<p>One pain point I often have is SSH forwarding the ports for a bunch of web
services and IPMI/IDRAC/ILO/Whatever connections through my pivot server to my
workstation. Its really tedious, and having a web UI right on the jump server's
subnet can be really helpful.</p>
<p>In this guide, I show how I launch Chrome on a remote Ubuntu server without
ever installing any graphics tools like Ubuntu Desktop on that server, and
without needing VNC/RDP/PCOIP/etc. X11 forwarding lets the XQuarts process on
a MacBook render the browser, while it still uses the networking on the Ubuntu
server it launched from.</p>
<hr>
<h3 id="table-of-contents">Table of Contents</h3>
<ul>
<li><a href="#configure-workstation-macbook-ssh-settings-for-x11-forwarding">Configure Workstation (MacBook) SSH Settings for X11 Forwarding</a>
<ul>
<li><a href="#set-xauthlocation">Set XAuthLocation</a></li>
<li><a href="#enable-forwardagent-and-forwardx11">Enable ForwardAgent and ForwardX11</a></li>
</ul>
</li>
<li><a href="#remotely-launch-graphical-apps-with-xwindows">Remotely Launch Graphical Apps with XWindows</a>
<ul>
<li><a href="#install-chrome">Install Chrome</a></li>
<li><a href="#install-x11-apps-for-xeyes">Install X11-apps for xeyes</a></li>
</ul>
</li>
<li><a href="#launch-forwarded-xwindows-session">Launch Forwarded XWindows Session</a>
<ul>
<li><a href="#open-ssh-session-with-x11-forwarding-enabled">Open SSH session with X11 Forwarding Enabled.</a></li>
</ul>
</li>
<li><a href="#troubleshooting">Troubleshooting</a>
<ul>
<li><a href="#xauth--timeout-in-locking-authority-file-xauthority">xauth:  timeout in locking authority file ~/.Xauthority</a></li>
<li><a href="#display-is-empty-no-xauth-program">$DISPLAY is Empty, No xauth program</a></li>
<li><a href="#x11-connection-rejected-because-of-wrong-authentication">X11 connection rejected because of wrong authentication.</a></li>
</ul>
</li>
<li><a href="#reference-links">Reference Links</a></li>
</ul>
<h1 id="configure-workstation-macbook-ssh-settings-for-x11-forwarding">Configure Workstation (MacBook) SSH Settings for X11 Forwarding</h1>
<p>If you're not using a MacBook, this won't apply.</p>
<h2 id="set-xauthlocation">Set XAuthLocation</h2>
<p>The workstation needs to allow X11 forwarding. Some brilliant update broke it
in my version of Mac OS I had to set the XAuthLocation in <code>ssh_config</code>.</p>
<p><code>vi /etc/ssh/ssh_config</code></p>
<pre><code class="language-bash">Host *
  SendEnv LANG LC_*
  XAuthLocation /usr/X11/bin/xauth
  ServerAliveInterval 60
  ForwardX11Timeout 596h
</code></pre>
<h2 id="enable-forwardagent-and-forwardx11">Enable ForwardAgent and ForwardX11</h2>
<p>My hostname was <code>adc-bmc</code> and its IP was 192.168.2.2. Alter this as needed.
On your workstation:</p>
<p><code>vi ~/.ssh/config</code></p>
<pre><code class="language-bash">Host adc-bmc
  HostName 192.168.2.2
  ForwardAgent yes
  ForwardX11 yes
</code></pre>
<h1 id="remotely-launch-graphical-apps-with-xwindows">Remotely Launch Graphical Apps with XWindows</h1>
<h2 id="install-chrome">Install Chrome</h2>
<p>You can use Firefox or whatever instead. Chrome's install will fail due to
missing dependencies, but apt can sort it out.</p>
<pre><code class="language-bash">wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
dpkg -i google-chrome-stable_current_amd64.deb
apt-get install -f
dpkg -i google-chrome-stable_current_amd64.deb
</code></pre>
<h2 id="install-x11-apps-for-xeyes">Install X11-apps for xeyes</h2>
<p>This is just for fun and testing. Xeyes is kind of neat.</p>
<pre><code>apt-get install -y x11-apps
</code></pre>
<hr>
<h1 id="launch-forwarded-xwindows-session">Launch Forwarded XWindows Session</h1>
<h2 id="open-ssh-session-with-x11-forwarding-enabled">Open SSH session with X11 Forwarding Enabled.</h2>
<p>XWindows can be passed through SSH. Open a new terminal window and connect to
the server using the <code>-X</code> flag to enable X forwarding on the client.</p>
<p>The xeyes application is a fun test.</p>
<pre><code class="language-bash">ssh -X myuser@192.168.2.2 xeyes
</code></pre>
<p>If that works, try Chrome. The extra flags enable compression and use a faster
encryption algorithm. If they cause problems, just use <code>-X</code>.</p>
<pre><code class="language-bash">ssh -XC -c chacha20-poly1305@openssh.com myuser@192.168.2.2 google-chrome
</code></pre>
<h1 id="troubleshooting">Troubleshooting</h1>
<h2 id="xauth--timeout-in-locking-authority-file-xauthority">xauth:  timeout in locking authority file ~/.Xauthority</h2>
<p>As your not-root user, remove and <code>chmod</code> some files.</p>
<pre><code class="language-bash">sudo rm ~/.Xauthority-c
sudo rm ~/.Xauthority-l
sudo rm -r ~/.Xauthority
mkdir ~/.Xauthority
chmod 0600 ~/.Xauthority
</code></pre>
<h2 id="display-is-empty-no-xauth-program">$DISPLAY is Empty, No xauth program</h2>
<p>On your mac, if you connect with <code>ssh -v -X ...</code> and you get an error line
saying <code>No xauth program</code>, then you need to edit your SSH config to specify
the xauth path. Mine was <code>/usr/X11/bin/xauth</code>.</p>
<h2 id="x11-connection-rejected-because-of-wrong-authentication">X11 connection rejected because of wrong authentication.</h2>
<p>If you're on Mac, this can happen when you didn't set the <code>XAuthLocation</code> ssh
configuration.</p>
<h1 id="reference-links">Reference Links</h1>
<ul>
<li><a href="https://linuxize.com/post/how-to-install-google-chrome-web-browser-on-ubuntu-18-04/">linuxize.com - Install chrome</a></li>
<li><a href="https://github.com/dnschneid/crouton/issues/2676">github.com - x11 forwarding tshooting</a></li>
</ul>


Kyle Pericak

"It works in my environment"

Categories

Tags