Ssh – Loading GUI on host machine through SSH with X11 forwarding

forwardingsshx11

I've got applications on my host machine running fine by doing:

$ssh -X user@host
Welcome to host
$firefox

Firefox proceeds to run in client display from the host machine.

How do I get firefox to load on the host machine's display so I could remotely manage the host machine's running GUI applications? I need my application to load a GUI on a remote machine without walking to that machine or expecting the user to launch it.

EDIT: Firefox is just an example app, but I am using one machine to launch several trainer programs on remote machines. Each remote machine will be controlled by a different person.

Best Answer

[This is really a superuser.com question, since there's no programming involved.]

The -X flag to ssh is specifically for sending the display back to the machine you ssh'ed from. To display on the machine you're ssh'ed to, instead you'd set the DISPLAY environment variable to that machines display (probably ":0" but may vary depending on configuration, virtual terminals, etc.), and make sure you have the right authentication set up to talk to that display (see the Xsecurity man page for details).

Related Solutions

Linux – How to enable SSH X11 forwarding through additional server

There are several ways to do this, the one I prefer is to forward the ssh port:

First, connect to machine B and forward [localPort] to C:22 through B

A$ ssh -L [localPort]:C:22 B

Next, connect to C from A through this newly-created tunnel using [localPort], forwarding X11

A$ ssh -X -p [localPort] localhost

Now we can run X11 programs on C and have them display on A

C$ xclock

[localPort] can be any port that you are not already listening to on A, I often use 2222 for simplicity.

Ssh-agent forwarding and sudo to another user

As you mentioned, the environment variables are removed by sudo, for security reasons.

But fortunately sudo is quite configurable: you can tell it precisely which environment variables you want to keep thanks to the env_keep configuration option in /etc/sudoers.

For agent forwarding, you need to keep the SSH_AUTH_SOCK environment variable. To do so, simply edit your /etc/sudoers configuration file (always using visudo) and set the env_keep option to the appropriate users. If you want this option to be set for all users, use the Defaults line like this:

Defaults    env_keep+=SSH_AUTH_SOCK

man sudoers for more details.

You should now be able to do something like this (provided user1's public key is present in ~/.ssh/authorized_keys in user1@serverA and user2@serverB, and serverA's /etc/sudoers file is setup as indicated above):

user1@mymachine> eval `ssh-agent`  # starts ssh-agent
user1@mymachine> ssh-add           # add user1's key to agent (requires pwd)
user1@mymachine> ssh -A serverA    # no pwd required + agent forwarding activated
user1@serverA> sudo su - user2     # sudo keeps agent forwarding active :-)
user2@serverA> ssh serverB         # goto user2@serverB w/o typing pwd again...
user2@serverB>                     # ...because forwarding still works

Best Answer

Related Solutions

Linux – How to enable SSH X11 forwarding through additional server

Ssh-agent forwarding and sudo to another user

Related Topic