On the machine where Firefox will run and display (machine A), you need to:
- Specify which X server to connect to, e.g. set DISPLAY=:0.0 .
- Authenticate somehow to the X server. An easy way is to read the value of $XAUTHORITY in the X session and use the same one.
For example, in a terminal in the X session do:
$ echo $XAUTHORITY
/var/run/gdm/auth-for-ambro-j3bu8Q/database
Then from the SSH terminal, do, as the same user as the X session (otherwise use su):
DISPLAY=:0.0 XAUTHORITY=/var/run/gdm/auth-for-ambro-j3bu8Q/database firefox http://stackoverflow.com
You can have the value of $XAUTHORITY automatically written somewhere when you login. For example, create the following script ~/write-xauth (don't forget to chmod +x):
#!/bin/bash
touch "$HOME"/.saved-xauthority
chmod u=rw,g=,o= "$HOME"/.saved-xauthority
echo "$XAUTHORITY" > "$HOME"/.saved-xauthority
Then create an autostart file that will run the above script, ~/.config/autostart/save-xauthority.desktop :
[Desktop Entry]
Type=Application
Name=Save XAUTHORITY to .saved-xauthority
Exec=/home/<type_user>/write-xauth
Terminal=false
X-KDE-StartupNotify=false
StartupNotify=false
Once you have a shell on machine B (the machine on which firefox will not display), you just have to SSH to machine A (where firefox will run and will display) and run the firefox command I posted. It is possible to automate this into a script on machine B. You'll have use keys (rather than password) for SSH authentication to machine A. For example, see https://wiki.archlinux.org/index.php/SSH_Keys . This will allow you to ssh non-interactively without entering a password. Now you can run commands on machine A from machine B by typing:
ssh machineA command argument ...
In your case, you'd probably want to make a script on machineA for opening the Firefox window:
ssh machineA ./open_local_firefox http://whatever
And this script would look something like:
#!/bin/bash
export DISPLAY=:0.0
export XAUTHORITY=$(cat "$HOME"/.saved-xauthority)
firefox "$1" &>/dev/null 2>&1 &
It's worth noting that this setup will allow machine B to run anything on machine A as the user you're SSHing as. It's possible to limit this, but it's not easy. If you want to do this with SSH, sshd's ForceCommand option would probably help.
There are other ways of doing this of course, but it all boils down to running the 'firefox' command on machine A with the right environment vars (as shown above) as the right user. For example, you can set up an HTTP server and a script on machine A, such that a certain POST request will open that Firefox window. This is probably easier to secure than the SSH approach.
