Hello,
After ssh -X on a remote machine If I tried to run
sudo gparted I get X11 connection rejected because of wrong authentication.
while I can sudo on this machine.
It it specific to gparted ?
Thank.
=========================================================================== Patrick DUPRÉ | | email: pdupre@gmx.com ===========================================================================
Am 07.06.2025 um 21:04:31 Uhr schrieb Patrick Dupre via users:
X11 connection rejected because of wrong authentication.
while I can sudo on this machine.
X11 uses a Cookie to authenticate.
It it specific to gparted ?
Did you use gparted or gparted-root, which exists on some systems and invokes policykit?
On Sat, 7 Jun 2025 at 20:05, Patrick Dupre via users < users@lists.fedoraproject.org> wrote:
After ssh -X on a remote machine If I tried to run
sudo gparted I get X11 connection rejected because of wrong authentication.
while I can sudo on this machine.
This isn't parted specific, you'll see similar behaviour from things like gnome-terminal and other windowing applications.
There are a bunch of things around propagating/copying SSH_AUTH_SOCK, MIT-MAGIC-COOKIE (as Marco alludes) that can help work through/around this.
See these articles for more info:
https://www.baeldung.com/linux/ssh-agent-forwarding-sudo-another-user https://www.simplified.guide/ssh/x11-forwarding-as-root
1. Check how your 'local' machine is configured:
$ set | grep SSH SSH_AUTH_SOCK=/run/user/1000/keyring/ssh $ ssh-add -l 256 SHA256:XXXxxxxXXXXXXXXX user@host 2025-05-07 (ED25519)
2. Connect to a 'remote' machine (it's the same system but essentially SSH treats it as a new machine):
$ ssh -X localhost $ set | grep SSH SSH_CLIENT='::1 33410 22' SSH_CONNECTION='::1 33410 ::1 22' SSH_TTY=/dev/pts/3
Note there's no SSH_AUTH_SOCK set.
If you just 'sudo' then none of those local SSH environment variables are inherited in the root shell:
$ sudo gparted X11 connection rejected because of wrong authentication.
(gpartedbin:132496): Gtk-WARNING **: 23:15:05.136: cannot open display: localhost:10.0
If you 'sudo -Es' that should work (unless some defaults have been messed with):
$ sudo -Es gparted X11 connection rejected because of wrong authentication.
(gpartedbin:132690): dbind-WARNING **: 23:19:48.688: Could not open X display GParted 1.7.0 configuration --enable-libparted-dmraid libparted 3.6
There's a warning, but gparted runs.
Note that neither sudo -Es nor xauth appear to allow root to run gnome-terminal (I was just testing a different application for completeness) but that's a Dbus thing and probably fixable.
On 6/7/25 12:04 PM, Patrick Dupre via users wrote:
Hello,
After ssh -X on a remote machine If I tried to run
sudo gparted I get X11 connection rejected because of wrong authentication.
while I can sudo on this machine.
It it specific to gparted ?
Thank.
=========================================================================== Patrick DUPRÉ | | email: pdupre@gmx.com ===========================================================================
Hi Pat,
I can get gparted to work after I "su" to root on the remote machine. (I see you used "sudo".)
This is my ssh run line: ssh -l todd -t -X -p xxxx aaa.bbb.ccc.ddd
Did you remember the "-X" in your run line?
-T
Thank.
It works.
However, what is the "-t" for ? man ssh does not provide this option
Sent: Sunday, June 08, 2025 at 5:12 AM From: "ToddAndMargo via users" users@lists.fedoraproject.org To: users@lists.fedoraproject.org Cc: "ToddAndMargo" ToddAndMargo@zoho.com Subject: Re: gparted
On 6/7/25 12:04 PM, Patrick Dupre via users wrote:
Hello,
After ssh -X on a remote machine If I tried to run
sudo gparted I get X11 connection rejected because of wrong authentication.
while I can sudo on this machine.
It it specific to gparted ?
Thank.
=========================================================================== Patrick DUPRÉ | | email: pdupre@gmx.com ===========================================================================
Hi Pat,
I can get gparted to work after I "su" to root on the remote machine. (I see you used "sudo".)
This is my ssh run line: ssh -l todd -t -X -p xxxx aaa.bbb.ccc.ddd
Did you remember the "-X" in your run line?
