X11 and ezjails

[James B. Byrne]

On Fri, March 31, 2017 14:45, Polytropon wrote:
> On Fri, 31 Mar 2017 13:39:29 -0400, James B. Byrne via
> freebsd-questions wrote:
>> I would like to run gvim in an X11 window over ssh to a jailed
>> instance created with ezjail.  I have set sshd_config in the jail to
>> allow X11Forwarding and I am connecting with 'ssh -Y
>> jail.domain.tld'
>>
>> However, when I log into the jail and run gvim then I see this:
>>
>> # gvim
>> X11 connection rejected because of wrong authentication.
>> E233: cannot open display
>> Press ENTER or type command to continue
>>
>> E852: The child process failed to start the GUI
>> X11 connection rejected because of wrong authentication.
>>
>>
>> I have run into this before and have attempted to apply all of the
>> previous remedies but nothing seems to work.  Is there anything
>> about jails themselves that would prevent X11 forwarding?
>
> Just a very stupid question: You _did_ set $DISPLAY as needed?
> See "man ssh", section X11 FORWARDING.
>
>

echo $DISPLAY
localhost:10.0

I have this in the local host's ssh_config:

Host *
	GSSAPIAuthentication yes
# If this option is set to yes then remote X11 clients will
# have full access to the original X11 display. As virtually
# no X11 client supports the untrusted mode correctly we set
# this to yes.
	ForwardX11Trusted yes
	ForwardAgent yes
# Send locale-related environment variables
	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE
	SendEnv LC_MONETARY LC_MESSAGES
	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
	SendEnv XMODIFIERS
	Protocol 2

I have this in the remote host jail /etc/ssh/sshd_config:

GatewayPorts			no
AllowTcpForwarding		yes
KeepAlive			yes
IgnoreRhosts			yes
Banner				/etc/ssh/ssh_pre_logon.txt
IgnoreUserKnownHosts		no
PrintMotd			yes
StrictModes			yes
PubkeyAuthentication		yes
RSAAuthentication		no
PermitRootLogin			without-password
PermitEmptyPasswords		no
X11Forwarding			yes
X11DisplayOffset		10
X11UseLocalhost			yes


I connect using this:

ssh 192.168.209.33  -t -X 'bash || sh'

When I attempt to run gvim over a session created with the above ssh
command then I get this

gvim
X11 connection rejected because of wrong authentication.
E233: cannot open display
Press ENTER or type command to continue

E852: The child process failed to start the GUIX11 connection rejected
because of wrong authentication.

I only encounter this on jailed instances on the remote host.  On the
remote host itself gvim works over ssh connections without difficulty.

I regret the delay in returning to this issue but other matters proved
more pressing in the meantime.

Any ideas respecting resolving this are most welcome.


-- 
***          e-Mail is NOT a SECURE channel          ***
        Do NOT transmit sensitive data via e-Mail
 Do NOT open attachments nor follow links sent by e-Mail

James B. Byrne                mailto:ByrneJB at Harte-Lyne.ca
Harte & Lyne Limited          http://www.harte-lyne.ca
9 Brockley Drive              vox: +1 905 561 1241
Hamilton, Ontario             fax: +1 905 561 0757
Canada  L8E 3C3