From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1Iay7H-0002Q9-Rs for garchives@archives.gentoo.org; Thu, 27 Sep 2007 18:29:40 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.14.1/8.14.0) with SMTP id l8RIJQEG000870; Thu, 27 Sep 2007 18:19:26 GMT Received: from mail.askja.de (mail.askja.de [83.137.103.136]) by robin.gentoo.org (8.14.1/8.14.0) with ESMTP id l8RIDc7W026263 for ; Thu, 27 Sep 2007 18:13:39 GMT Received: from xdsl-213-168-118-148.netcologne.de ([213.168.118.148] helo=zone.wonkology.org) by mail.askja.de with esmtpsa (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.67) (envelope-from ) id 1Iaxrm-0005b3-FN for gentoo-user@lists.gentoo.org; Thu, 27 Sep 2007 20:13:38 +0200 Received: from weird.wonkology.org (weird.wonkology.org [::ffff:192.168.1.4]) by zone.wonkology.org with esmtp; Thu, 27 Sep 2007 20:13:35 +0200 id 00038335.46FBF2CF.00005F38 From: Alex Schuster Organization: Wonkology To: gentoo-user@lists.gentoo.org Subject: [gentoo-user] SSH: No X11 forwarding any longer Date: Thu, 27 Sep 2007 20:13:34 +0200 User-Agent: KMail/1.9.7 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Content-Disposition: inline Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Message-Id: <200709272013.34289.wonko@wonkology.org> X-Archives-Salt: 5fb61fad-22c0-4be9-b7ff-3afb2a2b262c X-Archives-Hash: 3a97d58db927aa3f547481c621696c69 Hi there! For a little while now I have a problem on one of my hosts, X11 forwarding stopped working. I do not know where to look, but I thought maybe someone here has an idea? I have a .Xauthority file dated from Sept 19, this might be around the last time forwarding was working. Here is my /etc/ssh/sshd_config, stripped by all commented lines in order to save space: Protocol 2,1 PermitRootLogin no PasswordAuthentication no UsePAM yes X11Forwarding yes ClientAliveInterval 180 Banner /etc/ssh/tolles.banner Subsystem sftp /usr/lib/misc/sftp-server I stopped the ssh service and started sshd manually with option -d: root@zone:~ /usr/sbin/sshd -d debug1: sshd version OpenSSH_4.7p1 debug1: private host key: #0 type 0 RSA1 debug1: read PEM private key done: type RSA debug1: private host key: #1 type 1 RSA debug1: read PEM private key done: type DSA debug1: private host key: #2 type 2 DSA debug1: rexec_argv[0]='/usr/sbin/sshd' debug1: rexec_argv[1]='-d' debug1: Bind to port 22 on 0.0.0.0. Server listening on 0.0.0.0 port 22. socket: Address family not supported by protocol Generating 768 bit RSA key. RSA key generation complete. [Now comes the login] debug1: Server will not fork when running in debugging mode. debug1: rexec start in 4 out 4 newsock 4 pipe -1 sock 7 debug1: inetd sockets after dupping: 3, 3 Connection from 192.168.1.4 port 38166 debug1: Client protocol version 2.0; client software version OpenSSH_4.6 debug1: match: OpenSSH_4.6 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-1.99-OpenSSH_4.7 debug1: permanently_set_uid: 22/22 debug1: list_hostkey_types: ssh-rsa,ssh-dss debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: client->server aes128-cbc hmac-md5 none debug1: kex: server->client aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: KEX done debug1: userauth-request for user wonko service ssh-connection method none debug1: attempt 0 failures 0 debug1: PAM: initializing for "wonko" debug1: PAM: setting PAM_RHOST to "weird.wonkology.org" debug1: PAM: setting PAM_TTY to "ssh" debug1: userauth_send_banner: sent debug1: userauth-request for user wonko service ssh-connection method publickey debug1: attempt 1 failures 1 debug1: test whether pkalg/pkblob are acceptable debug1: temporarily_use_uid: 1000/100 (e=0/0) debug1: