From owner-freebsd-questions@FreeBSD.ORG Thu Aug 21 08:48:24 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5BCA01065679 for ; Thu, 21 Aug 2008 08:48:24 +0000 (UTC) (envelope-from nvass@teledomenet.gr) Received: from smtp.teledomenet.gr (smtp.teledomenet.gr [213.142.128.2]) by mx1.freebsd.org (Postfix) with ESMTP id 137608FC18 for ; Thu, 21 Aug 2008 08:48:24 +0000 (UTC) (envelope-from nvass@teledomenet.gr) Received: by smtp.teledomenet.gr (Postfix, from userid 58) id 05F3A14211B; Thu, 21 Aug 2008 11:48:23 +0300 (EEST) X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on smtp.teledomenet.gr X-Spam-Level: X-Spam-Status: No, score=-2.5 required=5.0 tests=BAYES_00,RDNS_NONE autolearn=no version=3.2.5 Received: from iris.teledomenet.local (unknown [192.168.1.71]) by smtp.teledomenet.gr (Postfix) with ESMTP id 876F8142025; Thu, 21 Aug 2008 11:47:47 +0300 (EEST) From: Nikos Vassiliadis To: freebsd-questions@freebsd.org Date: Thu, 21 Aug 2008 11:49:58 +0300 User-Agent: KMail/1.9.7 References: <48AADA2A.10803@supsi.ch> <48AD1125.6030509@supsi.ch> In-Reply-To: <48AD1125.6030509@supsi.ch> X-NCC-RegID: gr.telehouse MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200808211149.59449.nvass@teledomenet.gr> Cc: Roberto Nunnari Subject: Re: X11 tunnel over ssh and then rsh X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Aug 2008 08:48:24 -0000 On Thursday 21 August 2008 09:54:29 Roberto Nunnari wrote: > Anybody on this, please? > > Roberto Nunnari wrote: > > Hello list. > > > > I have this scenario > > > > 1) host A with X server > > 2) host B with ssh server but without X server > > 3) host C with rsh server and X client programs but without X server > > (on host C there's also an ssh server, but in our case, users > > have to use rsh) Why rsh? Isn't ssh a drop-in replacement for rsh? > > > > now, I need to connect from host A to host B with: > > A$ ssh -Y B (-Y or -X, to create a X tunnel) > > and then from host B to host C with: > > B$ rsh C > > and on host C I need to run an X client like: > > C$ xterm > > > > Now, I would like the users not to have to set the > > DISPLAY env var on host C, as they tend to forget > > and also some user's X server don't accept plain > > X connections.. > > > > Is there a way that I could configure host B to somehow > > expose to host C the X tunnel to host A? Automatically? No. You can however use ssh to create generic TCP tunnels, using -R and -L. But this is much more complicated than remembering a DISPLAY variable. > > From host > > B I have access to the users' homes on host C and I could > > place there some script to set the DISPLAY env var on user > > login. > > > > B$ echo $DISPLAY > > on host B gives back something like localhost:16.0, > > but if on host C I enter: > > C$ export DISPLAY=B:16.0 > > C$ xterm > > it doesn't work.. probably host C doesn't expose a > > network socket but maybe a unix socket for the X tunnel.. This is probably because the listener (which proxies X11 to host A) is bound to localhost(127.0.0.1) and not B(12.23.34.45). You can overcome this, using manual forwarding(-R & -L). HOST_A# ssh -R '*:6010:127.0.0.1:6000' HOST_B # create a listener on HOST_B listening on all interfaces and TCP port 6010 and tunnel everything from there to HOST_A's 127.0.0.1 6000 Then every host which can connect to HOST_B can connect to HOST_A X11 server. Using generic TCP port forwarding through ssh to forward X11 has an other minus. You have to handle yourself the X11 authorization(xauth, XAUTHORITY and friends) You can of course use a second ssh session from HOST_B to HOST_C to expose HOST_B's 127.0.0.1:6010 to HOST_C's 127.0.0.1:6010. So, connecting from HOST_C to 127.0.0.1:6010 will be tunneled to HOST_B's 127.0.0.1:6010, which will be tunneled to HOST_A's 127.0.0.1:6000 were your X11 display lives. It's rather complicated, though...