ssh -X remote does not work due to problem with xauth

[Matthias Apitz]

When I launch 'ssh -X remote host' to get X11 forwarded to my workstation
this does not work, i.e. does not produce a DISPLAY env on the remote
host and says:

$ ssh -X ***@srap16dxr1
Warning: untrusted X11 forwarding setup failed: xauth key data not generated
Last login: Wed May 9 12:37:17 2018 from 10.49.8.33
***@srap16dxr1:~>

I digged into it with -vv options for ssh and trussing the client. It seems it's
our end causing the problem:

$ uname -a
FreeBSD r314251-amd64 12.0-CURRENT FreeBSD 12.0-CURRENT #0 r314251: Sat Feb 25 17:14:40 CET 2017
***@r303343-amd64:/usr/obj/usr/src/sys/GENERIC amd64

$ truss -s128 -f -o ssh.tr ssh -X -vv ***@srap16dxr1
$ grep -i xauth ssh.tr > xauth.txt

20544: stat("/usr/local/bin/xauth",{ mode=-rwxr-xr-x ,inode=2820147,size=41056,blksize=32768 }) = 0 (0x0)
20544: write(2,"debug2: client_x11_get_proto: /usr/local/bin/xauth -f /tmp/ssh-zfFpkwHgD1qj/xauthfile generate :0 MIT-MAGIC-COOKIE-1 untrusted t"...,153) = 153 (0x99)
20545: execve("/usr/local/bin/xauth",0x801459260,0x801459408) = 0 (0x0)
20545: stat("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",0x7fffffffdc40) ERR#2 'No such file or directory'
20545: openat(AT_FDCWD,"/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",O_WRONLY|O_CREAT|O_EXCL,0600) = 3 (0x3)
20545: pathconf("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",_PC_LINK_MAX) = 32767 (0x7fff)
20545: link("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c","/tmp/ssh-zfFpkwHgD1qj/xauthfile-l") = 0 (0x0)
20545: access("/tmp/ssh-zfFpkwHgD1qj/xauthfile",F_OK) ERR#2 'No such file or directory'
20545: open("/tmp/ssh-zfFpkwHgD1qj/xauthfile",O_RDONLY,0666) ERR#2 'No such file or directory'
20545: access("/tmp/ssh-zfFpkwHgD1qj/xauthfile",F_OK) ERR#2 'No such file or directory'
20545: write(2,"/usr/local/bin/xauth: file /tmp/ssh-zfFpkwHgD1qj/xauthfile does not exist\n",75) = 75 (0x4b)
20545: access("/tmp/kde-guru/xauth-1001-_0",R_OK) = 0 (0x0)
20545: open("/tmp/kde-guru/xauth-1001-_0",O_RDONLY,0666) = 4 (0x4)
20545: write(2,"/usr/local/bin/xauth: (argv):1: ",33) = 33 (0x21)
20545: lstat("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",{ mode=-rw------- ,inode=8331,size=0,blksize=32768 }) = 0 (0x0)
20545: unlink("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c") = 0 (0x0)
20545: lstat("/tmp/ssh-zfFpkwHgD1qj/xauthfile-l",{ mode=-rw------- ,inode=8331,size=0,blksize=32768 }) = 0 (0x0)
20545: unlink("/tmp/ssh-zfFpkwHgD1qj/xauthfile-l") = 0 (0x0)
20544: unlink("/tmp/ssh-zfFpkwHgD1qj/xauthfile") ERR#2 'No such file or directory'
20544: write(2,"Warning: untrusted X11 forwarding setup failed: xauth key data not generated\r\n",78) = 78 (0x4e)

Any ideas?

Thanks

matthias

[Steve O'Hara-Smith]

On Wed, 9 May 2018 12:47:00 +0200

Post by Matthias Apitz
When I launch 'ssh -X remote host' to get X11 forwarded to my workstation
this does not work, i.e. does not produce a DISPLAY env on the remote
Warning: untrusted X11 forwarding setup failed: xauth key data not
generated Last login: Wed May 9 12:37:17 2018 from 10.49.8.33

...

Post by Matthias Apitz
Any ideas?

Possible workaround - ssh -Y.

[Matthias Apitz]

Post by Steve O'Hara-Smith
On Wed, 9 May 2018 12:47:00 +0200

Post by Matthias Apitz
When I launch 'ssh -X remote host' to get X11 forwarded to my workstation
this does not work, i.e. does not produce a DISPLAY env on the remote
Warning: untrusted X11 forwarding setup failed: xauth key data not
generated Last login: Wed May 9 12:37:17 2018 from 10.49.8.33

...

Post by Matthias Apitz
Any ideas?

Possible workaround - ssh -Y.

