check that /etc/ssh/sshd_config has "X11Forwarding yes" set. mh On Tue, Oct 2, 2012 at 11:48 AM, Steve La Rocque <slarocque [ at ] gmail [ dot ] com>wrote: > Hi everyone. For years, I've been using ssh -X just fine to connect to > our various remote machines and interact with X applications on the > remote machines via the display in front of me, but recently I installed > a fresh CentOS 6.3 x64 on real hardware and it isn't working. The > DISPLAY environment variable is never populated on the connected session > and even manually setting it fails. > > "hope" is my local machine, "dy" is an established CentOS 5.x machine > that works fine and "dz" is the problematic one. > > dz was installed with "X Windows System" and indeed on the console, X > works just fine and I have a Gnome desktop too. > > [larocque@hope ~]$ echo $DISPLAY > :0 > [larocque@hope ~]$ > [larocque@hope ~]$ ssh -Xvv root [ at ] dz [ dot ] cms [ dot ] math [ dot ] ca > OpenSSH_5.6p1, OpenSSL 1.0.0j-fips 10 May 2012 > debug1: Reading configuration data /home/larocque/.ssh/config > debug1: Reading configuration data /etc/ssh/ssh_config > debug1: Applying options for * > debug2: ssh_connect: needpriv 0 > debug1: Connecting to dz.cms.math.ca [10.5.7.201] port 22. > debug1: Connection established. > debug1: identity file /home/larocque/.ssh/id_rsa type -1 > debug1: identity file /home/larocque/.ssh/id_rsa-cert type -1 > debug1: identity file /home/larocque/.ssh/id_dsa type -1 > debug1: identity file /home/larocque/.ssh/id_dsa-cert type -1 > debug1: Remote protocol version 2.0, remote software version > OpenSSH_5.3 > debug1: match: OpenSSH_5.3 pat OpenSSH* > debug1: Enabling compatibility mode for protocol 2.0 > debug1: Local version string SSH-2.0-OpenSSH_5.6 > debug2: fd 3 setting O_NONBLOCK > debug1: SSH2_MSG_KEXINIT sent > debug1: SSH2_MSG_KEXINIT received > debug2: kex_parse_kexinit: > > diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 > debug2: kex_parse_kexinit: > ssh-rsa-cert-v01 [ at ] openssh [ dot ] com,ssh-dss-cert-v01 [ at ] openssh [ dot ] com, > ssh-rsa-cert-v00 [ at ] openssh [ dot ] com,ssh-dss-cert-v00 [ at ] openssh [ dot ] com,ssh-rsa,ssh-dss > debug2: kex_parse_kexinit: > > aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour, > rijndael-cbc [ at ] lysator [ dot ] liu [ dot ] se > debug2: kex_parse_kexinit: > > aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour, > rijndael-cbc [ at ] lysator [ dot ] liu [ dot ] se > debug2: kex_parse_kexinit: > hmac-md5,hmac-sha1,umac-64 [ at ] openssh [ dot ] com,hmac-ripemd160, > hmac-ripemd160 [ at ] openssh [ dot ] com,hmac-sha1-96,hmac-md5-96 > debug2: kex_parse_kexinit: > hmac-md5,hmac-sha1,umac-64 [ at ] openssh [ dot ] com,hmac-ripemd160, > hmac-ripemd160 [ at ] openssh [ dot ] com,hmac-sha1-96,hmac-md5-96 > debug2: kex_parse_kexinit: none,zlib [ at ] openssh [ dot ] com,zlib > debug2: kex_parse_kexinit: none,zlib [ at ] openssh [ dot ] com,zlib > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: first_kex_follows 0 > debug2: kex_parse_kexinit: reserved 0 > debug2: kex_parse_kexinit: > > diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 > debug2: kex_parse_kexinit: ssh-rsa,ssh-dss > debug2: kex_parse_kexinit: > > aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour, > rijndael-cbc [ at ] lysator [ dot ] liu [ dot ] se > debug2: kex_parse_kexinit: > > aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour, > rijndael-cbc [ at ] lysator [ dot ] liu [ dot ] se > debug2: kex_parse_kexinit: > hmac-md5,hmac-sha1,umac-64 [ at ] openssh [ dot ] com,hmac-ripemd160, > hmac-ripemd160 [ at ] openssh [ dot ] com,hmac-sha1-96,hmac-md5-96 > debug2: kex_parse_kexinit: > hmac-md5,hmac-sha1,umac-64 [ at ] openssh [ dot ] com,hmac-ripemd160, > hmac-ripemd160 [ at ] openssh [ dot ] com,hmac-sha1-96,hmac-md5-96 > debug2: kex_parse_kexinit: none,zlib [ at ] openssh [ dot ] com > debug2: kex_parse_kexinit: none,zlib [ at ] openssh [ dot ] com > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: > debug2: kex_parse_kexinit: first_kex_follows 0 > debug2: kex_parse_kexinit: reserved 0 > debug2: mac_setup: found hmac-md5 > debug1: kex: server->client aes128-ctr hmac-md5 none > debug2: mac_setup: found hmac-md5 > debug1: kex: client->server aes128-ctr hmac-md5 none > debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent > debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP > debug2: dh_gen_key: priv key bits set: 129/256 > debug2: bits set: 513/1024 > debug1: SSH2_MSG_KEX_DH_GEX_INIT sent > debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY > debug1: Host 'dz.cms.math.ca' is known and matches the RSA host key. > debug1: Found key in /home/larocque/.ssh/known_hosts:153 > debug2: bits set: 533/1024 > debug1: ssh_rsa_verify: signature correct > debug2: kex_derive_keys > debug2: set_newkeys: mode 1 > debug1: SSH2_MSG_NEWKEYS sent > debug1: expecting SSH2_MSG_NEWKEYS > debug2: set_newkeys: mode 0 > debug1: SSH2_MSG_NEWKEYS received > debug1: Roaming not allowed by server > debug1: SSH2_MSG_SERVICE_REQUEST sent > debug2: service_accept: ssh-userauth > debug1: SSH2_MSG_SERVICE_ACCEPT received > debug2: key: general ssh key for larocque at CMS > (larocque [ at ] cms [ dot ] math [ dot ] ca) (0x7f599d07efb0) > debug2: key: /home/larocque/.ssh/id_rsa ((nil)) > debug2: key: /home/larocque/.ssh/id_dsa ((nil)) > debug1: Authentications that can continue: > publickey,gssapi-keyex,gssapi-with-mic,password > debug1: Next authentication method: gssapi-keyex > debug1: No valid Key exchange context > debug2: we did not send a packet, disable method > debug1: Next authentication method: gssapi-with-mic > debug1: Unspecified GSS failure. Minor code may provide more > information > Credentials cache file '/tmp/krb5cc_500' not found > > debug1: Unspecified GSS failure. Minor code may provide more > information > Credentials cache file '/tmp/krb5cc_500' not found > > debug1: Unspecified GSS failure. Minor code may