Date: Wed, 9 Jun 1999 09:21:58 -0600 (MDT) From: Paul Hart <hart@iserver.com> To: John-Mark Gurney <gurney_j@resnet.uoregon.edu> Cc: hqy2446 <hqy2446@is2.nyu.edu>, freebsd-security@FreeBSD.ORG Subject: Re: newbie question: ssh Message-ID: <Pine.BSF.3.96.990609090104.5589A-100000@anchovy.orem.iserver.com> In-Reply-To: <19990609004437.15372@hydrogen.nike.efn.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 9 Jun 1999, John-Mark Gurney wrote: > > What I did is > > > > $ xhost +[remote host] > > NEVER EVER do this!!! this is BAD, anyone on [remote host] can now > connect to your server and intercept ANY keystrokes that you may time, > this includes any passwords you may type... Oooh, yeah, this is very very bad. > as for why ssh isn't doing all the forwarding work for you, that's > another puzzle, you need to make sure you build ssh when the X libs > are installed on the machine, I built ssh once, then installed the X > libs, of course X forwarding didn't work till we rebuilt ssh... Did you make sure that the remote sshd has X11 forwarding turned on? You need to have X11 forwarding turned on in your local SSH client configuration and the remote sshd has to have it turned on as well. If the remote machine does not have X installed, it may be difficult to get sshd to do X11 forwarding because SSH likes to do things like create .Xauthority files for you on the remote machine using xauth and stock them with cookies. X11 forwarding will also be missing from sshd if the build process was unable to locate xauth at the SSH compilation configuration stage on the remote machine, as I recall. If you use the defaults everywhere that come with SSH, your client installation will have X11 forwarding turned on and the remote sshd should also have it enabled. Then just log in to the remote server with SSH and immediately check your DISPLAY environment variable (don't you set it!). You should see DISPLAY set to a high numbered display (like >10) on the the remote machine. This will be your sign that SSH X11 forwarding is in effect. Try running some X clients on the remote machine, verify that they do appear on your local X server, and check the list of open sockets on the local machine with netstat to verify that the X clients in fact did not come over a socket directly to your local X server (i.e. you don't see any active connections from the remote machine to port 6000 or so on the local machine). Paul Hart -- Paul Robert Hart ><8> ><8> ><8> Verio Web Hosting, Inc. hart@iserver.com ><8> ><8> ><8> http://www.iserver.com/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.3.96.990609090104.5589A-100000>