I have the following setup:

My work computer is running Ubuntu 18.04, with the following /etc/ssh/sshd_config:

#       $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Port 3022
#AddressFamily any
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile     .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM no

AllowAgentForwarding no
AllowTcpForwarding no
#GatewayPorts no
X11Forwarding yes
X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintLastLog yes
TCPKeepAlive no
#UseLogin no
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
Banner /etc/issue.net
PrintMotd yes

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem       sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
Match User me
        AllowAgentForwarding yes
        AllowTcpForwarding yes
        X11Forwarding yes
        X11UseLocalhost no
        PermitTunnel yes

I currently don't have physical access to the work computer. So I'm connecting to it from home. My home PC is running Windows 10 with the Windows Subshell for Linux running Ubuntu 18.04. In there ~/.ssh/config contains the following:

# Defaults
Host *
        ForwardAgent no
        ForwardX11 no
        ForwardX11Trusted no
        User me
        Protocol 2
        ServerAliveInterval 0
        TcpKeepAlive no

# Workstation
Host workcomputer
        HostName machine.domain.com
        Port 3022
        ForwardX11 Yes
        ForwardX11Trusted Yes

and ~/.profile contains the line


The home computer also has VcXsrv installed and running.

I am able to run apps like xeyes locally and they open up just fine in the VcXsrv window (although I need to run it as xeyes -display :0 because xeyes doesn't seem to use the $DISPLAY variable). However, I can't get any remote GUI applications to appear.

me@Home:~$ ssh workcomputer
me@Work:~$ echo $DISPLAY

me@Work:~$ gedit
Unable to init server: Could not connect: Connection refused

(gedit:20107): Gtk-WARNING **: 16:58:42.096: cannot open display:

I've tried running export DISPLAY=:0 on the remote machine and gedit did run after that but didn't appear on my local machine in the VcXsrv window. I also tried export DISPLAY=:10 but that again resulted in Connection refused. I also tried connecting with ssh -X but that didn't work either.

What else can I try to be able to open remote GUI applications on my local X server?


So I've finally managed to make this work properly. Several things to do (in addition to the original post):

  1. On both local and remote install xauth and generate entries for :0.

     sudo apt install xauth
     xauth generate :0 . trusted

This may or may not be required on remote, but it's definitely required on local to get rid of warnings about missing authentication data. This may also be required on local depending on where your xauth gets installed.

  1. On local put this exact line (without shortening or omitting anything) in ~/.bashrc (remove it from ~/.profile):

     export DISPLAY=localhost:0.0

3. Even though ForwardX11 and ForwardX11Trusted are set to Yes in your ~/.ssh/config, use the -Y (or -X if you don't trust the connection) switch when connecting:

    ssh -Y workcomputer

I'm not sure why this is required but for some reason it doesn't forward X11 without the switches for me.


Regarding the 3rd point, the reason the -Y switch was necessary for me was that my ssh configuration file improperly had default values at the top. Ordering in it matters (the first match for each parameter is used), and as such the appropriate fix, rather than always using -Y, is to invert the entries in the ~/.ssh/config file:

# Workstation
Host workcomputer
        HostName machine.domain.com
        Port 3022
        ForwardX11 Yes
        ForwardX11Trusted Yes

# Defaults
Host *
        ForwardAgent no
        ForwardX11 no
        ForwardX11Trusted no
        User me
        Protocol 2
        ServerAliveInterval 0
        TcpKeepAlive no

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.