SSH -X doesn't seem to work.

Indeed, I am confused. But, one shouldn't be surprised when an experimental branch of an OS doesn't behave as expected. It's a little surprising that I got more and better help from this group than from the freebsd lists I subscribe to. The fix was simple, explictly turn on X11Forwarding in sshd.conf, something not needed up to this point.

Thanks for reading,

bob prohaska

(TLDR tail -8)

I'm now very confused. I have much the same sort of setup: a headless pi4 running freebsd, plus some linux mint workstations.

I simply /cannot/ ssh into the linux box and get X11 forwarded back to the workstation. ssh mint <-> mint, and all works as expected, with DISPLAY set to localhost:10.0 (ie forwarded over the ssh connection).

With ssh from mint -> freebsd, I get DISPLAY set to 192.168.0.9:0, ie X11 not forwarded over ssh.

The linux config files are presumably correct since it all works as expected between the mint boxes. I've tried replacing the freebsd sshd_config with that from linux (and had to fix up KbdInteractiveAuthentication to log in at all), and it /still/ does not allow X11 forwarding.

With ssh -v -X, I always seem to get debug1: Requesting X11 forwarding with authentication spoofing. so clearly the server isn't allowing it.

On the server end, with sshd -Dd, I see in particular debug1: active: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding ... debug1: server_input_channel_req: channel 0 request x11-req reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req x11-req debug1: channel 1: new [X11 inet listener] debug1: channel 2: new [X11 inet listener] ... which doesn't help me at all :-{

The pi4, BTW, is on 13.1-RELEASE-p7; mint is at 21 Vanessa.

Bob, would it be possible to post your working sshd config file please?

Thanks.

That's the mirror image of what I'm doing: My ssh -X runs on the Pi, with FreeBSD answering via sshd. Shouldn't matter, but it might be interesting to try it both ways. I can't, since the router won't forward incoming packets without an existing connection.

My setup includes a router between public and private networks. The FreeBSD host is on a public net, the RasPiOS workstation is on a 192.168.... net. I'd expect that to make matters worse, not better, but in my case it didn't seem to matter. If you have a router in your setup it might be a worthy suspect.

My router is a DI524, old and cheap. FreeBSD is -current, up to date as of a day or so ago. RasPiOS is Bullseye, also up to date.

Signal path is RasPi internal Wifi to router Wifi, then wired connection to to the Pi4.

hth,

bob prohaska

Me being cryptic - Too Long Don't Read, so head to the last 8 lines. Sorry.

I see; but we're both trying to run ssh -X on linux and have a freebsd sshd respond. I think. It shouldn't matter what the exact hardware is.

I'm just on my home LAN at the moment, which ought to make life easier; no routers involved and everything's visible at one desk.

What I don't get is that since the sshd programs on linux and fbsd are essentially the same code, just why, with the same configuration file, one works and the other not.

Maybe I need to diff the sources from the two systems.

Are you sure that FreeBSD's SSHd is reading the configuration file that you think it is? Maybe the config file location, set at build time, moved in the past and you replaced and old copy of the config file that wasn't being used anymore.

Failing that, I'd try setting both ends (client and server) to defaults (empty config file) except for the one line enabling X11 forwarding in SSHd, and see if that works.

Thanks for the comment.

Yes, I'm sure the files are right; nevertheless I've tried a fresh almost-empty config file: root@kirk:/etc/ssh # cat sshd_TEST X11Forwarding yes

And I /still/ get on the client end:

mike@spock ~ $ ssh -X -v -F /dev/null kirk ..... debug1: Requesting X11 forwarding with authentication spoofing. ..... Running /usr/local/bin/xauth remove unix:11.0 /usr/local/bin/xauth add unix:11.0 MIT-MAGIC-COOKIE-1 f6a4308d2f8fd240103a0454872782ec Erase set to backspace. On kirk.scotts remote display set to 192.168.0.9:0 (which is wrong)

I've also tried a raspberry OS client in place of mint; same problem unsurprisingly.

(BTW, I have no personal config files on either client or server; just the system ones in /etc/ssh)

what is outputing this ....

check out these files on kirk

~/.ssh/rc /etc/ssh/sshrc

checkout LOGIN PROCESS section in the sshd man page.

On my linux sshd server neither of those files exist, and so sshd itself calls xauth, and it works. I'm suspicious that a sshrc script is present and is not correct.

Thanks to all for comments.

I've resolved the issue.... somewhen in the dim and distant past something in the system created a .login file for me which checked whether the login was over ssh and - yes! - set DISPLAY accordingly. Now fixed.

(In mitigation, I'm absolutely sure it wasn't my doing - it uses csh constructs that I don't even know, and presumably it was put there by an early fbsd system. It must date back 20 years or so; that seems to be the earliest era for files in that directory.)

So thanks and apologies for the red herring.