Mailing List Archive: SSH X11 Setting the Display Variable

SSH X11 Setting the Display Variable

May 19, 2009, 5:08 PM

Post #1 of 7 (5717 views)

Is there a way to have the DISPLAY variable set the way that sshd sets it when a clientconnects with either -X or -Y option, but after the shell loads? It would be best of thiscould only be done if the shell was started by an ssh session that used the -X or -Y option.
The specific ssh version in question is listed below, but I would like to have solutions fornewer versions of ssh as well.
OpenSSH_4.6p1 Debian-5ubuntu0.6, OpenSSL 0.9.8e 23 Feb 2007

This is the situation. I am running a coLinux based distro named andLinux, which basicallyis Ubuntu 7.04 running parallel with Windows. It has this "hack" that allows X forwardingover a virtual network interface that provides inter OS network between Windows and Linux.The X forwarding is used to load Linux X apps, Xfce based in this case, in Windows usingXming. To make this work, the following line is in /etc/profile.
export DISPLAY=192.168.11.1:0.0

Early on, I found that this prevented X forwarding to work when I sshed to andLinux via theopen network interface, the interface used to access other computers on my network andthe internet through my firewall. I got around this by adding the following to ~/.profile
export DISPLAY=localhost:10.0

This has 2 issues. The first is that I have to add this for each user. In this case that is nobiggie, but it would be great if I could override this for all users always. The second is oneI found today and that is because I have statically set this variable all ssh sessions use 10and that means that no-matter which ssh session I try to X forward in, the X app is sent tothe computer that crated the first ssh session that successfully had X forwarding set. Therub is that since andLinux "needs" the specific $DISPLAY setting set in /etc/profile, it isinherited by all shell sessions and it gets set after sshd sets this variable. This is a problemfor me as I may be connected from several places with x forwarding enabled. I know I canmanually set this, but that has 2 issues.
1) I have to set it every time.
2) The bigger issue is, I learn nothing by doing that.
So if I were to break down the parts of the $DISPLAY variable in to the following.
DISPLAY=x:y.z
and
DISPLAY=localhost:10.0

then
x = localhosty = 10z = 0
So I want to be able to set it so that $DISPLAY is set with a different y for each session thatsuccessfully creates an X forwarding session.
Any ideas or hints?
In case it helps.
uname -aLinux andLinux 2.6.22.18-co-0.7.3 #1 PREEMPT Wed Apr 16 18:50:10 UTC 2008 i686 GNU/Linux

# cat /etc/debian_version lenny/sid
# cat /etc/issue Ubuntu 7.10 \n \l
I have a new version of this andLinux, details below.

Thanks,
Chris

_________________________________________________________________
Hotmail® has a new way to see what's up with your friends.
http://windowslive.com/Tutorial/Hotmail/WhatsNew?ocid=TXT_TAGLM_WL_HM_Tutorial_WhatsNew1_052009

Re: SSH X11 Setting the Display Variable [ In reply to ]

daniel at xyz-network

May 21, 2009, 1:32 PM

Post #2 of 7 (5567 views)

Permalink

this didn't make it to the list:

On Wed, May 20, 2009 at 1:08 AM, Chris Mirchandani <novashadow@msn.com> wrote:

> ... To make this work, the following line is in /etc/profile.
> export DISPLAY=192.168.11.1:0.0

> ... I got around this by adding the following to ~/.profile
> export DISPLAY=localhost:10.0

how about in /etc/profile setting the following:?

----
if [ -z "$DISPLAY" ]; then export DISPLAY=192.168.11.1:0.0; fi
----

the above tests for emptyness of the $DISPLAY variable, and sets it to
the predefined setting (192.168.11.1:0.0) if it hasn't already been
set by sshd. (I hope)

--
Regards,
Â Â Daniel Llewellyn

RE: SSH X11 Setting the Display Variable [ In reply to ]

novashadow at msn

May 28, 2009, 9:17 PM

Post #3 of 7 (5658 views)

Permalink

OK, I found one hole in this script. If I ssh in as any user, the script does what it is supposedto do and the DISPLAY variable value is left as set by ssh. However, if I su -l to another userDISPLAY=192.168.11.1:0.0. If I su to the same user without -l the DISPLAY variable value is leftas set by ssh when the initial user was logged in. Any ideas and/or suggestions?