provide more > information > > > debug1: Unspecified GSS failure. Minor code may provide more > information > > > debug2: we did not send a packet, disable method > debug1: Next authentication method: publickey > debug1: Offering RSA public key: general ssh key for larocque at CMS > (larocque [ at ] cms [ dot ] math [ dot ] ca) > debug2: we sent a publickey packet, wait for reply > debug1: Server accepts key: pkalg ssh-rsa blen 646 > debug2: input_userauth_pk_ok: SHA1 fp > 9c:0c:da:c8:f0:4f:64:cd:59:27:d3:3f:a4:72:c2:fd:cc:63:9b:83 > debug1: Authentication succeeded (publickey). > Authenticated to dz.cms.math.ca ([10.5.7.201]:22). > debug1: channel 0: new [client-session] > debug2: channel 0: send open > debug1: Requesting no-more-sessions [ at ] openssh [ dot ] com > debug1: Entering interactive session. > debug2: callback start > debug2: x11_get_proto: /usr/bin/xauth list :0 2>/dev/null > debug1: Requesting X11 forwarding with authentication spoofing. > debug2: channel 0: request x11-req confirm 0 > debug2: client_session2_setup: id 0 > debug2: channel 0: request pty-req confirm 1 > debug1: Sending environment. > debug1: Sending env XMODIFIERS = @im=none > debug2: channel 0: request env confirm 0 > debug1: Sending env LANG = en_CA.utf8 > debug2: channel 0: request env confirm 0 > debug2: channel 0: request shell confirm 1 > debug2: fd 3 setting TCP_NODELAY > debug2: callback done > debug2: channel 0: open confirm rwindow 0 rmax 32768 > debug2: channel_input_status_confirm: type 99 id 0 > debug2: PTY allocation request accepted on channel 0 > debug2: channel 0: rcvd adjust 2097152 > debug2: channel_input_status_confirm: type 99 id 0 > debug2: shell request accepted on channel 0 > Last login: Tue Oct 2 11:40:38 2012 from hope.ott.cms > [root@dz ~]# > [root@dz ~]# > [root@dz ~]# > [root@dz ~]# > [root@dz ~]# echo $DISPLAY > > [root@dz ~]# xclock > Error: Can't open display: > [root@dz ~]# > [root@dz ~]# > [root@dz ~]# > [root@dz ~]# > [root@dz ~]# grep X /etc/ssh/*_config > /etc/ssh/ssh_config:# ForwardX11 no > /etc/ssh/ssh_config:# If this option is set to yes then remote X11 > clients will have full access > /etc/ssh/ssh_config:# to the original X11 display. As virtually no > X11 client supports the untrusted > /etc/ssh/ssh_config: ForwardX11Trusted yes > /etc/ssh/ssh_config: SendEnv XMODIFIERS > /etc/ssh/sshd_config:AcceptEnv XMODIFIERS > /etc/ssh/sshd_config:#X11Forwarding no > /etc/ssh/sshd_config:X11Forwarding yes > /etc/ssh/sshd_config:#X11DisplayOffset 10 > /etc/ssh/sshd_config:#X11UseLocalhost yes > /etc/ssh/sshd_config:# X11Forwarding no > [root@dz ~]# > [root@dz ~]# > [root@dz ~]# > [root@dz ~]# rpm -qa|grep -i x11|sort > ConsoleKit-x11-0.4.1-3.el6.x86_64 > dbus-x11-1.2.24-7.el6_3.x86_64 > libX11-1.3-2.el6.x86_64 > libX11-common-1.3-2.el6.noarch > pulseaudio-module-x11-0.9.21-14.el6_3.x86_64 > qt-x11-4.6.2-24.el6.x86_64 > xorg-x11-apps-7.4-10.el6.x86_64 > xorg-x11-drivers-7.3-13.3.el6.x86_64 > xorg-x11-drv-acecad-1.5.0-3.el6.x86_64 > xorg-x11-drv-aiptek-1.4.1-2.el6.x86_64 > xorg-x11-drv-apm-1.2.3-2.el6.x86_64 > xorg-x11-drv-ast-0.91.10-1.el6.x86_64 > xorg-x11-drv-ati-6.14.2-9.el6.x86_64 > xorg-x11-drv-ati-firmware-6.14.2-9.el6.noarch > xorg-x11-drv-cirrus-1.3.2-2.el6.x86_64 > xorg-x11-drv-dummy-0.3.4-1.el6.x86_64 > xorg-x11-drv-elographics-1.3.0-2.el6.x86_64 > xorg-x11-drv-evdev-2.6.0-2.el6.x86_64 > xorg-x11-drv-fbdev-0.4.2-2.el6.x86_64 > xorg-x11-drv-fpit-1.4.0-2.el6.x86_64 > xorg-x11-drv-glint-1.2.5-1.el6.x86_64 > xorg-x11-drv-hyperpen-1.4.1-2.el6.x86_64 > xorg-x11-drv-i128-1.3.4-1.el6.x86_64 > xorg-x11-drv-i740-1.3.2-2.el6.x86_64 > xorg-x11-drv-intel-2.16.0-4.el6.x86_64 > xorg-x11-drv-keyboard-1.6.0-1.el6.x86_64 > xorg-x11-drv-mach64-6.9.0-1.el6.x86_64 > xorg-x11-drv-mga-1.4.13-7.el6.x86_64 > xorg-x11-drv-mouse-1.7.0-4.el6.x86_64 > xorg-x11-drv-mutouch-1.3.0-2.el6.x86_64 > xorg-x11-drv-nouveau-0.0.16-13.20110719gitde9d1ba.el6.x86_64 > xorg-x11-drv-nv-2.1.18-2.el6.x86_64 > xorg-x11-drv-openchrome-0.2.904-4.el6.x86_64 > xorg-x11-drv-penmount-1.5.0-2.el6.x86_64 > xorg-x11-drv-qxl-0.0.14-13.el6_2.x86_64 > xorg-x11-drv-r128-6.8.1-3.el6.x86_64 > xorg-x11-drv-rendition-4.2.4-1.el6.x86_64 > xorg-x11-drv-s3virge-1.10.4-2.el6.x86_64 > xorg-x11-drv-savage-2.3.2-1.el6.x86_64 > xorg-x11-drv-siliconmotion-1.7.5-1.el6.x86_64 > xorg-x11-drv-sis-0.10.3-1.el6.x86_64 > xorg-x11-drv-sisusb-0.9.4-1.el6.x86_64 > xorg-x11-drv-synaptics-1.4.1-3.el6.x86_64 > xorg-x11-drv-tdfx-1.4.3-2.el6.x86_64 > xorg-x11-drv-trident-1.3.4-1.el6.x86_64 > xorg-x11-drv-v4l-0.2.0-4.el6.x86_64 > xorg-x11-drv-vesa-2.3.0-2.el6.x86_64 > xorg-x11-drv-vmmouse-12.7.0-1.el6.x86_64 > xorg-x11-drv-vmware-11.0.3-1.el6.x86_64 > xorg-x11-drv-void-1.4.0-1.el6.x86_64 > xorg-x11-drv-voodoo-1.2.4-1.el6.x86_64 > xorg-x11-drv-wacom-0.13.0-6.el6.x86_64 > xorg-x11-drv-xgi-1.6.0-11.el6.x86_64 > xorg-x11-font-utils-7.2-11.el6.x86_64 > xorg-x11-server-common-1.10.6-1.el6.centos.x86_64 > xorg-x11-server-utils-7.5-5.2.el6.x86_64 > xorg-x11-server-Xorg-1.10.6-1.el6.centos.x86_64 > xorg-x11-utils-7.4-8.el6.x86_64 > xorg-x11-xauth-1.0.2-7.1.el6.x86_64 > xorg-x11-xinit-1.0.9-13.el6.x86_64 > xorg-x11-xkb-utils-7.4-6.el6.x86_64 > [root@dz ~]# > > > Oddly, as you can see above, SSH seems to properly negotiate the X11 > Forwarding, yet I still have no DISPLAY. I compared the ssh -vv output > between hope and dy to the one shown above between hope and dz and they > match very closely, but only the dy destination actually gives me the > DISPLAY setting and properly forwards X11. > > I tried "ssh -Y" rather than "ssh -X" but got the same symptom. > > I also tried clearing IP tables entirely. > > > What should I try next, oh wizards? > > -Steve > > > > > _______________________________________________ > Linux mailing list > Linux [ at ] lists [ dot ] oclug [ dot ] on [ dot ] ca > http://oclug.on.ca/mailman/listinfo/linux > -- Martin Hicks P.Eng. | mort [ at ] bork [ dot ] org Bork Consulting Inc. | +1 (613) 266-2296