7

I'm ssh'd into a remote computer and xforwarding is working fine... but as soon as I "sudo su -" or "sudo su user2" it no longer Xforwards anything giving me the error:

X11 connection rejected because of wrong authentication.
xterm Xt error: Can't open display: localhost:10.0

Any Ideas?

Thanks

2
  • 1
    this is more due to X permissions than X forwarding -- the user you've logged into with SSH has permission to connect to the X display, but when you switch users with 'sudo' the user you're switching to doesn't have those permissions. Apr 15, 2010 at 0:54
  • There should be a work around though... I have root access, I should be able to run an X11-forwarded app as a different user. How do I get it to work?
    – Jarvin
    Apr 15, 2010 at 13:41

5 Answers 5

6
  1. Enable X-11 Forwarding in your client
  2. Log in as your normal user
  3. echo $DISPLAY to get the associated display
  4. xauth list, find the display number which corresponds with what you found in #3 and copy it
  5. Sudo to root xauth add <paste in what you copied from #4>
  6. Now you can execute commands as root and will be able to se the X11 Forwarding connection
5

Before you sudo, do this:

$ xauth extract /tmp/xauthstuff $DISPLAY

After you sudo, do this:

# xauth merge /tmp/xauthstuff

Does this work for you?

PS remember to rm /tmp/xauthstuff afterwards

3
  • 3
    I tried that command and it failed: $ xauth extract /tmp/xauthstuff $DISPLAY No matches found, authority file "/tmp/xauthstuff" not written Ideas?
    – djb
    Mar 31, 2011 at 13:07
  • What does echo $DISPLAY produce?
    – tzot
    Oct 3, 2012 at 20:57
  • DISPLAY has the value localhost:10.0
    – djb
    Nov 26, 2013 at 20:27
3

I don't have access to root account to do any of the above, so here is a work around that I used.

First, ssh to your account like you normally do and test everything is working.

ssh -Y <you>@<your_server>

I usually just fire up an XTerm to ensure I have connectivity. If all good, copy .XAuthority file that is in <you> home directory and put it in a public directory.

cp ~/.Xauthority /tmp/tempXAuth

Make sure you chmod 777 on that file in the public directory so that the sudo account can use it in the later step.

chmod 777 /tmp/tempXAuth

now sudo to the user you need to do work as

sudo su - <other_user>

once you are <other_user>, back up the existing .Xauthority and then copy the "good" one over.

cp ~/.Xauthority ~/.Xauthority.bak
cp /tmp/tempXAuth ~/.Xauthority

you should be able to run any X programs and have them authenticate with your current XServer session.

2

Before you sudo su user2 check the permissions on your $XAUTHORITY:
echo $XAUTHORITY
ls -l $XAUTHORITY


If after switching user you still reference the same $XAUTHORITY but have lost permissions to the file, then this will break X11 forwarding.
In my case a quick solution was to adjust the file permissions on the $XAUTHORITY file before switching user.

Keep in mind that if users you don't trust gain access to your $XAUTHORITY file this could be a security issue.

0

As the user that you normally log in as type:

cd

sudo cp .Xauthority /root/

Then you can switch to root using:

sudo su

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .