Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From my machine, I must connect through nodes A, B, and C, to reach target:

localhost -> A -> B -> C -> target

Machine A is configured to refuse X11 Forwarding, so I guess I shouldn't be able to open graphical interfaces via connections passing through ssh A.

However, setting up ~/.ssh/config file, and adding ProxyCommand's using netcat, I've been able to open a graphical application at target, simply executing ssh -XY target. The setup in ~/.ssh/config goes as follows:

Host A
    Hostname domainA
Host B
    Hostname domainB
    ProxyCommand ssh A nc %h %p
Host C
    Hostname domainC
    ProxyCommand ssh B nc %h %p
Host target
    Hostname domain-target
    ProxyCommand ssh C nc %h %p

The connection itself is working, and I'm very fine with that. Happens, though, I did not actually understand what is going on behind the curtains.

When I run ssh -XY target, what actually happens, and why is it I'm able to open GUI via this tunnel, even though host A does not allow X11 Forwarding?

I understand it's nice to show some effort, so here goes the farther I've been able to get, trying to understand the execution above. I have replaced target with TARGET, and host C with HOST_C.

$ ssh -vXY TARGET
OpenSSH_6.2p2, OpenSSL 1.0.1e 11 Feb 2013
debug1: Reading configuration data /home/rubens/.ssh/config
debug1: /home/rubens/.ssh/config line 20: Applying options for TARGET
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Executing proxy command: exec ssh HOST_C nc TARGET 22
debug1: permanently_drop_suid: 1000
debug1: identity file /home/rubens/.ssh/id_rsa type 1
debug1: identity file /home/rubens/.ssh/id_rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0,
    remote software version OpenSSH_5.9p1 Debian-5ubuntu1.1
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1.1 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: RSA (some numbers...)
debug1: Host 'TARGET' is known and matches the RSA host key.
debug1: Found key in /home/rubens/.ssh/known_hosts:51
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/rubens/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: Authentication succeeded (publickey).
Authenticated to TARGET (via proxy).
debug1: channel 0: new [client-session]
debug1: Requesting
debug1: Entering interactive session.
debug1: Requesting X11 forwarding with authentication spoofing.
Welcome to Ubuntu 12.04.2 LTS (GNU/Linux 3.2.0-48-generic x86_64)
$ # prompt, and I'm able to open graphical apps, like gkrellm

The connection seems to take place first with host C, that needs previous connections to take place (backward recursion stacking dependencies, and solving them in LIFO order).

At host A, which is the first level of connection, is the X11Forward permission applied? Or does it simply creates a tunnel of nc connections, until machine target, and returns an open socket I later use into something like:

ssh -XY (open socket resulting from connections A->B->C->target)

If so, is it fine I'm able to connect with X11Forwarding? Or maybe there is something wrong with host A's setup?

share|improve this question
up vote 1 down vote accepted

Host A does not forward X11 connections, host C does. You connect to host C and open an X11 application (client) that is then displayed on your local machine (server). The connection is passed through intermediate nodes A and B, but this is unrelated to the X forwarding which is set up between your local host and host C.

Note: You don't need netcat, since you use OpenSSH which has the -W option for that purpose.

share|improve this answer
+1 -W %h:%p instead of nc %h %p works just fine. Yet, I haven't got exactly what happens when I connect using ssh -XY target. Is the connection opened through the intermediate nodes, and a socket port is returned, to which I actually ssh (socket)? Or do the connections to hosts A, B, and C, before connecting to target, just perform authentications, without actually being part of the stack of packet exchanging (packet goes from localhost -> A -> B -> C -> target, or, after authentication, just localhost -> target)? – Rubens Aug 4 '13 at 23:36
The packets are passed through each intermediate node. – Marco Aug 4 '13 at 23:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.