☰

仅在单个服务器上 X11 转发失败

tag-icon • tag-icon linux ssh
仅在单个服务器上 X11 转发失败

我有两台计算机：PC1 和 PC2。两台计算机都运行相同的 Debian Wheezy 安装并附带最新更新。PC2 上的安装来自 PC1，使用tar。PC1 和 PC2 之间的唯一区别是 grub 条目、主机名、内容/etc/hosts和 IP 地址。两台计算机的 SSHD 配置相同：

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

#AddressFamily inet

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts                                                                                                             
RhostsRSAAuthentication no                                                                                                                                                          
# similar for protocol version 2                                                                                                                                                    
HostbasedAuthentication no                                                                                                                                                          
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication                                                                                                       
#IgnoreUserKnownHosts yes                                                                                                                                                           

# To enable empty passwords, change to yes (NOT RECOMMENDED)                                                                                                                        
PermitEmptyPasswords no                                                                                                                                                             

# Change to yes to enable challenge-response passwords (beware issues with                                                                                                          
# some PAM modules and threads)                                                                                                                                                     
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
X11UseLocalhost no
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

我可以从 PC2 连接到 PC1 并顺利运行 GUI 程序。但我无法从任何计算机（包括 PC2 本身）在 PC2 上远程运行 GUI 程序。这是我在 PC2 上尝试运行后ssh得到的输出：xtermssh -Xvvv localhost

user@pc2:~$ xterm
debug1: client_input_channel_open: ctype x11 rchan 3 win 65536 max 16384
debug1: client_request_x11: request from 127.0.0.1 42667
debug2: fd 7 setting O_NONBLOCK
debug3: fd 7 is O_NONBLOCK
debug1: channel 1: new [x11]
debug1: confirm x11
debug2: X11 connection uses different authentication protocol.
X11 connection rejected because of wrong authentication.
debug2: X11 rejected 1 i0/o0
debug2: channel 1: read failed
debug2: channel 1: close_read
debug2: channel 1: input open -> drain
debug2: channel 1: ibuf empty
debug2: channel 1: send eof
debug2: channel 1: input drain -> closed
debug2: channel 1: write failed
debug2: channel 1: close_write
debug2: channel 1: output open -> closed
debug2: X11 closed 1 i3/o3
debug2: channel 1: send close
debug2: channel 1: rcvd close
debug2: channel 1: is dead
debug2: channel 1: garbage collecting
debug1: channel 1: free: x11, nchannels 2
debug3: channel 1: status: The following connections are open:
  #0 client-session (t4 r0 i0/0 o0/0 fd 4/5 cc -1)
  #1 x11 (t7 r3 i3/0 o3/0 fd 7/7 cc -1)

xterm: Xt error: Can't open display: pc2:11.0

~/.Xauthority 的权限和所有权看起来正常：

user@pc2:~$ ls -l ~/.Xauthority 
-rw------- 1 user user 301 Aug 27 13:49 /home/user/.Xauthority

我已经尝试通过谷歌搜索解决这个问题几个小时了，但似乎没有任何进展。我需要你的帮助。

答案1

查看服务器上~/.ssh/rc是否有文件。根据/etc/ssh/sshrc这个问题，如果其中一个脚本存在，sshd则会在会话启动期间运行它，并且该脚本负责调用xauth以设置 X11 身份验证。如果两个文件都不存在，则 sshdxauth直接调用。远程服务器上可能有其中一个文件，但它无法正确执行其工作。

这OpenSSH sshd 手册页有一个 rc 脚本应运行以设置 xauth 的 shell 代码示例：

如果正在使用 X11 转发，它将在其标准输入中接收“proto cookie”对（并在其环境中显示）。脚本必须调用 xauth(1)，因为 sshd 不会自动运行 xauth 来添加 X11 cookie。

if read proto cookie && [ -n "$DISPLAY" ]; then 
    if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then 
        # X11UseLocalhost=yes 
        echo add unix:`echo $DISPLAY | 
            cut -c11-` $proto $cookie 
    else 
        # X11UseLocalhost=no 
        echo add $DISPLAY $proto $cookie 
    fi | xauth -q - 
fi

相关内容