I know (and I use it). But the problem should be solved.

matthias

[Valeri Galtsev]

Post by Steve O'Hara-Smith
On Wed, 9 May 2018 12:47:00 +0200

Post by Matthias Apitz
When I launch 'ssh -X remote host' to get X11 forwarded to my workstation
this does not work, i.e. does not produce a DISPLAY env on the remote
Warning: untrusted X11 forwarding setup failed: xauth key data not
generated Last login: Wed May 9 12:37:17 2018 from 10.49.8.33

...

Post by Matthias Apitz
Any ideas?

Possible workaround - ssh -Y.

Also, I would check why xauth wasn't able to do its job. Possible
reasons: quota on /home exceeded, or one of filesystems is full (or
permissions...)

Valeri

[Christian Weisgerber]

Post by Matthias Apitz
When I launch 'ssh -X remote host' to get X11 forwarded to my workstation
this does not work, i.e. does not produce a DISPLAY env on the remote

Is X11Forwarding enabled in /etc/ssh/sshd_config on the remote host?

Post by Matthias Apitz
Warning: untrusted X11 forwarding setup failed: xauth key data not generated

That's exactly the error you get if X11Forwarding is off on the
remote host.

[Matthias Apitz]

Post by Christian Weisgerber

Post by Matthias Apitz
When I launch 'ssh -X remote host' to get X11 forwarded to my workstation
this does not work, i.e. does not produce a DISPLAY env on the remote

Is X11Forwarding enabled in /etc/ssh/sshd_config on the remote host?

Post by Matthias Apitz
Warning: untrusted X11 forwarding setup failed: xauth key data not generated

That's exactly the error you get if X11Forwarding is off on the
remote host.

X11Forwarding is definitely enabled on the remote server. Other users in
my company network who are coming from Ubuntu workstations to the same
server do not face this problem.

matthias

[Lowell Gilbert]

Post by Matthias Apitz

Post by Christian Weisgerber

Post by Matthias Apitz
When I launch 'ssh -X remote host' to get X11 forwarded to my workstation
this does not work, i.e. does not produce a DISPLAY env on the remote

Is X11Forwarding enabled in /etc/ssh/sshd_config on the remote host?

Post by Matthias Apitz
Warning: untrusted X11 forwarding setup failed: xauth key data not generated

That's exactly the error you get if X11Forwarding is off on the
remote host.

X11Forwarding is definitely enabled on the remote server. Other users in
my company network who are coming from Ubuntu workstations to the same
server do not face this problem.

Have you tried increasing the verbosity on the ssh session?
And if possible, on the sshd at the other end?

[Matthias Apitz]

Post by Lowell Gilbert

Post by Matthias Apitz
X11Forwarding is definitely enabled on the remote server. Other users in
my company network who are coming from Ubuntu workstations to the same
server do not face this problem.

Have you tried increasing the verbosity on the ssh session?
And if possible, on the sshd at the other end?

Have you read my original post? I used -vv as options for the
SSH client site and in addition watch the client with truss(1).

matthias

[Bruce Ferrell]

Post by Matthias Apitz

Post by Lowell Gilbert

Post by Matthias Apitz
X11Forwarding is definitely enabled on the remote server. Other users in
my company network who are coming from Ubuntu workstations to the same
server do not face this problem.

Have you tried increasing the verbosity on the ssh session?
And if possible, on the sshd at the other end?

Have you read my original post? I used -vv as options for the
SSH client site and in addition watch the client with truss(1).
matthias

Just out of curiosity, are you able to increase logging on the server?

The error would tend to imply the client is making the request and being rejected at the server. By design, the client can't necessarily tell why... But the server knows.

[James B. Byrne via freebsd-questions]

