I have several non-sudoers on an Ubuntu machine that needs to access to X11 forwarding
. However, I can't seem to find a workaround to pass X11 connection rejected because of wrong authentication
error as everytime the sudoer accounts logs out, the MAGIC-COOKIE
will be set to another, thus the non-sudoers will lose their correct xauth list
.
Steps to reproduce the issue:
Using a sudoer account I execute commands as :
sudo su - nonSudoerUser -c 'echo $DISPLAY'
NONE
sudo su - nonSudoerUser -c 'xauth list'
NONE
sudo su - nonSudoerUser -c 'firefox &'
X11 connection rejected because of wrong authentication
Now checking the sudoer side:
xauth list
NAME/unix:10 MIT-MAGIC-COOKIE-1 c1ed9d514d3c1ca1166d20b3edd794b6
Copy that to the non-sudoer ~/.Xauthority:
sudo su - nonSudoerUser -c 'xauth add NAME/unix:10 MIT-MAGIC-COOKIE-1 c1ed9d514d3c1ca1166d20b3edd794b6'
Check if it's working:
sudo su - nonSudoerUser -c 'echo $DISPLAY'
localhost:10.0
Now, log out/in and recheck sudoers list and we see the MAGIC-COOKIE
is changed and the non-sudoer can't connect to X11 anymore.
On my sshd_config I have:
Host *
X11Forwarding yes
ForwardX11Trusted yes
X11DisplayOffset 10
Also, I tried:
$sudo xhost +
access control disabled, clients can connect from any host
Without any success. Can anyone clarify this issue? Thanks.
ssh
with the-X
or-Y
option) and doesn't depend onsudo
status at all.ssh -XY non-sudoerUser@IP
to connect, but they can not have an X11 session run. This error returns:X11 connection rejected because of wrong authentication