Re: X-11 forwarding, ssh, multiple hosts

["William Underwood" <wllmundrwd@charter.net>]

On Mon, 05 May 2003 11:52:59 -0400
 "William Underwood" <wllmundrwd@charter.net> wrote:
>ssh w/X-tunnel: ClientA <-> ServerA works
>ssh w/X-tunnel: ServerA <-> ServerB works
>ssh w/X-Tunnel: ClientA <-> ServerA <-> ServerB fails... :-(

Okay,
  After reading all the replies (Thank you! especially Bob) and trying some
more experimentation, this seems to work (syntax may vary):

In one terminal/session on clientA run this:
ssh2 -L XX:hostB:YY user@hostA

In a separate terminal/session on clientA run this:
ssh2 -p XX user@clientA

After logging in, you should be presented with something like this:
user hostB >

So, at that point you could do:
user hostb > xterm &

Now, our clients automatically request X-forwarding, if yours doesn't, you'll
have to expand the command like this (syntax may vary):
ssh2 -p XX -X user@clientA

Additionally, it does seem that you can "stack" the connections...
In one terminal/session on clientA run this:
ssh2 -L XX:hostB:YY user@hostA
ssh2 -L YY:hostC:XX user@hostB
ssh2 -L XX:hostD:YY user@hostC
ssh2 -L YY:hostE:XX user@hostD
ssh2 -L XX:hostF:YY user@hostE

In a separate terminal/session on clientA run this:
ssh2 -p XX user@clientA (or user@localhost)

After logging in, you should be presented with this:
user hostE >

When building the connections, the first port after the -L should be a random
high port (unless you're running as root, but nobody does that, right?), and
the second should be the listening port (usually 22) of the SSHD on the
target machine.  However, if you're stacking the connections, only the very
last connection will be 22, the others will be random high ports...

Perhaps it is just the version of SSH[D] we're using, but it does not seem
that you can run all the ssh2 commands together on one line, like this:
ssh2 -L XX:hostB:YY user@hostA ssh2 -L YY:hostC:XX user@hostB ssh2 -L
XX:hostD:YY user@hostC ssh2 -L YY:hostE:XX  user@hostD ssh2 -L XX:hostF:YY
user@hostE

Plus, that wouldn't be a good idea anyway, because one of the port forwards
may fail, and you could miss seeing the error, and wouldn't be able to figure
out why you can't login to the target server...

Oh, one more thing:  In a private email, someone suggested SSHing to the
inbetween server and then to the target server, and just issuing a set
DISPLAY clientA:0 or something like that.  That won't achieve the desired
effect, which is SSH-tunneled Xapps.  Plus, unless you have totally open X
ports all the way from the target host to the client, it will fail to
connect.

Thanks all,
William

-- 
William Underwood
wllmundrwd@charter.net

-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.