Post by Matthias Apitz
When I launch 'ssh -X remote host' to get X11 forwarded to my
workstation
this does not work, i.e. does not produce a DISPLAY env on the remote
Warning: untrusted X11 forwarding setup failed: xauth key data not
generated
Last login: Wed May 9 12:37:17 2018 from 10.49.8.33
I digged into it with -vv options for ssh and trussing the client. It
seems it's
$ uname -a
Sat Feb 25 17:14:40 CET 2017
$ grep -i xauth ssh.tr > xauth.txt
20544: stat("/usr/local/bin/xauth",{ mode=-rwxr-xr-x
,inode=2820147,size=41056,blksize=32768 }) = 0 (0x0)
20544: write(2,"debug2: client_x11_get_proto: /usr/local/bin/xauth -f
/tmp/ssh-zfFpkwHgD1qj/xauthfile generate :0 MIT-MAGIC-COOKIE-1
untrusted t"...,153) = 153 (0x99)
20545: execve("/usr/local/bin/xauth",0x801459260,0x801459408) = 0
(0x0)
20545: stat("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",0x7fffffffdc40) ERR#2
'No such file or directory'
openat(AT_FDCWD,"/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",O_WRONLY|O_CREAT|O_EXCL,0600)
= 3 (0x3)
20545: pathconf("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",_PC_LINK_MAX) =
32767 (0x7fff)
link("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c","/tmp/ssh-zfFpkwHgD1qj/xauthfile-l")
= 0 (0x0)
20545: access("/tmp/ssh-zfFpkwHgD1qj/xauthfile",F_OK) ERR#2 'No such
file or directory'
20545: open("/tmp/ssh-zfFpkwHgD1qj/xauthfile",O_RDONLY,0666) ERR#2 'No
such file or directory'
20545: access("/tmp/ssh-zfFpkwHgD1qj/xauthfile",F_OK) ERR#2 'No such
file or directory'
20545: write(2,"/usr/local/bin/xauth: file
/tmp/ssh-zfFpkwHgD1qj/xauthfile does not exist\n",75) = 75 (0x4b)
20545: access("/tmp/kde-guru/xauth-1001-_0",R_OK) = 0 (0x0)
20545: open("/tmp/kde-guru/xauth-1001-_0",O_RDONLY,0666) = 4 (0x4)
20545: write(2,"/usr/local/bin/xauth: (argv):1: ",33) = 33 (0x21)
20545: lstat("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",{ mode=-rw-------
,inode=8331,size=0,blksize=32768 }) = 0 (0x0)
20545: unlink("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c") = 0 (0x0)
20545: lstat("/tmp/ssh-zfFpkwHgD1qj/xauthfile-l",{ mode=-rw-------
,inode=8331,size=0,blksize=32768 }) = 0 (0x0)
20545: unlink("/tmp/ssh-zfFpkwHgD1qj/xauthfile-l") = 0 (0x0)
20544: unlink("/tmp/ssh-zfFpkwHgD1qj/xauthfile") ERR#2 'No such file
or directory'
20544: write(2,"Warning: untrusted X11 forwarding setup failed: xauth
key data not generated\r\n",78) = 78 (0x4e)
Any ideas?
Thanks
matthias

You need the xauth pkg installed on the remote to generate the
.Xauthority file for the ssh session.
--
*** e-Mail is NOT a SECURE channel ***
Do NOT transmit sensitive data via e-Mail
Do NOT open attachments nor follow links sent by e-Mail

James B. Byrne mailto:***@Harte-Lyne.ca
Harte & Lyne Limited http://www.harte-lyne.ca
9 Brockley Drive vox: [phone]
Hamilton, Ontario fax: [phone]
Canada L8E 3C3

[Matthias Apitz]

Post by James B. Byrne via freebsd-questions

Post by Matthias Apitz
When I launch 'ssh -X remote host' to get X11 forwarded to my
workstation
this does not work, i.e. does not produce a DISPLAY env on the remote
Warning: untrusted X11 forwarding setup failed: xauth key data not
generated
Last login: Wed May 9 12:37:17 2018 from 10.49.8.33
I digged into it with -vv options for ssh and trussing the client. It
seems it's
$ uname -a
Sat Feb 25 17:14:40 CET 2017
$ grep -i xauth ssh.tr > xauth.txt
20544: stat("/usr/local/bin/xauth",{ mode=-rwxr-xr-x
,inode=2820147,size=41056,blksize=32768 }) = 0 (0x0)
20544: write(2,"debug2: client_x11_get_proto: /usr/local/bin/xauth -f
/tmp/ssh-zfFpkwHgD1qj/xauthfile generate :0 MIT-MAGIC-COOKIE-1
untrusted t"...,153) = 153 (0x99)
20545: execve("/usr/local/bin/xauth",0x801459260,0x801459408) = 0
(0x0)
20545: stat("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",0x7fffffffdc40) ERR#2
'No such file or directory'
openat(AT_FDCWD,"/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",O_WRONLY|O_CREAT|O_EXCL,0600)
= 3 (0x3)
20545: pathconf("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",_PC_LINK_MAX) =
32767 (0x7fff)
link("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c","/tmp/ssh-zfFpkwHgD1qj/xauthfile-l")
= 0 (0x0)
20545: access("/tmp/ssh-zfFpkwHgD1qj/xauthfile",F_OK) ERR#2 'No such
file or directory'
20545: open("/tmp/ssh-zfFpkwHgD1qj/xauthfile",O_RDONLY,0666) ERR#2 'No
such file or directory'
20545: access("/tmp/ssh-zfFpkwHgD1qj/xauthfile",F_OK) ERR#2 'No such
file or directory'
20545: write(2,"/usr/local/bin/xauth: file
/tmp/ssh-zfFpkwHgD1qj/xauthfile does not exist\n",75) = 75 (0x4b)
20545: access("/tmp/kde-guru/xauth-1001-_0",R_OK) = 0 (0x0)
20545: open("/tmp/kde-guru/xauth-1001-_0",O_RDONLY,0666) = 4 (0x4)
20545: write(2,"/usr/local/bin/xauth: (argv):1: ",33) = 33 (0x21)
20545: lstat("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c",{ mode=-rw-------
,inode=8331,size=0,blksize=32768 }) = 0 (0x0)
20545: unlink("/tmp/ssh-zfFpkwHgD1qj/xauthfile-c") = 0 (0x0)
20545: lstat("/tmp/ssh-zfFpkwHgD1qj/xauthfile-l",{ mode=-rw-------
,inode=8331,size=0,blksize=32768 }) = 0 (0x0)
20545: unlink("/tmp/ssh-zfFpkwHgD1qj/xauthfile-l") = 0 (0x0)
20544: unlink("/tmp/ssh-zfFpkwHgD1qj/xauthfile") ERR#2 'No such file
or directory'
20544: write(2,"Warning: untrusted X11 forwarding setup failed: xauth
key data not generated\r\n",78) = 78 (0x4e)
Any ideas?
Thanks
matthias

