2

I have several non-sudoers on an Ubuntu machine that needs to access to X11 forwarding. However, I can't seem to find a workaround to pass X11 connection rejected because of wrong authentication error as everytime the sudoer accounts logs out, the MAGIC-COOKIE will be set to another, thus the non-sudoers will lose their correct xauth list.

Steps to reproduce the issue:

Using a sudoer account I execute commands as :

sudo su - nonSudoerUser -c 'echo $DISPLAY'
NONE
sudo su - nonSudoerUser -c 'xauth list'
NONE
sudo su - nonSudoerUser -c 'firefox &'
X11 connection rejected because of wrong authentication

Now checking the sudoer side:

xauth list
NAME/unix:10  MIT-MAGIC-COOKIE-1  c1ed9d514d3c1ca1166d20b3edd794b6

Copy that to the non-sudoer ~/.Xauthority:

sudo su - nonSudoerUser -c 'xauth add NAME/unix:10  MIT-MAGIC-COOKIE-1  c1ed9d514d3c1ca1166d20b3edd794b6'

Check if it's working:

sudo su - nonSudoerUser -c 'echo $DISPLAY'
localhost:10.0

Now, log out/in and recheck sudoers list and we see the MAGIC-COOKIE is changed and the non-sudoer can't connect to X11 anymore.

On my sshd_config I have:

Host *
X11Forwarding yes
ForwardX11Trusted yes
X11DisplayOffset 10

Also, I tried:

$sudo xhost +
access control disabled, clients can connect from any host

Without any success. Can anyone clarify this issue? Thanks.

2
  • What exactly do you mean by "access to X11 forwarding (separate on their own $DISPLAY)"? Normally that's something that's set up by a remote client (such as invoking ssh with the -X or -Y option) and doesn't depend on sudo status at all. – steeldriver Apr 3 '18 at 11:37
  • @steeldriver, they use ssh -XY non-sudoerUser@IP to connect, but they can not have an X11 session run. This error returns: X11 connection rejected because of wrong authentication – Amir Apr 3 '18 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.