Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite
1

strange variation on the standard 'multi-hop tunnel' question.

I'm working remotely at the minute, but have several 'incoming' automatic reverse shells connecting to a dedicated server. This dedicated server does not have X, but several of the 'incoming' shell servers do.

Basically, take three machines, laptop, server, client. Laptop and client have X, server does not. All three machines have password-less logins to each other (laptop > server, server > client) and can password-lessly establish a shell.

I've tried ssh -X user@server "ssh -X user@client gui-application" and, no suprise, I'm getting 'Cannot open Display" messages.

Does anyone know I nice one-liner for this kind of tunnelling?

share|improve this question
This shouldn't depend on the remote site running X or not -- all you should need is a local X server. So could you explain your setup more clearly? What server do you connect to what (what is "automatic")? Is your local X server running when you open the tunnels? And how do you use your tunnels? – honk Jul 7 '10 at 4:34
the automatic is just that the servers are set up to re-establish the reverse shells if the connection drops/times out. Setup more clearly explained in update. – Andrew Bolster Jul 7 '10 at 5:35

3 Answers

up vote 2 down vote accepted

Your command actually works for me, so I don't think you need to do anything very different. However, I did find that it worked a lot more snappily if I used a -t option on the first ssh:

ssh -tX user@server "ssh -X user@client gui-application"

This seems to be something to do with ssh-agent and asking for a passphrase in my case, since my ssh keys are protected with passphrases. However, maybe it will help in your case too.

I also tried adding -A (agent forwarding) on both ssh commands, and this worked too, although with a delay of several seconds (not sure why). It came up with a GUI password dialog for the key for the hop from "server" to "client".

Remember that ssh with a command doesn't use .profile on the remote machine, so if you're relying on settings from there, that won't work, although you could probably run it explicitly with:

ssh -tX user@server ". .profile; ssh -X user@client gui-application"
share|improve this answer
up vote 1 down vote

Sounds like your hop server doesn't allow X Set 'X11Forwarding yes' in the /etc/ssh/sshd_config of your hop server (also don't forget to restart sshd after changing the settings.

share|improve this answer
up vote 0 down vote

Try punching straight through the first hop:

ssh -N -L 9999:client:22 user@server
ssh -p 9999 -X user@localhost gui-application

The first command will forward local port 9999 to the client's SSH port. Leave this command running - it won't produce output after you log in. The second command will SSH to your local port 9999, which is actually the "client" SSH port, and launch the GUI.

Take that for a spin.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.