Thanks,
Chris

----------------------------------------
> Date: Thu, 21 May 2009 21:32:38 +0100
> Subject: Re: SSH X11 Setting the Display Variable
> From: daniel@xyz-network.com
> To: secureshell@securityfocus.com
>
> this didn't make it to the list:
>
> On Wed, May 20, 2009 at 1:08 AM, Chris Mirchandani wrote:
>
>> ... To make this work, the following line is in /etc/profile.
>> export DISPLAY=192.168.11.1:0.0
>
>> ... I got around this by adding the following to ~/.profile
>> export DISPLAY=localhost:10.0
>
> how about in /etc/profile setting the following:?
>
> ----
> if [ -z "$DISPLAY" ]; then export DISPLAY=192.168.11.1:0.0; fi
> ----
>
> the above tests for emptyness of the $DISPLAY variable, and sets it to
> the predefined setting (192.168.11.1:0.0) if it hasn't already been
> set by sshd. (I hope)
>
> --
> Regards,
> Daniel Llewellyn

_________________________________________________________________
Windows Live™: Keep your life in sync.
http://windowslive.com/explore?ocid=TXT_TAGLM_BR_life_in_synch_052009

Re: SSH X11 Setting the Display Variable [ In reply to ]

daniel at xyz-network

May 29, 2009, 6:49 AM

Post #4 of 7 (5628 views)

Permalink

On Fri, May 29, 2009 at 05:17, Chris Mirchandani <novashadow@msn.com> wrote:
> OK, I found one hole in this script. If I ssh in as any user, the script does what it is supposedto do and the DISPLAY variable value is left as set by ssh. However, if I su -l to another userDISPLAY=192.168.11.1:0.0. If I su to the same user without -l the DISPLAY variable value is leftas set by ssh when the initial user was logged in. Any ideas and/or suggestions?

I wouldn't have said that was a hole "per se", more a "feature" with
the way that `su -l` is designed to work. The point of the -l switch
is that the environment is set from a clean slate when entering the
new user context. This means that any pre-existing DISPLAY variable
will be blanked out along with the rest of the new shell's
environment. Then /etc/profile is run through to set up the initial
environment for said new shell, which will detect the lack of DISPLAY
variable and set up the default (192.168.11.1:0.0).

--
Regards,
Daniel Llewellyn

Re: SSH X11 Setting the Display Variable [ In reply to ]

dnelson at allantgroup

May 29, 2009, 2:23 PM

Post #5 of 7 (5500 views)

Permalink

In the last episode (May 29), Daniel Llewellyn said:
> On Fri, May 29, 2009 at 05:17, Chris Mirchandani <novashadow@msn.com> wrote:
> > OK, I found one hole in this script. If I ssh in as any user, the script does what it is supposedto do and the DISPLAY variable value is left as set by ssh. However, if I su -l to another userDISPLAY=192.168.11.1:0.0. If I su to the same user without -l the DISPLAY variable value is leftas set by ssh when the initial user was logged in. Any ideas and/or suggestions?
>
> I wouldn't have said that was a hole "per se", more a "feature" with the
> way that `su -l` is designed to work. The point of the -l switch is that
> the environment is set from a clean slate when entering the new user
> context. This means that any pre-existing DISPLAY variable will be
> blanked out along with the rest of the new shell's environment. Then
> /etc/profile is run through to set up the initial environment for said new
> shell, which will detect the lack of DISPLAY variable and set up the
> default (192.168.11.1:0.0).

That depends; some systems have a pam_xauth module that preserves $DISPLAY,
copies your current xauth key to a file readable by target user, and points
$XAUTHORITY at the temp file. Handy when you're su'ing to root to run a
graphical installer.

