ubuntu-mate, X11 cannot open the Display (solved) - Page 1
Forum section: electronics / general

author: DiTBho
author_rank: Super Contributor
timestamp: February 26, 2024, 08:49:29 pm
content: so, I usually create rootfs myself (Gentoo Catalyst), this time I'm with a laptop that has Ubuntu-Mate pre-installed in flash.I can ssh to a remote machine, everything is fine with this, but there is something wrong with X11.Already tried/checkedxhost +192.168.1.81 and/or xhost +/etc/ssh/sshd_config has "X11forwarding = yes"ssh remote_machine_IP -Yssh remote_machine_IP(192.168.1.81) -Y correctly sets the DISPLAY variable to "192.168.1.115:0.0", which is the IP of the laptop, and forces "X11forwarding=Yes" plus "trust it"; ssh connects, however, "xclock" always gets the answer "cannot open the display".Any idea?server: 192.168.1.81laptop: 192.168.1.115notes:"xhost +" disables the access control, clients can connect from any hostEnable X11 forwarding, by the -X optionEnable trusted X11 forwarding, by using the -Y option

author: DiTBho
author_rank: Super Contributor
timestamp: February 26, 2024, 08:54:34 pm
content: (Temporary solution to get that damn X11 workingThe laptop doesn't have an SSD, both kernel and rootfs are on an eMMC chip, which I can't reprogram at the moment.For sure, in the near future, the end of March?, will definitely wipe out and flash my stage 4 onto it)

author: DiTBho
author_rank: Super Contributor
timestamp: February 29, 2024, 07:53:16 am
content: Personally, I do find Ubuntu ... a weird distro.I edited all the files related to bothXorgandlightdm, the default display manager used by Ubuntu-mate,removedCode:-nolisten tcpand addedCode:-listen tcpto every instance of parameters passed to /usr/bin/xorg, however, once restarted, it did not even show the port 6000.Which is weirdEven stranger, if I now connect to a remote machine via ssh, export the display, and try to launch xclock...Code:# xhost +# ssh 192.168.1.81# export DISPLAY=192.168.1.115:0.0# xclockit no longer says it can't find the display, it just doesn't show anything

author: DiTBho
author_rank: Super Contributor
timestamp: February 29, 2024, 07:55:19 am
content: um, sshd has the following opts setCode:X11Forwarding yesX11DisplayOffset 10X11UseLocalhost no

author: alm
author_rank: Super Contributor
timestamp: February 29, 2024, 08:36:41 am
content: Quote from: DiTBho on February 29, 2024, 07:53:16 amTry being a bit less ham-fisted, and look for a proper solution likethis. Also, stop using the ancient xhost. Xauth is used for authorization these days. The less you fight a distribution, the less painful your experience will be. If you want to rip out everything and replace if with something else, then use a distribution more suited to these kinds of customizations.What does ssh -v -X hostname show? Is xauth installed on the client you're logging in from?

author: DiTBho
author_rank: Super Contributor
timestamp: February 29, 2024, 08:51:05 am
content: Quote from: alm on February 29, 2024, 08:36:41 amClumsy for what? to ensure that Xorg doesn't receive any "-nolisten TCP" parameters?Your "proper solution", found by Googling, is *exactly* what i did about the display manager, and it didn't work.Quote from: alm on February 29, 2024, 08:36:41 amI'm used to Gentoo, in theory a distribution like Ubuntu "should work" without having to change anything. However, if you look at the Google results, you can realize how many people are complaining, and how many have proposed it as a "temporary" solution just to understand whether or not xhost is creating problems.

author: alm
author_rank: Super Contributor
timestamp: February 29, 2024, 09:22:35 am
content: Quote from: DiTBho on February 29, 2024, 08:51:05 amWhy do you want to enable TCP listening anyhow?Quote from: DiTBho on February 29, 2024, 08:51:05 amTry describing accurately what you did and what you observed, because you did not describe trying this. Just that you removed-nolisten tcpand added-listen tcp, which is not what the instructions say. Also, try to respond to questions like asking for specific output. Maybe reading and following the tips inthis documentwill help you get more useful responses.

author: DiTBho
author_rank: Super Contributor
timestamp: February 29, 2024, 12:01:54 pm
content: Quote from: alm on February 29, 2024, 09:22:35 amI need X11 on port 6000.

author: DiTBho
author_rank: Super Contributor
timestamp: February 29, 2024, 12:07:27 pm
content: According tothispage, there several access control mechanisms that control whether a client application can connect to an X display serveraccess based on host <----- old way to do itaccess based on cookie <----- "modern way"access based on userso as brutal as it is, "xhost +" should work as a crude and straightforward solution.But it doesn't.And what I really don't understand is why if I launch xclock on the remote machine connected via ssh, it doesn't end with an error message, but stays there without showing anything