You need the xauth pkg installed on the remote to generate the
.Xauthority file for the ssh session.

The RPM is installed on the remote site:

***@srap16dxr1:~> rpm -qa | grep xauth
xauth-1.0.8-1.51.x86_64
***@srap16dxr1:~> which xauth
/usr/bin/xauth
***@srap16dxr1:~>

but the truss shows that the problem is on the local FreeBSD client
site.

matthias

[James B. Byrne via freebsd-questions]

On Wed, May 9, 2018 14:09, Matthias Apitz wrote:

What is the ownership of and permissions on .Xauthority on the remote
host?
--
*** e-Mail is NOT a SECURE channel ***
Do NOT transmit sensitive data via e-Mail
Do NOT open attachments nor follow links sent by e-Mail

James B. Byrne mailto:***@Harte-Lyne.ca
Harte & Lyne Limited http://www.harte-lyne.ca
9 Brockley Drive vox: [phone]
Hamilton, Ontario fax: [phone]
Canada L8E 3C3

[Matthias Apitz]

On Thursday, 10 May 2018 14:34:27 CEST, James B. Byrne

Post by James B. Byrne via freebsd-questions
What is the ownership of and permissions on .Xauthority on the remote
host?

It's owned by me, created as new if not there, but with size=0.

matthias

[Valeri Galtsev]

Post by Matthias Apitz
On Thursday, 10 May 2018 14:34:27 CEST, James B. Byrne

Post by James B. Byrne via freebsd-questions
What is the ownership of and permissions on .Xauthority on the remote
host?

It's owned by me, created as new if not there, but with size=0.

Did you check that you are not up against hard quota, and the filesystem
is not full? I already suggested that, but my message seems to miss your
attention. One thing you can try on remote host is:

dd if=/dev/zero of=~/test.dat bs=1024 count=1

if that creates 1 kB ~/test.dat file, neither quota nor filesystem full
is on your way. If that file has zero size, then you are hit by one of
the above.

Another possibility on multi-user system when this works for others but
not for you is if you as UNIX user is prohibited [X]-forwarding by
sysadmin (-"fascist"). I as sysadmin only twice during last decade had
to restrict one single user from doing something, but it still is the
possibility.

Valeri

Post by Matthias Apitz
matthias

[Matthias Apitz]

Post by Valeri Galtsev

Post by Matthias Apitz
On Thursday, 10 May 2018 14:34:27 CEST, James B. Byrne

Post by James B. Byrne via freebsd-questions
What is the ownership of and permissions on .Xauthority on the remote
host?

It's owned by me, created as new if not there, but with size=0.

Did you check that you are not up against hard quota, and the filesystem
is not full? I already suggested that, but my message seems to miss your

The remote host is one of our central development hosts, has not quota,
no file sys full and plenty much GB of disk space:

$ scp /boot/kernel/kernel ***@s70devl:.
$ ssh ***@s70devl ls -lh kernel
-r-xr-xr-x 1 apitzm apitzm 26M 10. Mai 16:49 kernel
$ ssh ***@s70devl LANG=C df -kh .
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_root-lv_root 337G 68G 268G 21% /

Post by Valeri Galtsev
Another possibility on multi-user system when this works for others but
not for you is if you as UNIX user is prohibited [X]-forwarding by
sysadmin (-"fascist"). I as sysadmin only twice during last decade had
to restrict one single user from doing something, but it still is the
possibility.

