Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I use ssh -X on my Mac (running OS X 10.6.7) to connect to my Ubuntu (11.04) box, I get the following warning:

Warning: untrusted X11 forwarding setup failed: xauth key data not generated Warning: No xauth data; using fake authentication data for X11 forwarding.

Is there something I can do to make this warning go away? If not, can I safely ignore it?

X11 forwarding seems to work fine, though I do see this message:

Xlib: extension "RANDR" missing on display "localhost:10.0".

Is that related to the warning? (I'm guessing not. If it's not, I'll file a new question about that.)

share|improve this question
    
IS the xauth program installed on the ubuntu server ? – slubman May 26 '11 at 9:17
    
sudo apt-get install xauth tells me "xauth is already the newest version" – Daryl Spitzer May 26 '11 at 19:00
    
When logged in on the ubuntu server, what is the output of 'which xauth' ? – slubman May 26 '11 at 19:50
    
Indeed I think you should read this explanation: mail-archive.com/cygwin-xfree@cygwin.com/msg17927.html … you can ignore this warning – slubman May 26 '11 at 20:00
2  
occasionally this can be caused by issues w/ your ~/.Xauthority file. If you delete it, it will be re-created the next time you attempt to login. – michael_n Aug 22 '12 at 4:15
up vote 62 down vote accepted

Any reason you don't want to use the -Y flag instead of the -X flag?

Quite simply, the difference between -X and -Y is that -Y enables trusted X11 forwarding.

share|improve this answer
2  
No, I just wasn't aware of the -Y flag when I wrote the question. I believe that did turn out to be a solution. Change your answer so it's not a question (and it would be nice if you briefly explained the difference between -Y and -C) and I'll accept it. – Daryl Spitzer Feb 2 '12 at 1:44
    
is there any case when you wouldnt want to use -Y instead of -X ? – Rooster Jul 3 '15 at 19:06
    
@Rooster for very old systems where -Y isn't supported I would say – Petr Jan 15 at 7:53

If you're coming here in 2015: even if everything else is set up properly, this can also happen on Mac OS X 10.10 Yosemite, when using ssh -X and running an XQuartz version <= 2.7.7. The root cause is X11 display sockets getting written outside of the xauth search path: issue #2068 in the XQuartz tracker.

XQuartz 2.7.8 has a fix, and installing it worked around this for me.

share|improve this answer
1  
Thank you! I had no idea that the XQuartz I just downloaded from the top of the XQuartz page is not actually the latest release. – craigds Aug 7 '15 at 4:57
    
thank you! you made my day – Rimbuaj Aug 12 '15 at 15:27
    
Worth noting that brew install xquartz presently installs the out of date 2.7.7 version. – Martin Cleaver Jan 9 at 23:03

If you get the same message even when using -Y, the xauth program might be missing on the server. On Debian-like systems, you need the xauth package.

share|improve this answer
1  
On RedHat systems, you'll need to install xorg-x11-xauth. – Craig Trader Jul 1 '15 at 6:33

I don't have a setup that can exhibit this behavior, so this is a shot in the dark:

The warning might be suppressed if you set ForwardX11Trusted to "no" for hosts that give this warning. You can place this in either ~/.ssh/config or /etc/ssh/ssh_config, and you can make the option specific to a particular host by including Host <hostname> on the line above. the <hostname> component matches what you type on the command line (not the resolved hostname), and it can include wildcards.

share|improve this answer
    
One can use ssh -Y to do trusted X11 forwarding but how can one fix the untrusted one? – Pavel Šimerda Oct 1 '15 at 12:45

"Untrusted" in this context means you don't trust the connection. SSH will use additional security measures to try to make X11 forwarding safer. "Trusted" means you are entirely confident that no on on the remote host will get access to your Xauth data and use it to monitor your keystrokes for instance.

This terminology actually confused me for years. I thought "Trusted" connections were safer. But actually it's an option you're supposed to use in situations where the connection IS trustworthy and you want to run stuff without extra security measures getting in your way. "Untrusted" is the one that makes it (somewhat) safer to deal with an untrusted remote host.

An "Untrusted" connection attempts to limit what a black hat could do to you by engaging the X11 security extension and disabling other extensions that you (hopefully) don't need. This is probably why RandR is disabled with -X. Do you need to be able to rotate your X display from the remote host?

It's also important to note that "untrusted" X11 forwarding turns off after a certain amount of time to keep you from accidentally leaving it on. New attempts to open windows will just fail after that. That bit me several times before I read enough docs to understand what was happening.

share|improve this answer

In most cases Flup's answer is the best, but there are corner cases where his answer falls short, specifically if xauth does not work right. One particularly annoying case was a corrupted .Xauthority file. The particular case allowed some x clients to work but not others with a greater tendency to fail with newer displays. Removing and recreating the .Xauthority file solved that problem.

share|improve this answer

xauth add `hostname`/unix:10 MIT-MAGIC-COOKIE-1 `openssl rand -hex 16`

share|improve this answer
1  
I don't understand ... – Pierre.Vriens Jun 11 at 6:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.