author: DiTBho
author_rank: Super Contributor
timestamp: February 29, 2024, 12:16:57 pm
content: Code:OpenSSH_7.2p2 Ubuntu-4ubuntu2.2, OpenSSL 1.0.2g 1 Mar 2016debug1: Reading configuration data /etc/ssh/ssh_configdebug1: /etc/ssh/ssh_config line 19: Applying options for *debug1: Connecting to 192.168.1.81 [192.168.1.81] port 22.debug1: Connection established.debug1: key_load_public: No such file or directorydebug1: identity file /home/olimex/.ssh/id_rsa type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/olimex/.ssh/id_rsa-cert type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/olimex/.ssh/id_dsa type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/olimex/.ssh/id_dsa-cert type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/olimex/.ssh/id_ecdsa type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/olimex/.ssh/id_ecdsa-cert type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/olimex/.ssh/id_ed25519 type -1debug1: key_load_public: No such file or directorydebug1: identity file /home/olimex/.ssh/id_ed25519-cert type -1debug1: Enabling compatibility mode for protocol 2.0debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2debug1: Remote protocol version 2.0, remote software version OpenSSH_5.6debug1: match: OpenSSH_5.6 pat OpenSSH_5* compat 0x0c000000debug1: Authenticating to 192.168.1.81:22 as 'root'debug1: SSH2_MSG_KEXINIT sentdebug1: SSH2_MSG_KEXINIT receiveddebug1: kex: algorithm: diffie-hellman-group-exchange-sha256debug1: kex: host key algorithm: ssh-rsadebug1: kex: server->client cipher: aes128-ctr MAC: umac-64@openssh.com compression: nonedebug1: kex: client->server cipher: aes128-ctr MAC: umac-64@openssh.com compression: nonedebug1: SSH2_MSG_KEX_DH_GEX_REQUEST(2048<3072<8192) sentdebug1: got SSH2_MSG_KEX_DH_GEX_GROUPdebug1: SSH2_MSG_KEX_DH_GEX_INIT sentdebug1: got SSH2_MSG_KEX_DH_GEX_REPLYdebug1: Server host key: ssh-rsa SHA256:NiBZpE+69Fpsb+lndLeIuYS+eEVQ+JUapMTHLS8BICIdebug1: Host '192.168.1.81' is known and matches the RSA host key.debug1: Found key in /home/olimex/.ssh/known_hosts:3debug1: rekey after 4294967296 blocksdebug1: SSH2_MSG_NEWKEYS sentdebug1: expecting SSH2_MSG_NEWKEYSdebug1: rekey after 4294967296 blocksdebug1: SSH2_MSG_NEWKEYS receiveddebug1: SSH2_MSG_SERVICE_ACCEPT receiveddebug1: Authentications that can continue: publickey,keyboard-interactivedebug1: Next authentication method: publickeydebug1: Trying private key: /home/olimex/.ssh/id_rsadebug1: Trying private key: /home/olimex/.ssh/id_dsadebug1: Trying private key: /home/olimex/.ssh/id_ecdsadebug1: Trying private key: /home/olimex/.ssh/id_ed25519debug1: Next authentication method: keyboard-interactivedebug1: Authentication succeeded (keyboard-interactive).Authenticated to 192.168.1.81 ([192.168.1.81]:22).debug1: channel 0: new [client-session]debug1: Requesting no-more-sessions@openssh.comdebug1: Entering interactive session.debug1: pledge: execdebug1: Requesting X11 forwarding with authentication spoofing.debug1: Sending environment.debug1: Sending env LANG = en_US.UTF-8debug1: client_input_channel_req: channel 0 rtype exit-status reply 0debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0debug1: channel 0: free: client-session, nchannels 1debug1: fd 2 clearing O_NONBLOCKConnection to 192.168.1.81 closed.Transferred: sent 3264, received 4104 bytes, in 28.2 secondsBytes per second: sent 115.7, received 145.5debug1: Exit status 0(ssh -v -X 192.168.1.81)Quote

author: DiTBho
author_rank: Super Contributor
timestamp: February 29, 2024, 12:33:30 pm
content: Quote from: alm on February 29, 2024, 09:22:35 amsame as described in your link, plus:Code:basedir=/usr/lib/xorgif [ -x "$basedir"/Xorg.wrap ]thenexec "$basedir"/Xorg.wrap "$@" -ac -listen tcpelseexec "$basedir"/Xorg "$@" -ac -listen tcpfi(/usr/bin/Xorg)Code:exec /usr/bin/X -listen tcp "$@"(etc/X11/xinit/xserverrc)reload, and verifiedCode:pgrep X | xargs ps -lfwwwpthat there is "no-listen" argument passed to the running xorgCode:F S UID PID PPID C PRI NI ADDR SZ WCHAN STIME TTY TIME CMD4 S root 794 741 4 80 0 - 58454 poll_s 09:15 tty7 8:05 /usr/lib/xorg/Xorg -ac -listen tcp :0 -seat seat0 -auth /var/run/lightdm/root/:0 -listen tcp vt7 -novtswitch -ac -listen tcpso, as you can see /usr/lib/xorg/Xorg has not been passed with "no-listen tcp"and, in fact, it's now listening on tcp portCode:netstat -a | grep x11tcp 0 0 *:x11 *:* LISTENtcp6 0 0 [::]:x11 [::]:* LISTENhowever, I was expecting something listening on port 6000