I don't think, that our IT department does such things against the Tech Head
I am :-)

I do thank for all replies, but have to say, that all ignored the provided
truss output (at least in all replies). Here it is again and shows that
there is a LOCAL problem; the LOCAL /usr/local/bin/xauth tries to
create the LOCAL file /tmp/ssh-adSkh4btDHWr/xauthfile (perhaps to move it over
the SSH channel to the remote end) and it fails doing this:

$ grep xauth ssh.tr
2505: stat("/usr/local/bin/xauth",{ mode=-rwxr-xr-x ,inode=15268663,size=41056,blksize=32768 }) = 0 (0x0)
2505: write(2,"debug2: client_x11_get_proto: /usr/local/bin/xauth -f /tmp/ssh-adSkh4btDHWr/xauthfile generate :0 MIT-MAGIC-COOKIE-1 untrusted timeout 1260 2>/dev/null\r\n",153) = 153 (0x99)
2506: execve("/usr/local/bin/xauth",0x80145a260,0x80145a408) = 0 (0x0)
2506: stat("/tmp/ssh-adSkh4btDHWr/xauthfile-c",0x7fffffffdb80) ERR#2 'No such file or directory'
2506: openat(AT_FDCWD,"/tmp/ssh-adSkh4btDHWr/xauthfile-c",O_WRONLY|O_CREAT|O_EXCL,0600) = 3 (0x3)
2506: pathconf("/tmp/ssh-adSkh4btDHWr/xauthfile-c",_PC_LINK_MAX) = 32767 (0x7fff)
2506: link("/tmp/ssh-adSkh4btDHWr/xauthfile-c","/tmp/ssh-adSkh4btDHWr/xauthfile-l") = 0 (0x0)
2506: access("/tmp/ssh-adSkh4btDHWr/xauthfile",F_OK) ERR#2 'No such file or directory'
2506: open("/tmp/ssh-adSkh4btDHWr/xauthfile",O_RDONLY,0666) ERR#2 'No such file or directory'
2506: access("/tmp/ssh-adSkh4btDHWr/xauthfile",F_OK) ERR#2 'No such file or directory'
2506: write(2,"/usr/local/bin/xauth: file /tmp/ssh-adSkh4btDHWr/xauthfile does not exist\n",75) = 75 (0x4b)
2506: access("/tmp/kde-guru/xauth-1001-_0",R_OK) = 0 (0x0)
2506: open("/tmp/kde-guru/xauth-1001-_0",O_RDONLY,0666) = 4 (0x4)
2506: write(2,"/usr/local/bin/xauth: (argv):1: ",33) = 33 (0x21)
2506: lstat("/tmp/ssh-adSkh4btDHWr/xauthfile-c",{ mode=-rw------- ,inode=24961,size=0,blksize=32768 }) = 0 (0x0)
2506: unlink("/tmp/ssh-adSkh4btDHWr/xauthfile-c") = 0 (0x0)
2506: lstat("/tmp/ssh-adSkh4btDHWr/xauthfile-l",{ mode=-rw------- ,inode=24961,size=0,blksize=32768 }) = 0 (0x0)
2506: unlink("/tmp/ssh-adSkh4btDHWr/xauthfile-l") = 0 (0x0)
2505: unlink("/tmp/ssh-adSkh4btDHWr/xauthfile") ERR#2 'No such file or directory'
2505: write(2,"Warning: untrusted X11 forwarding setup failed: xauth key data not generated\r\n",78) = 78 (0x4e)

$ grep Sec ssh.tr
2505: read(3,"\0\0\^A\^D\v\^_\0\0\0h\0\0\0\^Secdsa-sha2-nistp256\0\0\0\bnistp256\0\0\0A\^D\^Qa<x\^U\M-jW\M-Hy/\M-:\M-b\^Qc\M-\^\^SG\M^ZT|\M-ck7\M-H\M-s\M-gKNi\n\M^Ex\M-;D.\M-w\M-'\^O\^T\^Uls\M^Y\M-D\M-5{\M-6\M-3d\M-U\M-P\M-Ck\M-*7\a\^U\^W\M-^\M^Il\M-n\M-,\0\0\0 M\M-G"...,8192) = 364 (0x16c)
2506: write(2,"couldn't query Security extension on display ":0"\n",50) = 50 (0x32)

One can simulate the xauth call locally and without redirecting STDERR and
will see the same error:

$ /usr/local/bin/xauth -f /tmp/xauthfile generate :0 MIT-MAGIC-COOKIE-1 untrusted timeout 1260
/usr/local/bin/xauth: file /tmp/xauthfile does not exist
/usr/local/bin/xauth: (argv):1: couldn't query Security extension on display ":0"

This, and the fact that my colleagues do not face the problem, let me
strongly think in a LOCAL problem, maybe of the Xorg server which is xorg-7.7_2
from the ports.

