Alex Kernel Unix guy

First i'll explain the situation. There is a server running X11 applications that i want to display on my client PC running Windows at work with no public IP address and behind NAT/firewall, so the server doesn't see me in the internet. Nevermind that because i will create SSH tunnel using PuTTY client, so remote server will be able to connect to a port at my client PC. In Linux the setup is easier as you have SSH client built-in the shell environment, with PuTTY you have to point'n'click it everything.

To be able to forward X11 applications to remote display via SSH, we must check for some prerequisites. First of all on the server check if your SSH daemon configuration file (by me it's /etc/ssh/sshd_config) contains these lines:

X11Forwarding yes
X11DisplayOffset 10
X11UseLocalhost yes

X11Forwarding turns on the forwarding itself, X11DisplayOffset sets the display number to specified value, with local X-Servers the displays count from 0, that's why SSH X11 uses 10 to somehow differentiate it. X11UseLocalhost tells if the display should be bound only to localhost address which is 127.0.0.1 or if set to no, you can bind the display to other IP addresses.

Note also that the option:

UseLogin no

should be set to no, to enable the X11 forwarding. This is set to no by default but on some servers with more strict security settings, these can be set to yes.

Now for the XServer configuration. As we have set the display to offset 10, we need to configure this in our XServer as well.

If you use HummingBird Exceed that has rich functions, you will find this option in the Configuration window under Network and Communication if you use the Category View or under Communication if you use the Classic View. On the card Communication change the Display Number option to 10 and apply the changes, the XServer will need to restart.

If you use Xming that is free with basic functionality, you need to install XLaunch as well and start the XServer with XLaunch. Here you specify the Display number in the first window, click Next, Start no client and Next and on the next screen check the No Access Control checkbox. Click Next and Finish.

I don't use any other XServers, so if you have other, the configuration might be different. Now that we have both SSH daemon on the server and XServer configured and running, we can run PuTTY to configure the tunneling. You need to fill in at least Host name (or IP address) in the Session section of PuTTY configuration and then click +Connection -> +SSH -> X11 and set it like this:

Next click on the Tunnels and add the remote tunnel like this:

This will:

1. enable X11 forwarding to your SSH client (in here it's PuTTY)
2. set the display offset of the client to 10 on localhost (remote server – remember? X11DisplayOffset in sshd_config?)
3. create a REMOTE port forwarding tunnel, this means the service running at localhost:6010 will connect to your local port (from its perspective remote) 6010 on your client PC, this is important because if you leave it at Local, it won't be able to connect as it would expect your machine to establish the connection first but in this case the X11 application is connecting to your XServer running behind NAT/firewall... whatever, port 6010 is the port on which XServer is running on your machine (if you set the display to 10), you can check this by doing "netstat -an" in your cmd or powershell command line

Now you can open the SSH connection with these settings and establish a session to your SSH server. Set the display variable to use display number 10:

export DISPLAY=localhost:10.0

and you're ready and set to run X11 applications. If you set everything correctly, when you test for example with xclock, it should appear on your client PC screen. Remember that the tunnel and X11 application are dependent on having an established session to the server, so when you close the PuTTY window, all remote applications will be terminated.

linkuj.cz vybrali.sme.sk