 14 '09 at 13:19

score 0 · Answer 3 · answered Nov 13 '09 at 19:40

0

You also have to enable AllowX11Forwarding on the server side. It might be, that this is not needed/used for SSH1.

For details see here

answered Nov 13 '09 at 19:40

Steffen

101
1

X11 forwarding is allowed on the server side, otherwise I would not get any X11 window on the client at all. The problem ist the child process that is spawned form the application. – user1863 Nov 16 '09 at 14:05

ssh X11 forwarding issue

3 Answers3