Thanks again for reading my post.

matthias

[Bruce Ferrell]

Post by Matthias Apitz

Post by Valeri Galtsev

Post by Matthias Apitz
On Thursday, 10 May 2018 14:34:27 CEST, James B. Byrne

Post by James B. Byrne via freebsd-questions
What is the ownership of and permissions on .Xauthority on the remote
host?

It's owned by me, created as new if not there, but with size=0.

Did you check that you are not up against hard quota, and the filesystem
is not full? I already suggested that, but my message seems to miss your

The remote host is one of our central development hosts, has not quota,
-r-xr-xr-x 1 apitzm apitzm 26M 10. Mai 16:49 kernel
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_root-lv_root 337G 68G 268G 21% /

Post by Valeri Galtsev
Another possibility on multi-user system when this works for others but
not for you is if you as UNIX user is prohibited [X]-forwarding by
sysadmin (-"fascist"). I as sysadmin only twice during last decade had
to restrict one single user from doing something, but it still is the
possibility.

I don't think, that our IT department does such things against the Tech Head
I am :-)
I do thank for all replies, but have to say, that all ignored the provided
truss output (at least in all replies). Here it is again and shows that
there is a LOCAL problem; the LOCAL /usr/local/bin/xauth tries to
create the LOCAL file /tmp/ssh-adSkh4btDHWr/xauthfile (perhaps to move it over
$ grep xauth ssh.tr
2505: stat("/usr/local/bin/xauth",{ mode=-rwxr-xr-x ,inode=15268663,size=41056,blksize=32768 }) = 0 (0x0)
2505: write(2,"debug2: client_x11_get_proto: /usr/local/bin/xauth -f /tmp/ssh-adSkh4btDHWr/xauthfile generate :0 MIT-MAGIC-COOKIE-1 untrusted timeout 1260 2>/dev/null\r\n",153) = 153 (0x99)
2506: execve("/usr/local/bin/xauth",0x80145a260,0x80145a408) = 0 (0x0)
2506: stat("/tmp/ssh-adSkh4btDHWr/xauthfile-c",0x7fffffffdb80) ERR#2 'No such file or directory'
2506: openat(AT_FDCWD,"/tmp/ssh-adSkh4btDHWr/xauthfile-c",O_WRONLY|O_CREAT|O_EXCL,0600) = 3 (0x3)
2506: pathconf("/tmp/ssh-adSkh4btDHWr/xauthfile-c",_PC_LINK_MAX) = 32767 (0x7fff)
2506: link("/tmp/ssh-adSkh4btDHWr/xauthfile-c","/tmp/ssh-adSkh4btDHWr/xauthfile-l") = 0 (0x0)
2506: access("/tmp/ssh-adSkh4btDHWr/xauthfile",F_OK) ERR#2 'No such file or directory'
2506: open("/tmp/ssh-adSkh4btDHWr/xauthfile",O_RDONLY,0666) ERR#2 'No such file or directory'
2506: access("/tmp/ssh-adSkh4btDHWr/xauthfile",F_OK) ERR#2 'No such file or directory'
2506: write(2,"/usr/local/bin/xauth: file /tmp/ssh-adSkh4btDHWr/xauthfile does not exist\n",75) = 75 (0x4b)
2506: access("/tmp/kde-guru/xauth-1001-_0",R_OK) = 0 (0x0)
2506: open("/tmp/kde-guru/xauth-1001-_0",O_RDONLY,0666) = 4 (0x4)
2506: write(2,"/usr/local/bin/xauth: (argv):1: ",33) = 33 (0x21)
2506: lstat("/tmp/ssh-adSkh4btDHWr/xauthfile-c",{ mode=-rw------- ,inode=24961,size=0,blksize=32768 }) = 0 (0x0)
2506: unlink("/tmp/ssh-adSkh4btDHWr/xauthfile-c") = 0 (0x0)
2506: lstat("/tmp/ssh-adSkh4btDHWr/xauthfile-l",{ mode=-rw------- ,inode=24961,size=0,blksize=32768 }) = 0 (0x0)
2506: unlink("/tmp/ssh-adSkh4btDHWr/xauthfile-l") = 0 (0x0)
2505: unlink("/tmp/ssh-adSkh4btDHWr/xauthfile") ERR#2 'No such file or directory'
2505: write(2,"Warning: untrusted X11 forwarding setup failed: xauth key data not generated\r\n",78) = 78 (0x4e)
$ grep Sec ssh.tr
2505: read(3,"\0\0\^A\^D\v\^_\0\0\0h\0\0\0\^Secdsa-sha2-nistp256\0\0\0\bnistp256\0\0\0A\^D\^Qa<x\^U\M-jW\M-Hy/\M-:\M-b\^Qc\M-\^\^SG\M^ZT|\M-ck7\M-H\M-s\M-gKNi\n\M^Ex\M-;D.\M-w\M-'\^O\^T\^Uls\M^Y\M-D\M-5{\M-6\M-3d\M-U\M-P\M-Ck\M-*7\a\^U\^W\M-^\M^Il\M-n\M-,\0\0\0 M\M-G"...,8192) = 364 (0x16c)
2506: write(2,"couldn't query Security extension on display ":0"\n",50) = 50 (0x32)
One can simulate the xauth call locally and without redirecting STDERR and
$ /usr/local/bin/xauth -f /tmp/xauthfile generate :0 MIT-MAGIC-COOKIE-1 untrusted timeout 1260
/usr/local/bin/xauth: file /tmp/xauthfile does not exist
/usr/local/bin/xauth: (argv):1: couldn't query Security extension on display ":0"
This, and the fact that my colleagues do not face the problem, let me
strongly think in a LOCAL problem, maybe of the Xorg server which is xorg-7.7_2
from the ports.
Thanks again for reading my post.
matthias

