X applications fail to run on ssh -X

On 08/14/2008 04:39 PM, TsanChung wrote:
> aix ssh daemon:
> $ ssh -v
> OpenSSH_3.9p1_CASPUR-K5/AFS-2, OpenSSL 0.9.7e 25 Oct 2004
>
> linux ssh client:
> # ssh -v
> OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006

Well, for a start if it was me I'd replace your current version of SSH
with Darren Tucker's OpenSSH 5.0p1 from http://dtucker.freeshell.org/ or
the one that IBM provides (OpenSSH-4.7) from
https://sourceforge.net/projects/openssh-aix/ . You simply install the
BFF with smitty and then 'startsrc -s sshd' should work. The one you
have does not seem to be SRC controlled.

You could also post the output of 'ssh -vvv TARGETHOST' in the hope that
someone can figure out the problem, to be honest I'm not even sure if
the version you're using provides X11 forwarding support at all.

AFAIK, all versions below 4.4 suffer from some type of real badness ->
CVE-2006-4924, CVE-2006-4925, CVE-2007-2243, CVE-2006-5051.

cheers
Niel

On 08/14/2008 06:57 PM, Jim Lahue wrote:
> Well, that'll teach me to talk about things that I don't do :-)
>
> So, I assume that the DISPLAY variable is supposed to be set up for him
> via SSH.
>
> Jim Lahue

You're right, and a really neat trick is that if you "chain" from the
first target host to some more target hosts using 'ssh -X' again, it
will be able to display the X11 of the final target locally.

Wonderful application...

Niel

On Aug 14, 5:01*pm, Niel Lambrechts wrote:
> On 08/14/2008 04:39 PM, TsanChung wrote:
>
> > aix ssh daemon:
> > $ ssh -v
> > OpenSSH_3.9p1_CASPUR-K5/AFS-2, OpenSSL 0.9.7e 25 Oct 2004
>
> > linux ssh client:
> > # ssh -v
> > OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006
>
> Well, for a start if it was me I'd replace your current version of SSH
> with Darren Tucker's OpenSSH 5.0p1 fromhttp://dtucker.freeshell.org/or
> the one that IBM provides (OpenSSH-4.7) fromhttps://sourceforge.net/projects/openssh-aix/. You simply install the
> BFF with smitty and then 'startsrc -s sshd' should work. The one you
> have does not seem to be SRC controlled.
>
> You could also post the output of 'ssh -vvv TARGETHOST' in the hope that
> someone can figure out the problem, to be honest I'm not even sure if
> the version you're using provides X11 forwarding support at all.
>
> AFAIK, all versions below 4.4 suffer from some type of real badness ->
> CVE-2006-4924, CVE-2006-4925, CVE-2007-2243, CVE-2006-5051.
>
> cheers
> Niel

The current sshd is at /usr/sbin.
I am a AIX newbie, how to install the IBM OpenSSH-4.7 to another
directory?
Even if any errors occur during installation, I can still use the old
sshd.

On 2008-08-14 14:10:09 +0100, TsanChung said:

> On Aug 14, 3:25*am, Frank Fegert wrote:
>> On 2008-08-13, TsanChung wrote:
>>
>>
>>
>>> I use "ssh -X" to login to a aix machine successfully.
>>> However X applications fail to run.
>>> Please help to solve this problem.
>>> local$ uname -a
>>> Linux linux1 2.6.18-1.2798.fc6 #1 SMP Mon Oct 16 14:54:20 EDT 2006
>>> i686 i686 i386 GNU/Linux
>>> local$ ssh -X -o StrictHostKeyChecking=no tw...@aix1.chrysalis-its.co
> m
>>> tw...@aix1.chrysalis-its.com's password:
>>> Last unsuccessful login: Fri Aug *8 10:50:29 CDT 2008 on ssh from
>>> 172.20.11.66
>>> Last login: Fri Aug *8 13:56:17 CDT 2008 on /dev/pts/5 from
>>> 172.20.11.66
>>> $ xterm
>>> xterm Xt error: Can't open display:
>>> $ xclock
>>> Error: Can't open display:
>>> $ uname -a
>>> AIX aix1 3 5 00CC111E4C00
>>
>> Are you sure X11 forwarding is enabled in the SSHD config?
>> Check for an entry like:
>> * X11Forwarding yes
>>
>> Regards,
>>
>> * * * * Frank
>
> # grep X11Forwarding /etc/ssh/sshd_config
> #X11Forwarding no
> X11Forwarding yes

There is one more thing you can. Use the -Y option on your ssh
connection. i.e ssh -Y -o StrictHostKeyChecking=no

-Y Enables trusted X11 forwarding. Trusted X11 forwardings are not
subjected to the X11 SECURITY extension controls.

