Open an X application going through many hoops (SSH, vpn etc)

Question

The players:

• my home computer, running Linux with an X server running. (Call it HOME.)
• a remote site, to which I can connect over the internet using a VPN. (SITE)
• a Linux computer at the remote site, to which I can connect with ssh -X and nicely have X clients displaying on my local server. (MIDDLE)
• a very old Irix machine (an Onyx) at the remote site, which has no SSH server (therefore I can't ssh -X to it), only an ssh client. (ONYX)

Purpose

I need to run an X11 application on the ONYX machine, and see the GUI on HOME. I think I stumble upon xauth issues. Note that I have tried the obvious: I set DISPLAY to $ip_address_of_HOME_in_the_SITE_VPN:0, but the VPN server does not forward connection attempts to its clients, probably for security reasons.

So far

The current situation is:

• ☑ HOME connects to SITE
• ☑ A vncserver starts on MIDDLE:7
• ☑ vncviewer on HOME connects to vncserver on MIDDLE
• ☑ ONYX starts a forwarding ssh session to MIDDLE:
  ssh -TfN -L 6007:127.0.0.1:6007 MIDDLE
• ☒ DISPLAY=localhost:7 xclient on ONYX fails with
  Xlib: connection to "127.0.0.1:7.0" refused by server

I do know that the forwarding (6007:127.0.0.1:6007) succeeds.

A previous attempt was:

• ☑ HOME connects to SITE
• ☑ HOME connects to MIDDLE:
  ssh -X MIDDLE (xclock displays on HOME, DISPLAY is 127.0.0.1:10)
• ☑ ONYX starts an SSH tunnel to MIDDLE: ssh -TfN -L 6010:127.0.0.1:6010 MIDDLE
• ☒ DISPLAY=127.0.0.1:10 xclient fails with
  X connection to 127.0.0.1:10.0 broken (explicit kill or server shutdown).
  while an error pops up in the MIDDLE session:
  X11 connection rejected because of wrong authentication.

Despair

How can I achieve my purpose?

Answer 1

XDMCP. Configure ONYX to accept XDMCP connections, then bring up a SSH tunnel from HOME to MIDDLE. Connect Xnest or Xephyr to the local end of the SSH tunnel, and log into ONYX.

Answer 2

I managed to reach a solution using straight SSH tunnels (no -X option), plus some xauth fiddling:

• HOME connects to SITE, telnet to ONYX
• HOME ssh tunnel to MIDDLE:
  ssh -TfN -R 6010:127.0.0.1:6000 MIDDLE
• ONYX ssh tunnel to MIDDLE:
  ssh -TfN -L 6010:127.0.0.1:6010 MIDDLE
• HOME xauth nextract - $DISPLAY and copy the output
• ONYX xauth nmerge - and paste the previous output
• ONYX DISPLAY=127.0.0.1:10 xclient successful :)

Answer 3

You cannot use the localhost (127.0.0.1) DISPLAY for an X client running on the ONYX box to display on the HOME box. You need the HOME IP address or hostname.