Matthias,

I think this output is key:

couldn't query Security extension on display ":0"

xauth (at the sshd end) is attempting to interrogate the X server on the
ssh end and not getting an expected response, and as a result failing to
generate the necessary entries in the file xauth file.

searching the error on google found this:

https://groups.google.com/forum/#!topic/de.comp.os.unix.x11/44yHbl-RP_8

It has a nice step-by-step of what and how xauth is doing it's magic

Its the X server at the ssh end (your end).  I suspect you'll find your
colleagues are using a somewhat different X server and that explains the
difference in your operation vs yours... And that corresponds to your
comment about the Xorg server.

[Matthias Apitz]

Post by Matthias Apitz
couldn't query Security extension on display ":0"

Yes, I agree.

Post by Matthias Apitz
xauth (at the sshd end) is attempting to interrogate the X server on the
ssh end and not getting an expected response, and as a result failing to
generate the necessary entries in the file xauth file.

No. I straced the remote sshd while I ssh'ed into the server. On the remote side there
is no xauth called:

$ grep exec sshd.tr
1369 execve("/usr/sbin/sshd", ["/usr/sbin/sshd", "-D", "-R"], [/* 3 vars */] <unfinished ...>
1369 <... execve resumed> ) = 0
1373 execve("/bin/bash", ["-bash"], [/* 12 vars */]) = 0
1375 execve("/usr/bin/readlink", ["readlink", "/proc/1373/exe"], [/* 15 vars */]) = 0
1377 execve("/usr/bin/tty", ["tty"], [/* 15 vars */]) = 0
1379 execve("/bin/uname", ["/bin/uname", "-n"], [/* 16 vars */]) = 0
1381 execve("/bin/uname", ["/bin/uname", "-m"], [/* 16 vars */]) = 0
1383 execve("/usr/bin/manpath", ["/usr/bin/manpath", "-q"], [/* 32 vars */]) = 0
1385 execve("/usr/bin/ls", ["ls", "/etc/bash_completion.d"], [/* 38 vars */]) = 0
1387 execve("/usr/bin/tty", ["tty"], [/* 43 vars */]) = 0
1391 execve("/usr/bin/sed", ["sed", "-r", "s@/*:|([^\\\\]):@\\1\\***@g;H;x;s@/\\n@"...], [/* 48 vars */]) = 0
1395 execve("/usr/bin/sed", ["sed", "-r", "s@/*:|([^\\\\]):@\\1\\***@g;H;x;s@/\\n@"...], [/* 49 vars */]) = 0
1397 execve("/usr/bin/dircolors", ["/usr/bin/dircolors", "-b", "/etc/DIR_COLORS"], [/* 53 vars */]) = 0
1399 execve("/usr/bin/tput", ["/usr/bin/tput", "hs"], [/* 55 vars */]) = 0
1401 execve("/usr/bin/tput", ["/usr/bin/tput", "tsl"], [/* 55 vars */]) = 0
1403 execve("/usr/bin/tput", ["/usr/bin/tput", "fsl"], [/* 55 vars */]) = 0
1405 execve("/usr/bin/tput", ["tput", "sc"], [/* 55 vars */]) = 0
1407 execve("/usr/bin/tput", ["tput", "rc"], [/* 55 vars */]) = 0
1410 execve("/usr/bin/tty", ["tty"], [/* 55 vars */]) = 0


$ grep xauth sshd.tr
$

The problem is LOCAL on FreeBSD. (Btw: my colleagues use Ubuntu and do
not have this problem.)