trying public key file /home/wonko/.ssh/authorized_keys debug1: restore_uid: 0/0 debug1: temporarily_use_uid: 1000/100 (e=0/0) debug1: trying public key file /home/wonko/.ssh/authorized_keys2 debug1: restore_uid: 0/0 Failed publickey for wonko from 192.168.1.4 port 38166 ssh2 debug1: userauth-request for user wonko service ssh-connection method publickey debug1: attempt 2 failures 2 debug1: temporarily_use_uid: 1000/100 (e=0/0) debug1: trying public key file /home/wonko/.ssh/authorized_keys debug1: matching key found: file /home/wonko/.ssh/authorized_keys, line 1 Found matching DSA key: 01:57:eb:6f:53:3f:6f:d8:a7:87:6f:c2:a7:a4:7a:18 debug1: restore_uid: 0/0 debug1: ssh_dss_verify: signature correct debug1: do_pam_account: called Accepted publickey for wonko from 192.168.1.4 port 38166 ssh2 debug1: monitor_child_preauth: wonko has been authenticated by privileged process debug1: PAM: establishing credentials debug1: permanently_set_uid: 1000/100 debug1: Entering interactive session for SSH2. debug1: server_init_dispatch_20 debug1: server_input_channel_open: ctype session rchan 0 win 65536 max 16384 debug1: input_session_request debug1: channel 0: new [server-session] debug1: session_new: init debug1: session_new: session 0 debug1: session_open: channel 0 debug1: session_open: session 0: link with channel 0 debug1: server_input_channel_open: confirm session debug1: server_input_channel_req: channel 0 request x11-req reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req x11-req debug1: server_input_channel_req: channel 0 request pty-req reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req pty-req debug1: Allocating pty. debug1: session_new: init debug1: session_new: session 0 debug1: session_pty_req: session 0 alloc /dev/pts/2 debug1: server_input_channel_req: channel 0 request shell reply 0 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req shell debug1: PAM: setting PAM_TTY to "/dev/pts/2" debug1: Setting controlling tty using TIOCSCTTY. I did the same on another host where forwarding is working. Here is a diff of the two logs: (< ok, > not ok) 1a2 > debug1: private host key: #0 type 0 RSA1 3c4 < debug1: private host key: #0 type 1 RSA --- > debug1: private host key: #1 type 1 RSA 5c6 < debug1: private host key: #1 type 2 DSA --- > debug1: private host key: #2 type 2 DSA 10a12,14 > Generating 768 bit RSA key. > RSA key generation complete. > 14c18 < Connection from 127.0.0.1 port 55291 --- > Connection from 192.168.1.4 port 35800 18c22 < debug1: Local version string SSH-2.0-OpenSSH_4.7 --- > debug1: Local version string SSH-1.99-OpenSSH_4.7 36c40 < debug1: PAM: setting PAM_RHOST to "localhost" --- > debug1: PAM: setting PAM_RHOST to "weird.wonkology.org" 37a42 > debug1: userauth_send_banner: sent 47c52 < Failed publickey for wonko from 127.0.0.1 port 55291 ssh2 --- > Failed publickey for wonko from 192.168.1.4 port 35800 ssh2 57c62 < Accepted publickey for wonko from 127.0.0.1 port 55291 ssh2 --- > Accepted publickey for wonko from 192.168.1.4 port 35800 ssh2 74,75d78 < debug1: x11_create_display_inet: Socket family 10 not supported < debug1: channel 1: new [X11 inet listener] 82c85 < debug1: session_pty_req: session 0 alloc /dev/pts/19 --- > debug1: session_pty_req: session 0 alloc /dev/pts/7 86c89 < debug1: PAM: setting PAM_TTY to "/dev/pts/19" --- > debug1: PAM: setting PAM_TTY to "/dev/pts/7" So, this is the main difference, it appears only on the machine where forwarding is working: < debug1: x11_create_display_inet: Socket family 10 not supported < debug1: channel 1: new [X11 inet listener] Any idea what's wrong? Alex -- gentoo-user@gentoo.org mailing list