The players:

  • my home computer, running Linux with an X server running. (Call it HOME.)
  • a remote site, to which I can connect over the internet using a VPN. (SITE)
  • a Linux computer at the remote site, to which I can connect with ssh -X and nicely have X clients displaying on my local server. (MIDDLE)
  • a very old Irix machine (an Onyx) at the remote site, which has no SSH server (therefore I can't ssh -X to it), only an ssh client. (ONYX)


I need to run an X11 application on the ONYX machine, and see the GUI on HOME. I think I stumble upon xauth issues. Note that I have tried the obvious: I set DISPLAY to $ip_address_of_HOME_in_the_SITE_VPN:0, but the VPN server does not forward connection attempts to its clients, probably for security reasons.

So far

The current situation is:

  • ☑ HOME connects to SITE
  • ☑ A vncserver starts on MIDDLE:7
  • ☑ vncviewer on HOME connects to vncserver on MIDDLE
  • ☑ ONYX starts a forwarding ssh session to MIDDLE:
    ssh -TfN -L 6007: MIDDLE
  • DISPLAY=localhost:7 xclient on ONYX fails with
    Xlib: connection to "" refused by server

I do know that the forwarding (6007: succeeds.

A previous attempt was:

  • ☑ HOME connects to SITE
  • ☑ HOME connects to MIDDLE:
    ssh -X MIDDLE (xclock displays on HOME, DISPLAY is
  • ☑ ONYX starts an SSH tunnel to MIDDLE: ssh -TfN -L 6010: MIDDLE
  • DISPLAY= xclient fails with
    X connection to broken (explicit kill or server shutdown).
    while an error pops up in the MIDDLE session:
    X11 connection rejected because of wrong authentication.


How can I achieve my purpose?

  • I have attempted running xauth on ONYX, then generate . trusted (in the second case above), but I have the same dual error (one on ONYX, one on MIDDLE). – tzot May 7 '10 at 14:56

XDMCP. Configure ONYX to accept XDMCP connections, then bring up a SSH tunnel from HOME to MIDDLE. Connect Xnest or Xephyr to the local end of the SSH tunnel, and log into ONYX.

|improve this answer|||||
  • I'll try to read more on Xnest and Xephyr, because I don't have experience with these. I am not sure how the tunnel from HOME to MIDDLE should be set up, though. Also, if I configure ONYX to accept XDMCP connections, wouldn't that mean that on the ONYX graphical console I can log on to other systems (i.e the opposite from what I want)? – tzot May 7 '10 at 15:26
  • Honestly, I don't remember all the details. It's been so long since I've actually had to deal with XDMCP. – Ignacio Vazquez-Abrams May 7 '10 at 15:38

I managed to reach a solution using straight SSH tunnels (no -X option), plus some xauth fiddling:

  • HOME connects to SITE, telnet to ONYX
  • HOME ssh tunnel to MIDDLE:
    ssh -TfN -R 6010: MIDDLE
  • ONYX ssh tunnel to MIDDLE:
    ssh -TfN -L 6010: MIDDLE
  • HOME xauth nextract - $DISPLAY and copy the output
  • ONYX xauth nmerge - and paste the previous output
  • ONYX DISPLAY= xclient successful :)
|improve this answer|||||

You cannot use the localhost ( DISPLAY for an X client running on the ONYX box to display on the HOME box. You need the HOME IP address or hostname.

|improve this answer|||||
  • -1: You didn't notice the SSH tunnels, I'm afraid. Also, I've already attempted to set DISPLAY to IP_OF_HOME_THRU_VPN_ON_REMOTE_SITE:0, but the VPN server doesn't forward connections to the VPN clients, only from. – tzot May 7 '10 at 15:45
  • Actually, I did notice the tunnels. I saw no reason for their necessity. Regardless, localhost as the DISPLAY variable for a host without an X server running is incorrect. – mpez0 May 8 '10 at 2:22
  • localhost in the DISPLAY environment variable implies a TCP/IP connection; no host name at all implies a local UNIX socket. Given that there are many ways to forward TCP/IP sockets to remote machines (e.g. with ssh tunnels, which worked here; see my answer), what do you mean with your last part of your comment, “localhost as the DISPLAY variable for a host without an X server running is incorrect.”? Because reality disproves what you say, so it's incorrect itself. – tzot May 9 '10 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.