Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the difference between ssh -Y (trusted X11 forwarding) and ssh -X (untrusted X11 forwarding)? As far as I have understood it, it has something to do with security, but I did not grasp the difference and when to use which.

share|improve this question
up vote 55 down vote accepted

Both options have something to do with X11 forwarding. This means if you enable this you can use a graphical client through your SSH session (i.e. use Firefox or something else).

If you use ssh -X remotemachine the remote machine is treated as an untrusted client. So your local client sends a command to the remote machine and receives the graphical output. If your command violates some security settings you'll receive an error instead.

But if you use ssh -Y remotemachine the remote machine is treated as trusted client. This last option can open security problems. Because other graphical (X11) client could sniff data from the remote machine (make screenshots, do keylogging and other nasty stuff) and it is even possible to alter those data.

If you want to know more about those things I suggest reading the Xsecurity manpage or the X Security extension spec. Furthermore you can check the options ForwardX11 and ForwardX11Trusted in your /etc/ssh/ssh_config.

share|improve this answer
4  
The ssh manpage uses unfortunate wording, suggesting (at least to me) that -X is unsafe to use and -Y is better. So thank you for this answer. – Torsten Bronger Sep 9 '14 at 7:08
    
So, with -X is it impossible for other clients to sniff or alter data? – musiphil Nov 18 '14 at 0:44
2  
So why would one want to use -Y instead of -X in general? – Wernight Jan 5 at 13:56
    
I have the same question (why to use -Y) and the only case that I understood this may be useful is when the security control on the server side is somehow not implemented/not compatible. I have also read that forwarding X11 is generally a powerful and dangerous tool that should be treated as such. – MakisH Jan 24 at 0:02
    
Both links are 404 now, unfortunately. The site seems to be dead since 2014. – m00am Mar 3 at 9:56

Yes. -Y is for trusted X11 forwarding, while -X is for untrusted X11 forwarding. X11 forwarding just allows you to use X11 (i.e. graphical) applications over an SSH session.

I'm not sure what the meaningful difference is between trusted and untrusted X11 connections, but I'm sure it has to do with the server-side configuration (i.e. ssh-config, sshd-config, etc.). Check with your server or network admin about which flag to use.

share|improve this answer
1  
Both computer are my private ones, so there is network admin I could ask. But I guess it is "trusted" then, therefore I could use -Y I guess. – Martin Ueding Apr 16 '11 at 20:11
2  
I don't have enough rep to downvote, so I have to say: This answer contributes nothing whatsoever. – underscore_d Sep 24 '15 at 17:22

Use neither when you don't need to run X11 programs remotely; use -X when you do; and hypothetically use -Y if an X11 program you care about works better with -Y than with -X. But currently (Ubuntu 15.10), -X is identical to -Y, unless you edit ssh_config to say ForwardX11Trusted no. -X was originally intended to enable the X Security extension of the 1990's, but that is old and inflexible, and crashes some programs, and so is ignored by default.

Both ssh -Y and -X let you run an X11 program on a remote machine, with its windows appearing on the local X monitor. The issue is what the program is allowed to do to other programs' windows, and to the X server itself.

local$ ssh -X remote
remote$ xlogo
# Runs xlogo on remote, but the logo pops up on the local screen.

Trusted X11 forwarding is enabled by -Y. This is the historical behavior. A program with access to the display, is trusted with access to the entire display. It can screenshot, keylog, and inject input into all the windows of other programs. And it can use all X server extensions, including ones like accelerated graphics, which are security exposures. Which is good for running smoothly, but bad for security. You are trusting the remote programs to be as safe as your local programs.

Untrusted X11 forwarding tries to restrict remote programs to accessing only their own windows, and to using only those parts of X which are relatively secure. Which sounds good, but currently doesn't work well in practice.

The meaning of -X currently depends on your ssh configuration.

On Ubuntu 14.04 LTS, unless you edit your ssh_config, there is no difference between -X and -Y. "[B]ecause too many programs currently crash in [untrusted] mode."

ubuntu1404$ man ssh
...
 -X      Enables X11 forwarding.  This can also be specified on a per-host
         basis in a configuration file.
         ...
         (Debian-specific: X11 forwarding is not subjected to X11 SECURITY
         extension restrictions by default, because too many programs cur‐
         rently crash in this mode.  Set the ForwardX11Trusted option to
         “no” to restore the upstream behavior.  This may change in
         future depending on client-side improvements.)

ubuntu1404$ grep ForwardX11Trusted /etc/ssh/ssh_config
#   ForwardX11Trusted yes

If ForwardX11Trusted no, then -X enables untrusted forwarding. Otherwise, -X is treated the same as -Y, trusting that remote programs with display access are friendly.

share|improve this answer

If you use the -X option:

-X   Enables X11 forwarding.  This can also be specified on a per-host
     basis in a configuration file.

     X11 forwarding should be enabled with caution.  Users with the
     ability to bypass file permissions on the remote host (for the
     user's X authorization database) can access the local X11 display
     through the forwarded connection.  An attacker may then be able
     to perform activities such as keystroke monitoring.

     For this reason, X11 forwarding is subjected to X11 SECURITY
     extension restrictions by default.  Please refer to the ssh -Y
     option and the ForwardX11Trusted directive in ssh_config(5) for
     more information.

You will have a risk of SSH agent forwarding. The -X option allows a chain of ssh connections to forward key challenges back to the original agent, obviating the need for passwords or private keys on any intermediate machines. A program with root account, on an intermediate machine, can copy the ssh private key and make connections with it.

-Y      Enables trusted X11 forwarding.  Trusted X11 forwardings are not
        subjected to the X11 SECURITY extension controls.

The option -Y, corresponding to the ForwardX11Trusted directive in ssh_config(5), is even less secure because, it removes X11 SECURITY extension controls.

It's more secure to use -x

-x   Disables X11 forwarding.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.