This has worked for me when -X doesnt.
Hope this helps...

On Aug 16, 12:44*pm, vvisceroy wrote:
> On 2008-08-14 14:10:09 +0100, TsanChung said:
>
>
>
> > On Aug 14, 3:25*am, Frank Fegert wrote:
> >> On 2008-08-13, TsanChung wrote:
>
> >>> I use "ssh -X" to login to a aix machine successfully.
> >>> However X applications fail to run.
> >>> Please help to solve this problem.
> >>> local$ uname -a
> >>> Linux linux1 2.6.18-1.2798.fc6 #1 SMP Mon Oct 16 14:54:20 EDT 2006
> >>> i686 i686 i386 GNU/Linux
> >>> local$ ssh -X -o StrictHostKeyChecking=no tw...@aix1.chrysalis-its.co
> > m
> >>> tw...@aix1.chrysalis-its.com's password:
> >>> Last unsuccessful login: Fri Aug *8 10:50:29 CDT 2008 on ssh from
> >>> 172.20.11.66
> >>> Last login: Fri Aug *8 13:56:17 CDT 2008 on /dev/pts/5 from
> >>> 172.20.11.66
> >>> $ xterm
> >>> xterm Xt error: Can't open display:
> >>> $ xclock
> >>> Error: Can't open display:
> >>> $ uname -a
> >>> AIX aix1 3 5 00CC111E4C00
>
> >> Are you sure X11 forwarding is enabled in the SSHD config?
> >> Check for an entry like:
> >> * X11Forwarding yes
>
> >> Regards,
>
> >> * * * * Frank
>
> > # grep X11Forwarding /etc/ssh/sshd_config
> > #X11Forwarding no
> > X11Forwarding yes
>
> There is one more thing you can. Use the -Y option on your ssh
> connection. i.e ssh -Y -o StrictHostKeyChecking=no *
>
> * * *-Y * * *Enables trusted X11 forwarding. *Trusted X11 forwardings are not
> * * * * * * *subjected to the X11 SECURITY extension controls.
>
> This has worked for me when -X doesnt.
> Hope this helps...

It does not work even with "ssh -Y".
$ xclock
Error: Can't open display:

On Aug 19, 11:06*am, TsanChung wrote:
> On Aug 16, 12:44*pm, vvisceroy wrote:
>
>
>
> > On 2008-08-14 14:10:09 +0100, TsanChung said:
>
> > > On Aug 14, 3:25*am, Frank Fegert wrote:
> > >> On 2008-08-13, TsanChung wrote:
>
> > >>> I use "ssh -X" to login to a aix machine successfully.
> > >>> However X applications fail to run.
> > >>> Please help to solve this problem.
> > >>> local$ uname -a
> > >>> Linux linux1 2.6.18-1.2798.fc6 #1 SMP Mon Oct 16 14:54:20 EDT 2006
> > >>> i686 i686 i386 GNU/Linux
> > >>> local$ ssh -X -o StrictHostKeyChecking=no tw...@aix1.chrysalis-its.co
> > > m
> > >>> tw...@aix1.chrysalis-its.com's password:
> > >>> Last unsuccessful login: Fri Aug *8 10:50:29 CDT 2008 on ssh from
> > >>> 172.20.11.66
> > >>> Last login: Fri Aug *8 13:56:17 CDT 2008 on /dev/pts/5 from
> > >>> 172.20.11.66
> > >>> $ xterm
> > >>> xterm Xt error: Can't open display:
> > >>> $ xclock
> > >>> Error: Can't open display:
> > >>> $ uname -a
> > >>> AIX aix1 3 5 00CC111E4C00
>
> > >> Are you sure X11 forwarding is enabled in the SSHD config?
> > >> Check for an entry like:
> > >> * X11Forwarding yes
>
> > >> Regards,
>
> > >> * * * * Frank
>
> > > # grep X11Forwarding /etc/ssh/sshd_config
> > > #X11Forwarding no
> > > X11Forwarding yes
>
> > There is one more thing you can. Use the -Y option on your ssh
> > connection. i.e ssh -Y -o StrictHostKeyChecking=no *
>
> > * * *-Y * * *Enables trusted X11 forwarding. *Trusted X11forwardings are not
> > * * * * * * *subjected to the X11 SECURITY extension controls.
>
> > This has worked for me when -X doesnt.
> > Hope this helps...
>
> It does not work even with "ssh -Y".
> $ xclock
> Error: Can't open display:

What happens if you explicitly try to set it? e.g:

export DISPLAY=localhost:10.0
xclock

Regards,
Jon

On Aug 15, 2:39 am, TsanChung wrote:
> aix ssh daemon:
> $ ssh -v
> OpenSSH_3.9p1_CASPUR-K5/AFS-2, OpenSSL 0.9.7e 25 Oct 2004
>
> linux ssh client:
> # ssh -v
> OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006

root user ?
surely not!

