So here's my situation: I work for my school as a tech. One of our servers has a firewall problem and isn't accepting connections from outside the network.

I tried to SSH into one of the servers that IS working, and then SSH into the problem server from that using Mac's Terminal:

ssh -X11 -2 [email protected] # runs some Linux (don't remember which distro)
ssh -X11 -2 [email protected] # runs Ubuntu 11.04

If I try to run nautilus, I get "X11 connection rejected because of wrong authentication." four times in a row, then "Could not parse arguments: Cannot open display:"

I could wait for IT to fix the firewall issue but I have some work I need to get done the sooner the better, and using the command line slows things down quite a bit.

Sidenote: I don't think goodserver has X11 installed.

  • trying to use X11 over multiple ssh 'hops' won't work.
    – user87664
    Aug 2, 2011 at 0:05
  • Aw. Well fortunately I just got our Lion server running so I can screen share to that and then ssh -X11 to the other server from that. Post your comment as an answer and I'll accept it. Aug 2, 2011 at 0:15
  • 1
    Never say never, @BCV.
    – womble
    Aug 2, 2011 at 0:36
  • Are you sure the option is -X11? I always use -X. (And I just tried this, it seems to work. Of course, not with root.) (The -X11 is about the same as -X -1 -1, and the -1 you undo with -2 afterwards.) Aug 2, 2011 at 1:21

3 Answers 3


You can do this, but not the way you think. What you want to do is use the SSH ProxyCommand configuration option (see ssh_config(5) for examples) to allow you to make an SSH connection directly from your local machine to the destination, tunneling the SSH connection inside one or more other connections. You're not making multiple "hops", just a series of tunnels.

  • nc -x for the win! Aug 2, 2011 at 12:50
  • I stand corrected ;)
    – user87664
    Aug 2, 2011 at 14:03

Using ProxyCommand like @womble told you works. For me another way works, too. I also need to occasionally run remote X programs from a computer that's behind another server, so I need to connect from my laptop to a server and from there to my final destination. I do it like this:

ssh -YC me@myserver

and then from the server

ssh -YC me@myanothercomputer

So I use -YC instead of -X. Even the -Cis not needed, it's just compression, it helps me a bit if I'm behind a slow connection.

  • some background: -Y means "trusted connection". X11 servers have extensions, like Xrandr. Some of these extensions can allow someone with X permissions to sniff local events (mouse movements, etc.) So these extensions are disabled by default unless -Y is used. On other ssh clients like Solaris', all connections are trusted so -Y doesn't exist. Personally, I've only ever needed this when running some Java apps. And in the OP's case I think vanilla -X would work if he had X installed on the middle server. But +1 Aug 2, 2011 at 12:48

Sidenote: I don't think goodserver has X11 installed.

I think this is the problem - ssh -X will try to forward any remote incoming X connections to the local X server, and this seems to be impossible if there is no local X library and such. (It might be that SSH actually uses the X library for the cookie rewriting.)

I just tried your commands, and it worked fine - but here the intermediate server had the X binaries, too. (It has no monitor, though.)

So, use the proposal by womble: use one SSH connection to goodserver, create a tunnel in this connection, and then run a second connection through this tunnel. (I normally do this using the JSch SSH client library for Java, but it is also possible with command line SSH.)

ssh -L localhost:2222:badserver:22 -N root@goodserver &
ssh -X -p 2222 root@localhost

You might need the -o NoHostAuthenticationForLocalHost=yes for the second command to avoid your SSH client to howl if you already have another key for localhost stored in your known hosts file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .