Linux Networking Cookbook

7.12. Tunneling X Windows Securely over SSH

Problem

OK, all of this command-line stuff is slick and easy, but you still want a nice graphical environment. Maybe you use graphical utilities to manage your headless servers. Maybe you want to access a remote workstation and have access to all of its applications. You know that X Windows has built-in networking abilities, but it sends all traffic in cleartext, which of course is unacceptably insecure, plus it's a pain to set up. What else can you do?

Solution

Tunneling X over SSH is simple, and requires no additional software.

First, make sure this line is in /etc/ssh/sshd_config on the remote machine:

	X11Forwarding yes

Then, connect to the server using the -X flag:

	[carla@windbag:~/.ssh]$ ssh -X stilton
	Enter passphrase for key '/home/carla/.ssh/id_rsa':
	Linux stilton 2.6.15-26-k7 #1 SMP PREEMPT Sun Jun 3 03:40:32 UTC 2007 i686 GNU/Linux
	Last login: Sat June 2 14:55:10 2007
	carla@stilton:~$

Now, you can run any of the X applications installed on the remote PC by starting them from the command line:

	carla@stilton:~$ ppracer

SSH sets up an X proxy on the SSH server, which you can see with this command:

	carla@stilton:~$ echo $DISPLAY
	localhost:10.0

Discussion

The X server runs with the offset specified in /etc/sshd.conf:

	X11DisplayOffset 10

This needs to be configured to avoid colliding with existing X sessions. Your regular local X session is: 0.0.

The remote system only needs to be powered on. You don't need any local users to be logged in, and ...