On 2008-08-19, TsanChung wrote:
> It does not work even with "ssh -Y".
> $ xclock
> Error: Can't open display:

Please post the contents of the DISPLAY variable after the login
with "ssh -Y -X". Plus the output of "ssh -vvv -Y -X" might be
helpful.

Regards,

Frank

On Aug 20, 4:11*am, Frank Fegert wrote:
> On 2008-08-19, TsanChung wrote:
>
> > It does not work even with "ssh -Y".
> > $ xclock
> > Error: Can't open display:
>
> Please post the contents of the DISPLAY variable after the login
> with "ssh -Y -X". Plus the output of "ssh -vvv -Y -X" might be
> helpful.
>
> Regards,
>
> * * * * Frank

The output are as follows, please help:
$ ssh -vvv -Y -X aix1
OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to aix1 [172.20.9.210] port 22.
debug1: Connection established.
debug1: identity file /home/twong/.ssh/identity type -1
debug3: Not a RSA1 key file /home/twong/.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/twong/.ssh/id_rsa type 1
debug1: identity file /home/twong/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version
OpenSSH_3.9p1_CASPUR-K5/AFS-2
debug1: match: OpenSSH_3.9p1_CASPUR-K5/AFS-2 pat OpenSSH_3.*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.3
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-
hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-
cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-
cbc-at-lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-
cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-
cbc-at-lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
ripemd160-at-openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
ripemd160-at-openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib-at-openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib-at-openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-
hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-
cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc-at-lysator.liu.se,aes128-
ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-
cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc-at-lysator.liu.se,aes128-
ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
ripemd160-at-openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-
ripemd160-at-openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_init: found hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug2: mac_init: found hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 136/256
debug2: bits set: 485/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: filename /home/twong/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 33
debug3: check_host_in_hostfile: filename /home/twong/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 33
debug1: Host 'aix1' is known and matches the RSA host key.
debug1: Found key in /home/twong/.ssh/known_hosts:33
debug2: bits set: 513/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/twong/.ssh/identity ((nil))
debug2: key: /home/twong/.ssh/id_rsa (0x8ab3338)
debug2: key: /home/twong/.ssh/id_dsa ((nil))
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-with-mic,publickey,keyboard-
interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/twong/.ssh/identity
debug3: no such identity: /home/twong/.ssh/identity
debug1: Offering public key: /home/twong/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/twong/.ssh/id_dsa
debug3: no such identity: /home/twong/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
twong-at-aix1's password:
debug3: packet_send2: adding 64 (len 56 padlen 8 extra_pad 64)
debug2: we sent a password packet, wait for reply
debug1: Authentication succeeded (password).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Entering interactive session.
debug2: callback start
debug2: x11_get_proto: /usr/bin/xauth list :0 2>/dev/null
debug1: Requesting X11 forwarding with authentication spoofing.
debug2: channel 0: request x11-req confirm 0
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 0
debug3: tty_make_modes: ospeed 38400
debug3: tty_make_modes: ispeed 38400
