Linux Remote Access - SSH and X11 Forwarding - Chris Titus Tech
video description
Date: 2022-03-21
Related videos
Comments and reviews: 10
Hestia
What do they mean by this:
X11 forwarding should be enabled with caution. Users with the ability
to bypass file permissions on the remote host (for the user's X autho-
rization database) can access the local X11 display through the for-
warded connection. An attacker may then be able to perform activities
such as keystroke monitoring.
For this reason, X11 forwarding is subjected to X11 SECURITY extension
restrictions by default. Please refer to the ssh -Y option and the
ForwardX11Trusted directive in ssh_config(5) for more information.
(Debian-specific: X11 forwarding is not subjected to X11 SECURITY ex-
tension restrictions by default, because too many programs currently
crash in this mode. Set the ForwardX11Trusted option to -no- to re-
store the upstream behaviour. This may change in future depending on
client-side improvements.)
reply
What do they mean by this:
X11 forwarding should be enabled with caution. Users with the ability
to bypass file permissions on the remote host (for the user's X autho-
rization database) can access the local X11 display through the for-
warded connection. An attacker may then be able to perform activities
such as keystroke monitoring.
For this reason, X11 forwarding is subjected to X11 SECURITY extension
restrictions by default. Please refer to the ssh -Y option and the
ForwardX11Trusted directive in ssh_config(5) for more information.
(Debian-specific: X11 forwarding is not subjected to X11 SECURITY ex-
tension restrictions by default, because too many programs currently
crash in this mode. Set the ForwardX11Trusted option to -no- to re-
store the upstream behaviour. This may change in future depending on
client-side improvements.)
reply
gwgux
Wow, I just realized I haven't done X11 forwarding in over a decade. At one of the places I used to work at, their monitoring software was configured to SSH into Linux, AIX, and Solaris boxes and bring up status windows on a Windows PC for monitoring what was happening in each of their environments. X11 forwarding is a powerful tool when used correctly, but a lot of its previous uses has been replaced by web interfaces and the results have been a mixed bag.
That said, just seeing it again has inspired me to take another look at it and see what I can cook up now. Web interfaces for everything built on HTML5 just doesn't do everything efficiently or as well as running an app on a remote host so there's still a good need for it. Thanks Chris, ideas are floating into my head for some of my tasks at work now. :)
reply
Wow, I just realized I haven't done X11 forwarding in over a decade. At one of the places I used to work at, their monitoring software was configured to SSH into Linux, AIX, and Solaris boxes and bring up status windows on a Windows PC for monitoring what was happening in each of their environments. X11 forwarding is a powerful tool when used correctly, but a lot of its previous uses has been replaced by web interfaces and the results have been a mixed bag.
That said, just seeing it again has inspired me to take another look at it and see what I can cook up now. Web interfaces for everything built on HTML5 just doesn't do everything efficiently or as well as running an app on a remote host so there's still a good need for it. Thanks Chris, ideas are floating into my head for some of my tasks at work now. :)
reply
Geoff
I privately manage a few Linux machines via ssh, two remotely from UK to US. All connections are via ssh, sometimes using a tunnel for VNC and proxy browsing or using sftp to display remote file system. On the default Ubuntu file manager (files I think it is called) there is an option to connect using sftp then it shows up in your file manager locations same as local files. This would then make all remote files easily available for editing with any local application. Personally I've never found X11 forwarding very successful. Great videos by the way.
reply
I privately manage a few Linux machines via ssh, two remotely from UK to US. All connections are via ssh, sometimes using a tunnel for VNC and proxy browsing or using sftp to display remote file system. On the default Ubuntu file manager (files I think it is called) there is an option to connect using sftp then it shows up in your file manager locations same as local files. This would then make all remote files easily available for editing with any local application. Personally I've never found X11 forwarding very successful. Great videos by the way.
reply
yvrelna
If all you're using SSH X Forwarding for is to run a file manager, then you can instead just use SFTP or SSHFS instead and use a local file manager application to manage your remote files. This has the benefit that you can copy paste or drag'n'drop files to upload/download files between your local and remote machine and there's no graphic/input latency as the application will be running locally. Also, there are a number of Security issues with doing X11 forwarding if you don't fully trust the server which using SSHFS/SFTP would avoid.