--
Dan Nelson
dnelson@allantgroup.com

RE: SSH X11 Setting the Display Variable [ In reply to ]

novashadow at msn

May 29, 2009, 11:19 PM

Post #6 of 7 (5497 views)

Permalink

Greetings,
I assume that the pam_xauth module that Mr. Nelson brought up requires "UsePAM yes" in the sshd_config file that is loaded by sshd. I added it and got no where. Before enabling PAM, through more research, I found a solution. The solution seems to be the sux command. It seems to be designed for exactly that purpose and I confirmed that it works. It has several options and I am not sure if it takes all su options or own its own, but the basics are below.
sux works like su sux - works like su -l
Of course the exception is that using sux keeps the DISPLAY settings and transfers the X credentials to the su user. It works with the script below that Mr. Llewellyn provided for my special situation where andLinux set the DISPLAY variable in /etc/profile. Locally DISPLAY=192.168.11.1:0.0 and su works with that. Remotely vi ssh access DISPLAY= and sux keeps that across users when using the - option which loads the new users environment variables.
if [ -z "$DISPLAY" ]; then
export DISPLAY=192.168.11.1:0.0
fi

----------------------------------------
> Date: Fri, 29 May 2009 16:23:35 -0500
> From: dnelson@allantgroup.com
> To: daniel@xyz-network.com
> CC: novashadow@msn.com; secureshell@securityfocus.com
> Subject: Re: SSH X11 Setting the Display Variable
>
> In the last episode (May 29), Daniel Llewellyn said:
>> On Fri, May 29, 2009 at 05:17, Chris Mirchandani wrote:
>>> OK, I found one hole in this script. If I ssh in as any user, the script does what it is supposedto do and the DISPLAY variable value is left as set by ssh. However, if I su -l to another userDISPLAY=192.168.11.1:0.0. If I su to the same user without -l the DISPLAY variable value is leftas set by ssh when the initial user was logged in. Any ideas and/or suggestions?
>>
>> I wouldn't have said that was a hole "per se", more a "feature" with the
>> way that `su -l` is designed to work. The point of the -l switch is that
>> the environment is set from a clean slate when entering the new user
>> context. This means that any pre-existing DISPLAY variable will be
>> blanked out along with the rest of the new shell's environment. Then
>> /etc/profile is run through to set up the initial environment for said new
>> shell, which will detect the lack of DISPLAY variable and set up the
>> default (192.168.11.1:0.0).
>
> That depends; some systems have a pam_xauth module that preserves $DISPLAY,
> copies your current xauth key to a file readable by target user, and points
> $XAUTHORITY at the temp file. Handy when you're su'ing to root to run a
> graphical installer.
>
> --
> Dan Nelson
> dnelson@allantgroup.com

----------------------------------------
> Date: Fri, 29 May 2009 10:24:03 -0600
> Subject: Re: SSH X11 Setting the Display Variable
> To: novashadow@msn.com
> From: remo-dated-1244046244.fd158e@italy1.com
>
> This is normal part of security. I had the same problem while back. But I
> cannot remember what I did to fix it.
>
> ciao

_________________________________________________________________
Hotmail® goes with you.
http://windowslive.com/Tutorial/Hotmail/Mobile?ocid=TXT_TAGLM_WL_HM_Tutorial_Mobile1_052009

RE: SSH X11 Setting the Display Variable [ In reply to ]

novashadow at msn

May 30, 2009, 6:43 AM

Post #7 of 7 (5500 views)

Permalink

OK wow, my email client is working hard to make my emails unreadable. Here it is again,with some added detail.
I assume that the pam_xauth module that Mr. Nelson brought up requires "UsePAM yes"in the sshd_config file that is loaded by sshd. I added pam_xauth and got no where.Before enabling PAM, through more research, I found a solution. The sux command is asolution. It seems to be designed for exactly this purpose, keeping x credentials fora user when you su to load that user, and I confirmed that it works. It has several options and I am not sure if it takes all su options or only its own, but it seemslike it has most of the same options as su. The basics are below.
sux works like su