I will move this thread to freebsd-x11@ because it has more todo with X11 than
with the ssh client.

matthias

[FBUser]

Post by Matthias Apitz
I do thank for all replies, but have to say, that all ignored the provided
truss output (at least in all replies). Here it is again and shows that
there is a LOCAL problem; the LOCAL /usr/local/bin/xauth tries to
create the LOCAL file /tmp/ssh-adSkh4btDHWr/xauthfile (perhaps to move it over

To the contrary...

Post by Matthias Apitz
2506: openat(AT_FDCWD,"/tmp/ssh-adSkh4btDHWr/xauthfile-c",O_WRONLY|O_CREAT|O_EXCL,0600) = 3 (0x3)

A different file was created.

Post by Matthias Apitz
2506: link("/tmp/ssh-adSkh4btDHWr/xauthfile-c","/tmp/ssh-adSkh4btDHWr/xauthfile-l") = 0 (0x0)

A link to that file was successfully created.

Post by Matthias Apitz
2506: access("/tmp/ssh-adSkh4btDHWr/xauthfile",F_OK) ERR#2 'No such file or directory'
2506: open("/tmp/ssh-adSkh4btDHWr/xauthfile",O_RDONLY,0666) ERR#2 'No such file or directory'
2506: access("/tmp/ssh-adSkh4btDHWr/xauthfile",F_OK) ERR#2 'No such file or directory'
2506: write(2,"/usr/local/bin/xauth: file /tmp/ssh-adSkh4btDHWr/xauthfile does not exist\n",75) = 75 (0x4b)

The file didn't exist, it couldn't be read, and it still didn't
exist. Then log a complaint. Nothing ever tried to create the
file in question.

Post by Matthias Apitz
2506: access("/tmp/kde-guru/xauth-1001-_0",R_OK) = 0 (0x0)
2506: open("/tmp/kde-guru/xauth-1001-_0",O_RDONLY,0666) = 4 (0x4)
2506: write(2,"/usr/local/bin/xauth: (argv):1: ",33) = 33 (0x21)

Some KDE-specific file was opened for read...

Post by Matthias Apitz
2506: lstat("/tmp/ssh-adSkh4btDHWr/xauthfile-c",{ mode=-rw------- ,inode=24961,size=0,blksize=32768 }) = 0 (0x0)
2506: unlink("/tmp/ssh-adSkh4btDHWr/xauthfile-c") = 0 (0x0)
2506: lstat("/tmp/ssh-adSkh4btDHWr/xauthfile-l",{ mode=-rw------- ,inode=24961,size=0,blksize=32768 }) = 0 (0x0)
2506: unlink("/tmp/ssh-adSkh4btDHWr/xauthfile-l") = 0 (0x0)
2505: unlink("/tmp/ssh-adSkh4btDHWr/xauthfile") ERR#2 'No such file or directory'

And after finding the KDE file, the files and links created
earlier are discarded.

If I were to try something, I'd suggest killing KDE, logging in
from the console, and then seeing if you still have the same
problem. (Or looking at xauth's source for what it's doing with
KDE, and when /tmp/ssh-adSkh4btDHWr/xauthfile was supposed to
have been opened with O_CREAT, and why it might not have been.)

[Matthias Apitz]

The answers in https://lists.freebsd.org/pipermail/freebsd-x11/2018-May/021032.html
move us now to the source of the problem and its solution.

matthias

[Valeri Galtsev]

Post by Matthias Apitz
The answers in https://lists.freebsd.org/pipermail/freebsd-x11/2018-May/021032.html
move us now to the source of the problem and its solution.

Forward X trusted, huh (ssh -Y ...). I do try it if "ssh -X ..." doesn't
work, and it never occurred to me to ask/mention when answering on this
thread... Thanks for posting!

Valeri

Post by Matthias Apitz
matthias

[Matthias Apitz]

I recompiled the port x11-servers/xorg-server with adding "--enable-xcsecurity" to the
CONFIGURE_ARGS in the Makefile and now all is fine:

$ ssh -X ***@s70devl
Last login: Thu May 10 19:13:18 2018 from 10.49.94.187
/usr/bin/xauth: file /home/apitzm/.Xauthority does not exist
***@srap16dxr1:~> echo $DISPLAY
localhost:10.0
***@srap16dxr1:~> xclock

There was already a PR filed about this issue in
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=221984

And, last word, as I suspected and proofed from the beginning: the
problem was fully LOCAL in our beloved FreeBSD.

matthias