4

X11 forwarding works when I am logged in my CentOS 6.6 cluster as myself (using ssh -AY user@ipaddress). When I try switching users, e.g. sudo su user2 and try to fire up xterm, I get the error :

X11 connection rejected because of wrong authentication.

xterm Xt error: Can't open display: localhost:11.0

How do I get X11 forwarding to work in this case?

Community
  • 1
irritable_phd_syndrome
  • 283
  • 3
  • 10
  • basically, you don't, unless you will find some hack to do that. Your `user2` does not have permissions to write to `user` socket, which is correct. You might change permissions on such sockets, but then you might open security hole to your workstation. – Jakuje Mar 29 '16 at 11:32
  • Duplicate of http://superuser.com/questions/131101/xforwarding-doesnt-allow-for-switching-users – Andy Mar 29 '16 at 13:17

2 Answers2

1

using sudo su is likely to loose all authorization.

setup ssh key authentication, then use ssh -AY user2@localhost (or ssh -AY user2@localhost xterm )

Archemar
  • 31,183
  • 18
  • 69
  • 104
1

You're not the first to suffer this issue. The cause is quite simple: your X server is (quite reasonably) set to require an authentication token, and the second user doesn't have access to that token. There are a number of solutions:

  1. Don't run X11 applications as the other user. As yourself, start an xterm running a shell as the other user:

    xterm -e sudo -s user2

    Obviously this approach will not work if you really need to run a GUI application as the other user, but it's always worth considering before anything more complex.

  2. Allow user2 to access your X server without authentication. As yourself, add this user using xhost:

    xhost +SI:localuser:user2
  3. Install sux and use that instead of su. It's a simple shell wrapper, and it's now mostly fallen by the wayside, given solutions such as the next one.

  4. Configure su and sudo to use pam_xauth. This is a standard module (in libpam-modules on Debian). All that is required is to add the line

    session  optional  pam_xauth.so

    to /etc/pam.d/su and to /etc/pam.d/sudo. There are additional options (see the man page) but you're unlikely to need them.

Toby Speight
  • 8,460
  • 3
  • 26
  • 50