sux - works like su -l
Of course the exception is that using sux keeps the DISPLAY settings and transfersthe X credentials to the su user. It works with the script below that Mr. Llewellynprovided for my special situation where andLinux sets the DISPLAY variable in/etc/profile. Locally DISPLAY=192.168.11.1:0.0 and su works with that as expected.Remotely vi ssh access DISPLAY= and sux keeps that across users whenusing the - option which loads the new users environment variables.
# This script lets andLinux set the DISPLAY variable locally and ssh set it when# this copy of Linux is access via ssh with -X or -Y.
if [ -z "$DISPLAY" ]; then
export DISPLAY=192.168.11.1:0.0
fi
----------------------------------------
> From: novashadow@msn.com
> To: dnelson@allantgroup.com; daniel@xyz-network.com; remo-dated-1244046244.fd158e@italy1.com
> CC: secureshell@securityfocus.com
> Subject: RE: SSH X11 Setting the Display Variable
> Date: Sat, 30 May 2009 02:19:03 -0400
>
>
> Greetings,
> I assume that the pam_xauth module that Mr. Nelson brought up requires "UsePAM yes" in the sshd_config file that is loaded by sshd. I added it and got no where. Before enabling PAM, through more research, I found a solution. The solution seems to be the sux command. It seems to be designed for exactly that purpose and I confirmed that it works. It has several options and I am not sure if it takes all su options or own its own, but the basics are below.
> sux works like su sux - works like su -l
> Of course the exception is that using sux keeps the DISPLAY settings and transfers the X credentials to the su user. It works with the script below that Mr. Llewellyn provided for my special situation where andLinux set the DISPLAY variable in /etc/profile. Locally DISPLAY=192.168.11.1:0.0 and su works with that. Remotely vi ssh access DISPLAY= and sux keeps that across users when using the - option which loads the new users environment variables.
> if [ -z "$DISPLAY" ]; then
> export DISPLAY=192.168.11.1:0.0
> fi
>
>
> ----------------------------------------
>> Date: Fri, 29 May 2009 16:23:35 -0500
>> From: dnelson@allantgroup.com
>> To: daniel@xyz-network.com
>> CC: novashadow@msn.com; secureshell@securityfocus.com
>> Subject: Re: SSH X11 Setting the Display Variable
>>
>> In the last episode (May 29), Daniel Llewellyn said:
>>> On Fri, May 29, 2009 at 05:17, Chris Mirchandani wrote:
>>>> OK, I found one hole in this script. If I ssh in as any user, the script does what it is supposedto do and the DISPLAY variable value is left as set by ssh. However, if I su -l to another userDISPLAY=192.168.11.1:0.0. If I su to the same user without -l the DISPLAY variable value is leftas set by ssh when the initial user was logged in. Any ideas and/or suggestions?
>>>
>>> I wouldn't have said that was a hole "per se", more a "feature" with the
>>> way that `su -l` is designed to work. The point of the -l switch is that
>>> the environment is set from a clean slate when entering the new user
>>> context. This means that any pre-existing DISPLAY variable will be
>>> blanked out along with the rest of the new shell's environment. Then
>>> /etc/profile is run through to set up the initial environment for said new
>>> shell, which will detect the lack of DISPLAY variable and set up the
>>> default (192.168.11.1:0.0).
>>
>> That depends; some systems have a pam_xauth module that preserves $DISPLAY,
>> copies your current xauth key to a file readable by target user, and points
>> $XAUTHORITY at the temp file. Handy when you're su'ing to root to run a
>> graphical installer.
>>
>> --
>> Dan Nelson
>> dnelson@allantgroup.com
>
> ----------------------------------------
>> Date: Fri, 29 May 2009 10:24:03 -0600
>> Subject: Re: SSH X11 Setting the Display Variable
>> To: novashadow@msn.com
>> From: remo-dated-1244046244.fd158e@italy1.com
>>
>> This is normal part of security. I had the same problem while back. But I
>> cannot remember what I did to fix it.
>>
>> ciao
>
> _________________________________________________________________
> Hotmail® goes with you.
> http://windowslive.com/Tutorial/Hotmail/Mobile?ocid=TXT_TAGLM_WL_HM_Tutorial_Mobile1_052009

_________________________________________________________________
Insert movie times and more without leaving Hotmail®.
http://windowslive.com/Tutorial/Hotmail/QuickAdd?ocid=TXT_TAGLM_WL_HM_Tutorial_QuickAdd1_052009