RE: question about x11 forwarding in ssh

From: Bryan McAninch (bryan_at_mcaninch.org)
Date: 09/23/05

  • Next message: Robert Hajime Lanning: "Re: question about x11 forwarding in ssh" 
    To: <secureshell@securityfocus.com>
Date: Thu, 22 Sep 2005 19:45:03 -0500

    You are correct, X need not listen on 6000.

    Locally, on both server and client, OpenSSH creates a connection to
    127.0.0.1:<port>, starting where port is the offset specified by
    "X11DisplayOffset <port>" in your sshd_config file. One thing commonly
    overlooked is ensuring both hosts have an active 'lo' interface. The
    localhost connections occur on both client and server, and forward your X
    display over the existing SSH connection. Also, be sure "X11Forwarding yes"
    is set both locally and remotely in the respective sshd_config files.

    Cheers,
    Bryan

    -----Original Message-----
    From: Andre Charbonneau [mailto:andre.charbonneau@nrc-cnrc.gc.ca]
    Sent: Wednesday, September 21, 2005 10:12 AM
    To: secureshell@securityfocus.com
    Subject: question about x11 forwarding in ssh

    Hi,
    I'm currently trying to debug a SSH client implementation library which
    tries to do x11 forwarding. In the code it tries to open a socket to
    localhost:6000 when a x11 channel request arrives (on the ssh client side).
    But I get a 'connection refused'. I checked my system configurations and
    indeed my xserver is started with "-nolisten tcp", so this explains why I
    can't connect to port 6000.

    But I've read somewhere that someone should only open port 6000 only if they
    really really need it, and that they should use ssh x11 forwarding instead.

    But my question is: How does the SSH client (openSSH for example) forwards
    x11 when port 6000 is not open??? Does it use another, special port that it
    can connect to?
    Is there a document online that I can read that explains in details how ssh
    does the x11 forwarding?

    Thanks!
        Andre 

    --
Andre Charbonneau
100 Sussex Drive, Rm 2025
Research Computing Support, IMSB
National Research Council Canada
Ottawa, ON, Canada K1A 0R6
  • Next message: Robert Hajime Lanning: "Re: question about x11 forwarding in ssh"

    Relevant Pages

    • Re: interfaces lo:1 lo:2 lo:3? (for remote ssh tunnels)
      ... That's the problem tunneling (port forwarding) solves. ... >>can't get past the client firewall. ... > I don't understand why the server would be making the ... server initiates another connection to the client -- in this ...
      (Debian-User)
    • Re: Using Remote Desktop From an SBS Domain
      ... when you tried to RDP while attached directly to a port on your router? ... So if 3389 needs forwarded on the client end too then that is what the ... Hopefully next week I can attempt a connection while my ISP watches the ...
      (microsoft.public.windows.server.sbs)
    • UPDATE: Re: Question regarding SSH via Lantronix SCS100
      ... to do SSH and to authenticate the SSH connection with a local ... unexpectedly closed connection'. ... CONSOLE or AUX port on the router, or does it matter, and what ...
      (comp.dcom.sys.cisco)
    • RE: Telnet/ftp problems SBS2000
      ... Please make sure your client computers are configured as both Firewall ... will find two options "Enable folder view for FTP sites" and "Use Passive ... that the control connection has been successfully established, ... (other than port 21) ...
      (microsoft.public.windows.server.sbs)
    • Re: SSH options re: NAT
      ... No, SSH is two-fold, a call to it on the client side results in a call ... port, meaning that any connections that come into that port are answered ... programming practice for daemons) Once the connection is established, ... don't want to execute a command on the remote side and you use -N. ...
      (comp.security.ssh)