reply
If all you're using SSH X Forwarding for is to run a file manager, then you can instead just use SFTP or SSHFS instead and use a local file manager application to manage your remote files. This has the benefit that you can copy paste or drag'n'drop files to upload/download files between your local and remote machine and there's no graphic/input latency as the application will be running locally. Also, there are a number of Security issues with doing X11 forwarding if you don't fully trust the server which using SSHFS/SFTP would avoid.
reply
databaseexpert
X11 forwarding sucks, it has always sucked. For some reason, piping the graphics over the ssh loses important graphical items and disables buttons and other clickable items. The best solution when it is absolutely necessary to run GUI programs over an SSH connection is to tunnel VNC. Unfortunately, in some odd cases, VNC is not an option, in which case I recommend calling someone on site and walking them through the buttons to click, etc. while using a screen-share conferencing application.
reply
X11 forwarding sucks, it has always sucked. For some reason, piping the graphics over the ssh loses important graphical items and disables buttons and other clickable items. The best solution when it is absolutely necessary to run GUI programs over an SSH connection is to tunnel VNC. Unfortunately, in some odd cases, VNC is not an option, in which case I recommend calling someone on site and walking them through the buttons to click, etc. while using a screen-share conferencing application.
reply
Chris
I could add many things(that I believe that are missing) here but I would like to add one important thing.
On RHEL/CentOS/Fedora systems if we change the port to anything other than the default, we need to update the SELinux rule. We need to update it actually by running semanage port -a -t ssh_port_t -p tcp -your new port number goes here-. Thus if you haven't disabled the SELinux.
reply
I could add many things(that I believe that are missing) here but I would like to add one important thing.
On RHEL/CentOS/Fedora systems if we change the port to anything other than the default, we need to update the SELinux rule. We need to update it actually by running semanage port -a -t ssh_port_t -p tcp -your new port number goes here-. Thus if you haven't disabled the SELinux.
reply
Jacob
8:15 Google Chrome didn't crash. It would probably have worked. Those two were warnings from GTK, not fatal errors. At most there would have been some issues with colors and icons on the browser interface. You already had Google Chrome running in another window, probably on the physical desktop environment, and it used that to launch a new tab or your home page.
reply
8:15 Google Chrome didn't crash. It would probably have worked. Those two were warnings from GTK, not fatal errors. At most there would have been some issues with colors and icons on the browser interface. You already had Google Chrome running in another window, probably on the physical desktop environment, and it used that to launch a new tab or your home page.
reply
blackbriar
I really like your mini xming/SSH/X11 forwarding tutorial. It's going to make life easier accessing my simulation server. Can you you show me how you modified bashrc in putty to reflect what you have here as that makes all the difference in my case running multiple terminal windows. Thanks again in advance.
reply
I really like your mini xming/SSH/X11 forwarding tutorial. It's going to make life easier accessing my simulation server. Can you you show me how you modified bashrc in putty to reflect what you have here as that makes all the difference in my case running multiple terminal windows. Thanks again in advance.
reply
TBi
You should be able to connect to a computer by hostname using .local as the address. If server name is -debian10- then use -debian10.local-. Also what are you using for the terminal, it looks great! Next to try is x11vnc and/or NX/NoMachine. And also setting up ssh keys so you don't need passwords anymore!
reply
You should be able to connect to a computer by hostname using .local as the address. If server name is -debian10- then use -debian10.local-. Also what are you using for the terminal, it looks great! Next to try is x11vnc and/or NX/NoMachine. And also setting up ssh keys so you don't need passwords anymore!
reply
NAHPyboy
Any chance you would make this guide to create a file server to access files remotely (via SSH?) as if I'm connecting my laptop from one home network to another person's home network? I'd like to run a file server at home and share photos and movies between family members over Windows?
reply
Any chance you would make this guide to create a file server to access files remotely (via SSH?) as if I'm connecting my laptop from one home network to another person's home network? I'd like to run a file server at home and share photos and movies between family members over Windows?
reply
Add a review, comment
Other channel videos