-T
-- _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Am 08.06.2025 um 09:58:55 Uhr schrieb Patrick Dupre via users:
However, what is the "-t" for ? man ssh does not provide this option
Debian's manpage has it:
-t Force pseudo-terminal allocation. This can be used to execute arbitrary screen-based programs on a remote machine, which can be very useful, e.g. when implementing menu services. Multiple -t options force tty allocation, even if ssh has no local tty.
Hi.
On Sun, 08 Jun 2025 09:58:55 +0200 Patrick Dupre via users wrote:
I can get gparted to work after I "su" to root on the remote machine. (I see you used "sudo".)
It works.
Right. This is because su forwards (properly) the xauth keys. It does that by using pam_xauth (see man pam_xauth, /etc/pam.d/su).
You can also achieve that with sudo with:
XAUTHORITY=${XAUTHORITY:-~/.Xauthority} sudo garted
but this assumes:
- that root as the right to read the ~/.Xauthority file of the user. This will not be the case for example if the user homedir is under an NFS mountpoint.
- that /etc/sudoers keeps the XAUTHORITY variable (it does on Fedora-42) if this is not the case, use:
XAUTHORITY=${XAUTHORITY:-~/.Xauthority} sudo -E garted
Setting XAUTHORITY is needed because 'ssh -X' uses the default: ~/.Xauthority but sudo (unlike pam_xauth) does not manage this case: it only keeps the XAUTHORITY variable in the environment.
A more proper way to use sudo for that is thus:
XAUTHORITY=${XAUTHORITY:-~/.Xauthority} sudo su root -c gparted
Ie: use su to properly forward the xauth keys.
This will work even in the case were root doen't have a password, as su do not ask for a password if one is root already (see: pam_rootok).
On Sun, 08 Jun 2025 10:45:05 +0200 Francis.Montagnac@inria.fr wrote:
A more proper way to use sudo for that is thus: XAUTHORITY=${XAUTHORITY:-~/.Xauthority} sudo su root -c gparted Ie: use su to properly forward the xauth keys.
Note that this still assumes that root has access to the user ~/.Xauthority file (or the one defined as $XAUTHORITY).
The only added security it does is to restrict the xauth key to the current DISPLAY.
On 6/8/25 1:28 AM, Patrick Dupre via users wrote:
Thank for the feedback. I did not try because Todd gave an easier option. However, I also have an issue with gnome-terminal For example,it does not "wrok" between 2 fedora machines. /usr/bin/gnome-terminal does not open a new terminal (not complain either)
It probably does open a new terminal but on the real display. Gnome terminal uses a central process to spawn windows from and probably communicates via dbus.
It looks like ptyxis (the replacement for gnome-terminal) supports multiple sessions. Try running "ptyxis -s" instead.
Subject: Re: gparted
On 6/8/25 1:28 AM, Patrick Dupre via users wrote:
Thank for the feedback. I did not try because Todd gave an easier option. However, I also have an issue with gnome-terminal For example,it does not "wrok" between 2 fedora machines. /usr/bin/gnome-terminal does not open a new terminal (not complain either)
It probably does open a new terminal but on the real display. Gnome terminal uses a central process to spawn windows from and probably communicates via dbus.
It looks like ptyxis (the replacement for gnome-terminal) supports multiple sessions. Try running "ptyxis -s" instead.
ptyxis -s ptyxis: symbol lookup error: ptyxis: undefined symbol: vte_terminal_get_current_container_runtime
On 6/8/25 2:36 PM, Patrick Dupre via users wrote:
Subject: Re: gparted
On 6/8/25 1:28 AM, Patrick Dupre via users wrote:
Thank for the feedback. I did not try because Todd gave an easier option. However, I also have an issue with gnome-terminal For example,it does not "wrok" between 2 fedora machines. /usr/bin/gnome-terminal does not open a new terminal (not complain either)
It probably does open a new terminal but on the real display. Gnome terminal uses a central process to spawn windows from and probably communicates via dbus.
It looks like ptyxis (the replacement for gnome-terminal) supports multiple sessions. Try running "ptyxis -s" instead.
ptyxis -s ptyxis: symbol lookup error: ptyxis: undefined symbol: vte_terminal_get_current_container_runtime
Are you still running F40? This seems to be an issue on that release and of course it will never get fixed now.
-
Francis.Montagnac＠inria.fr -
Marco Moock -
Patrick Dupre -
Samuel Sieb -
ToddAndMargo -
Will McDonald