Take the 2-minute tour ×

strange variation on the standard 'multi-hop tunnel' question.

I'm working remotely at the minute, but have several 'incoming' automatic reverse shells connecting to a dedicated server. This dedicated server does not have X, but several of the 'incoming' shell servers do.

Basically, take three machines, laptop, server, client. Laptop and client have X, server does not. All three machines have password-less logins to each other (laptop > server, server > client) and can password-lessly establish a shell.

I've tried ssh -X user@server "ssh -X user@client gui-application" and, no suprise, I'm getting 'Cannot open Display" messages.

Does anyone know I nice one-liner for this kind of tunnelling?

share|improve this question
This shouldn't depend on the remote site running X or not -- all you should need is a local X server. So could you explain your setup more clearly? What server do you connect to what (what is "automatic")? Is your local X server running when you open the tunnels? And how do you use your tunnels? –  Benjamin Bannier Jul 7 '10 at 4:34
the automatic is just that the servers are set up to re-establish the reverse shells if the connection drops/times out. Setup more clearly explained in update. –  Andrew Bolster Jul 7 '10 at 5:35

3 Answers 3

up vote 3 down vote accepted

Your command actually works for me, so I don't think you need to do anything very different. However, I did find that it worked a lot more snappily if I used a -t option on the first ssh:

ssh -tX user@server "ssh -X user@client gui-application"

This seems to be something to do with ssh-agent and asking for a passphrase in my case, since my ssh keys are protected with passphrases. However, maybe it will help in your case too.

I also tried adding -A (agent forwarding) on both ssh commands, and this worked too, although with a delay of several seconds (not sure why). It came up with a GUI password dialog for the key for the hop from "server" to "client".

Remember that ssh with a command doesn't use .profile on the remote machine, so if you're relying on settings from there, that won't work, although you could probably run it explicitly with:

ssh -tX user@server ". .profile; ssh -X user@client gui-application"
share|improve this answer

Try punching straight through the first hop:

ssh -N -L 9999:client:22 user@server
ssh -p 9999 -X user@localhost gui-application

The first command will forward local port 9999 to the client's SSH port. Leave this command running - it won't produce output after you log in. The second command will SSH to your local port 9999, which is actually the "client" SSH port, and launch the GUI.

Take that for a spin.

share|improve this answer

Sounds like your hop server doesn't allow X Set 'X11Forwarding yes' in the /etc/ssh/sshd_config of your hop server (also don't forget to restart sshd after changing the settings.

share|improve this answer

Your Answer


