Sign up ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

What is the difference between ssh -Y (trusted X11 forwarding) and ssh -X (untrusted X11 forwarding)? As far as I have understood it, it has something to do with security, but I did not grasp the difference and when to use which.

share|improve this question

2 Answers 2

up vote 47 down vote accepted

Both options have something to do with X11 forwarding. This means if you enable this you can use a graphical client through your SSH session (i.e. use Firefox or something else).

If you use ssh -X remotemachine the remote machine is treated as an untrusted client. So your local client sends a command to the remote machine and receives the graphical output. If your command violates some security settings you'll receive an error instead.

But if you use ssh -Y remotemachine the remote machine is treated as trusted client. This last option can open security problems. Because other graphical (X11) client could sniff data from the remote machine (make screenshots, do keylogging and other nasty stuff) and it is even possible to alter those data.

If you want to know more about those things I suggest reading the Xsecurity manpage or the X Security extension spec. Furthermore you can check the options ForwardX11 and ForwardX11Trusted in your /etc/ssh/ssh_config.

share|improve this answer
The ssh manpage uses unfortunate wording, suggesting (at least to me) that -X is unsafe to use and -Y is better. So thank you for this answer. – Torsten Bronger Sep 9 '14 at 7:08
So, with -X is it impossible for other clients to sniff or alter data? – musiphil Nov 18 '14 at 0:44

Yes. -Y is for trusted X11 forwarding, while -X is for untrusted X11 forwarding. X11 forwarding just allows you to use X11 (i.e. graphical) applications over an SSH session.

I'm not sure what the meaningful difference is between trusted and untrusted X11 connections, but I'm sure it has to do with the server-side configuration (i.e. ssh-config, sshd-config, etc.). Check with your server or network admin about which flag to use.

share|improve this answer
Both computer are my private ones, so there is network admin I could ask. But I guess it is "trusted" then, therefore I could use -Y I guess. – Martin Ueding Apr 16 '11 at 20:11
I don't have enough rep to downvote, so I have to say: This answer contributes nothing whatsoever. – underscore_d Sep 24 at 17:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.