author: alm
author_rank: Super Contributor
timestamp: February 29, 2024, 01:47:55 pm
content: Quote from: DiTBho on February 29, 2024, 12:01:54 pmSSH port forwarding creates its own proxy that does not rely on the X server having an open TCP socket. You might be able to convince SSH to listen on port 6000 by setting X11DisplayOffset to 0.Quote from: DiTBho on February 29, 2024, 12:33:30 pmIsn't the x11 service mapped to port 6000 according to /etc/services?Quote from: DiTBho on February 29, 2024, 12:07:27 pmAssuming the client uses TCP sockets. I believe ssh will use Unix domain sockets by default. But the more important point is that SSH expects to use xauth for authorization, so other access control mechanisms are irrelevant for SSH X11 forwarding.Quote from: DiTBho on February 29, 2024, 12:16:57 pmLooks like the X11 forwarding channel is successfully created. What is the value of $DISPLAY when logged in this way?

author: DiTBho
author_rank: Super Contributor
timestamp: February 29, 2024, 02:34:46 pm
content: Strange, but the problem was /bin/hostname, which didn't work properly and prevented /usr/bin/xauth from adding the correct "display name", since it uses /etc/hosts to get the IPWhat the fsck! Seriously!/bin/hostname recompiled from a more recent source (Gentoo repo) -> problem solved!So, it wasn't an Ubunto side problem (laptop with x11), but a Gentoo side problem (remote server).Strange because it happened on both remote machines { x86/32, ppc32/be } I am using.Anyway, fixedGoing to re-build for all the other stages4-2024-02 { mips32r2/be, mips32r2/le, hppa2, ... } the most recentsys-apps/net-tools(<<hostname) source!

author: DiTBho
author_rank: Super Contributor
timestamp: February 29, 2024, 02:55:40 pm
content: Quote from: alm on February 29, 2024, 01:47:55 pmyup, from the outside, my port tcp/ip scanner (executed on the lab router) doesn't list the 6000 port as open, but only the ssh port, and a custom upper port, above 6000, that I use for telemetry.I don't need to investigate why the 6000 "appears" closed from the outside. I just need it to be able to run Geany and an xterm launched from the remote servers to finish a couple of projects.As soon as done, I will plan (likely next weekend?) to wipe out the entire eMMC where ubuntu is currently installed, and cook a stage4 arm64/le, with nothing but xorg, xterm, and a few other things I need to make the laptop a vt220-text-console + x11 terminal.

author: mag_therm
author_rank: Frequent Contributor
timestamp: February 29, 2024, 03:13:03 pm
content: Well, you fixed it.I am on Fedora, I prefer sshvnc. It is OK for sharing on a remote serverIFthe remote user also uses vnc via localhost.To remotely log into a running remote X11 via vnc client, (for ham radio remote access), I recently found this, which works well:Installation and setup on the server:https://tecadmin.net/how-to-install-x11vnc-server-on-fedora/login: by a standard vncviewer client, per demo at the bottom of that link

author: DiTBho
author_rank: Super Contributor
timestamp: March 01, 2024, 09:28:00 am
content: Quote from: DiTBho on February 29, 2024, 02:55:40 pmdon't ask me why port 22 (ssh) and port 6022 (my telemetry) weren't included in the firewall rules, but port 6000 wasUbuntu is franly a mess of files upon files to configure, and for sure - out of the box - something went wrong.I cleaned everything, and with greater emphasis, the following forces of the rules to leave traffic on those damn bloody ports!Code:ufw allow 22/tcp # sshdufw allow 6000/tcp # x11ufw allow 6022/tcp # telemetrynow, Fixed!

author: alm
author_rank: Super Contributor
timestamp: March 01, 2024, 02:59:11 pm
content: Quote from: DiTBho on March 01, 2024, 09:28:00 amProbably because having X unintentionally open to the internet is considered a security risk, due to the protocol (e.g. the IP-based authentication) and implementation being much less secure than say SSH. And if it's intentionally open, then the user can indicate it in the ufw config.Quote from: DiTBho on March 01, 2024, 09:28:00 amWhat went wrong, other than the xauth/xhost problem? The X server listening via TCP/IP is not a default configuration, so you can't really complain about that not working. I guess these days most people will tunnel it over SSH since that solves the authentication problem using common solutions like public keys.

author: DiTBho
author_rank: Super Contributor
timestamp: March 01, 2024, 03:39:40 pm
content: Well, there are too many default settings levels with Ubuntu and it took me too much time to figure out what to fix/change/etc.With Gentoo it's the opposite: you start with no-default-layers, and add your own as you want and need.Lightdm didn't even have settings. Just empty garbage in /etc/, and surely I would have added a "firewall"!Let the user choose if he/she wants (apt-get install...), why do you want to pre-install it? And without a line of doc?Worse, I see the other Ubuntu versions even have the port 22 blocked, so ... "no ssh from the outside as default set"

author: DiTBho
author_rank: Super Contributor
timestamp: March 03, 2024, 01:17:35 pm
content: you shutdown the display managerCode:systemctl stop lightdmand ... even the wifi turns off, and you have no-networkHow idiotic is this???