CentOS - Feb 2006 - ssh x11 forwarding problem

I'm running into an a problem with x11 forwarding over ssh

I'm trying to run an application (rasmol -  molecule viewing program)  
which when using the the default setup for x11 forwarding causes the  
following error:

X Error of failed request:  BadAccess (attempt to access private  
resource denied)
   Major opcode of failed request:  132 (MIT-SHM)
   Minor opcode of failed request:  1 (X_ShmAttach)
   Serial number of failed request:  230
   Current serial number in output stream:  231


It used to be possible to overcome this by setting

X11UseLocalhost  no

in /etc/ssh/sshd_config

This worked in CentOS 3 but does not in CentOS 4 (or Fedora 4 for  
that matter), and I'm guessing it is a XFree86 vs. Xorg issue.

Now, when using
X11UseLocalhost no

no X applications work

ssh myserver
# echo $DISPLAY
myserver.fqdn:10.0
# xdpyinfo
xdpyinfo:  unable to open display "myserver.fqdn:10.0".


I have X11 forwarding set up on the client side by default.

on the other hand if I don't use tunneling, but set  DISPLAY=myclient: 
0 and xhost +myserver on the client
then the application works.

I prefer to use tunneling if possible.

Thoughts about why X11UseLocalhost doesn't work?
Tony Schreiner

On Fri, February 17, 2006 10:02 am, Tony Schreiner said:
> I'm running into an a problem with x11 forwarding over ssh
>
> I'm trying to run an application (rasmol -  molecule viewing program)
> which when using the the default setup for x11 forwarding causes the
> following error:
>
> X Error of failed request:  BadAccess (attempt to access private
> resource denied)
>    Major opcode of failed request:  132 (MIT-SHM)
>    Minor opcode of failed request:  1 (X_ShmAttach)
>    Serial number of failed request:  230
>    Current serial number in output stream:  231
>
>
> It used to be possible to overcome this by setting
>
> X11UseLocalhost  no
>
> in /etc/ssh/sshd_config
>
> This worked in CentOS 3 but does not in CentOS 4 (or Fedora 4 for
> that matter), and I'm guessing it is a XFree86 vs. Xorg issue.
>
> Now, when using
> X11UseLocalhost no
>
> no X applications work
>
> ssh myserver
> # echo $DISPLAY
> myserver.fqdn:10.0
> # xdpyinfo
> xdpyinfo:  unable to open display "myserver.fqdn:10.0".
>
>
> I have X11 forwarding set up on the client side by default.
>
> on the other hand if I don't use tunneling, but set  DISPLAY=myclient:
> 0 and xhost +myserver on the client
> then the application works.
>
> I prefer to use tunneling if possible.
>
> Thoughts about why X11UseLocalhost doesn't work?
> Tony Schreiner
I believe setting ForwardX11Trusted to "yes" (or using -Y command line
option) will do the trick for you.

Marko

Am Fr, den 17.02.2006 schrieb Tony Schreiner um 16:02:
> I'm running into an a problem with x11 forwarding over ssh
> 
> I'm trying to run an application (rasmol -  molecule viewing program)  
> which when using the the default setup for x11 forwarding causes the  
> following error:
> 
> X Error of failed request:  BadAccess (attempt to access private  
> resource denied)
>    Major opcode of failed request:  132 (MIT-SHM)
>    Minor opcode of failed request:  1 (X_ShmAttach)
>    Serial number of failed request:  230
>    Current serial number in output stream:  231
http://www.openssh.org/faq.html#3.13
> Tony Schreiner
Alexander


-- 
Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773
legal statement: http://www.uni-x.org/legal.html
Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.11-1.35_FC2smp 
Serendipity 16:31:19 up 7 days, 1:22, load average: 0.31, 0.15, 0.04 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
URL:
<http://lists.centos.org/pipermail/centos/attachments/20060217/1e74917c/attachment-0002.sig>

On Feb 17, 2006, at 10:31 AM, Alexander Dalloz wrote:
> Am Fr, den 17.02.2006 schrieb Tony Schreiner um 16:02:
>
>> I'm running into an a problem with x11 forwarding over ssh
>>
>> I'm trying to run an application (rasmol -  molecule viewing
program)
>> which when using the the default setup for x11 forwarding causes the
>> following error:
>>
>> X Error of failed request:  BadAccess (attempt to access private
>> resource denied)
>>    Major opcode of failed request:  132 (MIT-SHM)
>>    Minor opcode of failed request:  1 (X_ShmAttach)
>>    Serial number of failed request:  230
>>    Current serial number in output stream:  231
>
> http://www.openssh.org/faq.html#3.13
>
Unfortunately for me, I already had set
ForwardX11Trusted yes

in my client ssh_config, so that doesn't seem to be the solution in  
this case.

I gather that this setting is all about the "access private resource  
denied" errror; but not related to my X11UseLocalhost issue.

Tony Schreiner

Tony Schreiner <schreian at bc.edu> wrote:
>I'm trying to run an application (rasmol -  molecule viewing program)  
>which when using the the default setup for x11 forwarding causes the  
>following error:
>
>X Error of failed request:  BadAccess (attempt to access private  
>resource denied)
>   Major opcode of failed request:  132 (MIT-SHM)
>   Minor opcode of failed request:  1 (X_ShmAttach)
>   Serial number of failed request:  230
>   Current serial number in output stream:  231
>
>
>It used to be possible to overcome this by setting
>
>X11UseLocalhost  no
>
>in /etc/ssh/sshd_config
>
>This worked in CentOS 3 but does not in CentOS 4 (or Fedora 4 for  
>that matter), and I'm guessing it is a XFree86 vs. Xorg issue.
>
>Now, when using
>X11UseLocalhost no
>
>no X applications work
>
>ssh myserver
># echo $DISPLAY
>myserver.fqdn:10.0
># xdpyinfo
>xdpyinfo:  unable to open display "myserver.fqdn:10.0".
It appears that in FC4 setting 'X11UseLocalhost no' causes sshd to
listen
for X connections only on the IPV6 port:

$ netstat -ant | grep 6010
tcp        0      0 :::6010                     :::*                       
LISTEN

I'd say this was a bug, and indeed there is such a report in the openssh
bugzilla, but it's supposed to have been fixed years ago.  I've tried
forcing sshd to use IPV4 only (with the -4 flag) but that just gets me
back into the land of X authentication failures.

The problem with rasmol is that it tries to use the X shared memory extension
if it thinks it's running on the same host as the X server.  To rasmol an
ssh-forwarded X connection looks like a local connection, so it tries to
use shared memory and fails.  The 'X11UseLocalhost no' trick works
because
it makes the forwarded connection look like a connection to a remote machine
so the application falls back to using an alternative.

Looking at the source for rasmol I see that it uses this test to determine
if it can use MIT-SHM:

   ptr = DisplayString(dpy);
   if( !ptr || (*ptr==':') || !strncmp(ptr,"localhost:",10) ||
		   !strncmp(ptr,"unix:",5) || !strncmp(ptr,"local:",6) )

So even with 'X11UseLocalhost yes' it might be possible to fool it into
not
using MIT-SHM by setting your DISPLAY to '127.0.0.1:10.0' (or whatever).

Ron