Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When I use ssh -X on my Mac (running OS X 10.6.7) to connect to my Ubuntu (11.04) box, I get the following warning:

Warning: untrusted X11 forwarding setup failed: xauth key data not generated Warning: No xauth data; using fake authentication data for X11 forwarding.

Is there something I can do to make this warning go away? If not, can I safely ignore it?

X11 forwarding seems to work fine, though I do see this message:

Xlib: extension "RANDR" missing on display "localhost:10.0".

Is that related to the warning? (I'm guessing not. If it's not, I'll file a new question about that.)

share|improve this question
IS the xauth program installed on the ubuntu server ? – slubman May 26 '11 at 9:17
sudo apt-get install xauth tells me "xauth is already the newest version" – Daryl Spitzer May 26 '11 at 19:00
When logged in on the ubuntu server, what is the output of 'which xauth' ? – slubman May 26 '11 at 19:50
Indeed I think you should read this explanation: … you can ignore this warning – slubman May 26 '11 at 20:00
occasionally this can be caused by issues w/ your ~/.Xauthority file. If you delete it, it will be re-created the next time you attempt to login. – michael_n Aug 22 '12 at 4:15

5 Answers 5

up vote 53 down vote accepted

Any reason you don't want to use the -Y flag instead of the -X flag?

Quite simply, the difference between -X and -Y is that -Y enables trusted X11 forwarding.

share|improve this answer
No, I just wasn't aware of the -Y flag when I wrote the question. I believe that did turn out to be a solution. Change your answer so it's not a question (and it would be nice if you briefly explained the difference between -Y and -C) and I'll accept it. – Daryl Spitzer Feb 2 '12 at 1:44
is there any case when you wouldnt want to use -Y instead of -X ? – Rooster Jul 3 at 19:06

If you're coming here in 2015: even if everything else is set up properly, this can also happen on Mac OS X 10.10 Yosemite, when using ssh -X and running an XQuartz version <= 2.7.7. The root cause is X11 display sockets getting written outside of the xauth search path: issue #2068 in the XQuartz tracker.

XQuartz 2.7.8 has a fix, and installing it worked around this for me.

share|improve this answer
Thank you! I had no idea that the XQuartz I just downloaded from the top of the XQuartz page is not actually the latest release. – craigds Aug 7 at 4:57
thank you! you made my day – Rimbuaj Aug 12 at 15:27

If you get the same message even when using -Y, the xauth program might be missing on the server. On Debian-like systems, you need the xauth package.

share|improve this answer
On RedHat systems, you'll need to install xorg-x11-xauth. – Craig Trader Jul 1 at 6:33

I don't have a setup that can exhibit this behavior, so this is a shot in the dark:

The warning might be suppressed if you set ForwardX11Trusted to "no" for hosts that give this warning. You can place this in either ~/.ssh/config or /etc/ssh/ssh_config, and you can make the option specific to a particular host by including Host <hostname> on the line above. the <hostname> component matches what you type on the command line (not the resolved hostname), and it can include wildcards.

share|improve this answer
One can use ssh -Y to do trusted X11 forwarding but how can one fix the untrusted one? – Pavel Šimerda Oct 1 at 12:45

In most cases Flup's answer is the best, but there are corner cases where his answer falls short, specifically if xauth does not work right. One particularly annoying case was a corrupted .Xauthority file. The particular case allowed some x clients to work but not others with a greater tendency to fail with newer displays. Removing and recreating the .Xauthority file solved that problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.