debug3: tty_make_modes: 1 3
debug3: tty_make_modes: 2 28
debug3: tty_make_modes: 3 127
debug3: tty_make_modes: 4 21
debug3: tty_make_modes: 5 4
debug3: tty_make_modes: 6 0
debug3: tty_make_modes: 7 0
debug3: tty_make_modes: 8 17
debug3: tty_make_modes: 9 19
debug3: tty_make_modes: 10 26
debug3: tty_make_modes: 12 18
debug3: tty_make_modes: 13 23
debug3: tty_make_modes: 14 22
debug3: tty_make_modes: 18 15
debug3: tty_make_modes: 30 0
debug3: tty_make_modes: 31 0
debug3: tty_make_modes: 32 0
debug3: tty_make_modes: 33 0
debug3: tty_make_modes: 34 0
debug3: tty_make_modes: 35 0
debug3: tty_make_modes: 36 1
debug3: tty_make_modes: 37 0
debug3: tty_make_modes: 38 0
debug3: tty_make_modes: 39 0
debug3: tty_make_modes: 40 0
debug3: tty_make_modes: 41 0
debug3: tty_make_modes: 50 1
debug3: tty_make_modes: 51 1
debug3: tty_make_modes: 52 0
debug3: tty_make_modes: 53 1
debug3: tty_make_modes: 54 1
debug3: tty_make_modes: 55 1
debug3: tty_make_modes: 56 0
debug3: tty_make_modes: 57 0
debug3: tty_make_modes: 58 0
debug3: tty_make_modes: 59 1
debug3: tty_make_modes: 60 1
debug3: tty_make_modes: 61 1
debug3: tty_make_modes: 62 0
debug3: tty_make_modes: 70 1
debug3: tty_make_modes: 71 0
debug3: tty_make_modes: 72 1
debug3: tty_make_modes: 73 0
debug3: tty_make_modes: 74 0
debug3: tty_make_modes: 75 0
debug3: tty_make_modes: 90 1
debug3: tty_make_modes: 91 1
debug3: tty_make_modes: 92 0
debug3: tty_make_modes: 93 0
debug1: Sending environment.
debug3: Ignored env KDE_MULTIHEAD
debug3: Ignored env SSH_AGENT_PID
debug3: Ignored env HOSTNAME
debug3: Ignored env TERM
debug3: Ignored env SHELL
debug3: Ignored env HISTSIZE
debug3: Ignored env CATALINA_HOME
debug3: Ignored env GTK2_RC_FILES
debug3: Ignored env KDE_NO_IPV6
debug3: Ignored env GTK_RC_FILES
debug3: Ignored env GS_LIB
debug3: Ignored env WINDOWID
debug3: Ignored env QTDIR
debug3: Ignored env QTINC
debug3: Ignored env AXIS2_HOME
debug3: Ignored env ANT_HOME
debug3: Ignored env KDE_FULL_SESSION
debug3: Ignored env USER
debug3: Ignored env LS_COLORS
debug3: Ignored env SSH_AUTH_SOCK
debug3: Ignored env KDEDIR
debug3: Ignored env SESSION_MANAGER
debug3: Ignored env USERNAME
debug3: Ignored env XDG_CONFIG_DIRS
debug3: Ignored env KONSOLE_DCOP
debug3: Ignored env PATH
debug3: Ignored env DESKTOP_SESSION
debug3: Ignored env MAIL
debug3: Ignored env QT_IM_MODULE
debug3: Ignored env GDM_XSERVER_LOCATION
debug3: Ignored env KONSOLE_DCOP_SESSION
debug3: Ignored env PWD
debug3: Ignored env INPUTRC
debug3: Ignored env XMODIFIERS
debug3: Ignored env JAVA_HOME
debug1: Sending env LANG = en_US.UTF-8
debug2: channel 0: request env confirm 0
debug3: Ignored env KDE_IS_PRELINKED
debug3: Ignored env KDE_SESSION_UID
debug3: Ignored env GDMSESSION
debug3: Ignored env SSH_ASKPASS
debug3: Ignored env SHLVL
debug3: Ignored env HOME
debug3: Ignored env XCURSOR_THEME
debug3: Ignored env LOGNAME
debug3: Ignored env SNMP_PERSISTENT_DIR
debug3: Ignored env QTLIB
debug3: Ignored env DBUS_SESSION_BUS_ADDRESS
debug3: Ignored env CLASSPATH
debug3: Ignored env LESSOPEN
debug3: Ignored env DISPLAY
debug3: Ignored env GTK_IM_MODULE
debug3: Ignored env G_BROKEN_FILENAMES
debug3: Ignored env COLORTERM
debug3: Ignored env XAUTHORITY
debug3: Ignored env _
debug2: channel 0: request shell confirm 0
debug2: fd 3 setting TCP_NODELAY
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel 0: rcvd adjust 131072

Last unsuccessful login: Fri Aug 8 10:50:29 CDT 2008 on ssh from
172.20.11.66
Last login: Tue Aug 19 19:45:06 CDT 2008 on /dev/pts/6 from
172.20.11.66
bash$ set|grep DISPLAY
bash$ xclock
Error: Can't open display:
bash$

On 2008-08-20, TsanChung wrote:
> bash$ set|grep DISPLAY
> bash$ xclock
> Error: Can't open display:

There's your problem. DISPLAY should be automatically set so some-
thing like "localhost:$OFFSET.0" by SSHD. So either it doesn't get
set in the first place (no xauth or no X11Forwarding) or it's reset
by your environment. Check your .profile, .bashrc, etc. and make
sure DISPLAY is not unset/overwritten.

Regards,

Frank