SSH Port Forwarding and X11 Question !

[Karun]

Hi Guys !
I have the following problem. I need to know if ssh port forwarding can be done for this.

I have Server A (Solaris)which needs to run a grpahics program.
Server A resides behind a Firewall.
Server B (Solaris) has access to Server A through ssh. There is a Firewall Rule that was implemented to allow ssh traffic from Server B to Server A.
Both Server A and Server B do not have Graphics monitor attached to it.
I have PC C in which I'm running cygwin (X server). I would like to display the grpahics program that is invoked on Server A on my PC C. My PC can ssh (using putty) to Server B as they are in the same network.

Obviously, when I export the display on Server A to my PCs IP address, I'm getting "Can't open Display" because Server A cannot talk to my PC directly.

Thanks very much for your input.

[Barry Brimer-2]

> I have Server A (Solaris)which needs to run a grpahics program.
> Server A resides behind a Firewall.
> Server B (Solaris) has access to Server A through ssh. There is a Firewall
> Rule that was implemented to allow ssh traffic from Server B to Server A.
> Both Server A and Server B do not have Graphics monitor attached to it.
> I have PC C in which I'm running cygwin (X server). I would like to display
> the grpahics program that is invoked on Server A on my PC C. My PC can ssh
> (using putty) to Server B as they are in the same network.
>
> Obviously, when I export the display on Server A to my PCs IP address, I'm
> getting "Can't open Display" because Server A cannot talk to my PC directly.

I am not familiar with Solaris, but if it works the same as RHEL, this
should work.

1.  Start X server on PC C.
2.  Configure Putty to use X11 on "localhost:0".
3.  Ssh to Server B.
4.  Ssh with Xll forwarding (usually ssh -X) to Server A.
5.  Run X Application.

The key is that by using the above method, your X traffic will be wrapped
in your SSH connection which can traverse your firewall.  When you export
your display, you are not wrapping your X traffic in an SSH session, and
most likely, it will not be able to traverse the firewall.

Barry

[Thiago LPS]

Ok

now you have to do it

log into your firewall with ssh -X firewall ( the -X is to do a X-forwarding)

after this... do it:

ssh -X solaris

so.. every GUI that you execute in solaris will be forwarded to
firewall, but the there is one more X-forward on firewall that will
redirect the X-session to your box

this worked with me... :)

remember to set up X-forwarding enable on sshd_config







On 11/14/06, Karun <karunanidhis@...> wrote:

>
> Hi Guys !
> I have the following problem. I need to know if ssh port forwarding can be
> done for this.
>
> I have Server A (Solaris)which needs to run a grpahics program.
> Server A resides behind a Firewall.
> Server B (Solaris) has access to Server A through ssh. There is a Firewall
> Rule that was implemented to allow ssh traffic from Server B to Server A.
> Both Server A and Server B do not have Graphics monitor attached to it.
> I have PC C in which I'm running cygwin (X server). I would like to display
> the grpahics program that is invoked on Server A on my PC C. My PC can ssh
> (using putty) to Server B as they are in the same network.
>
> Obviously, when I export the display on Server A to my PCs IP address, I'm
> getting "Can't open Display" because Server A cannot talk to my PC directly.
>
> Thanks very much for your input.
>
> --
> View this message in context: http://www.nabble.com/SSH-Port-Forwarding-and-X11-Question-%21-tf2632425.html#a7347094
> Sent from the SSH (Secure Shell) mailing list archive at Nabble.com.
>
>

--
--------------------------------------------------
Thiago LPS
C.E.S.A.R - Administrador de Sistemas
msn: thiago.lps@...
0xx 81 8735 2591
--------------------------------------------------

[Javier Reyna Padilla]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

If you have problem bypassing X-11 session on your FW this woulb be a
nice option, but take in consideration, that some comercial firewalls
like checkpoint ( I don't know if it happens the same with ..e.g.
netfilter)  does not apply state-inspection to X-11 connections and need
to setup a bidirectional rule, from server a to pc C ando from pc C to
server A, like a packet filter.

It is not the principal topic but it might save someone a bit of time.

Thiago LPS wrote:

> Ok
>
> now you have to do it
>
> log into your firewall with ssh -X firewall ( the -X is to do a
> X-forwarding)
>
> after this... do it:
>
> ssh -X solaris
>
> so.. every GUI that you execute in solaris will be forwarded to
> firewall, but the there is one more X-forward on firewall that will
> redirect the X-session to your box
>
> this worked with me... :)
>
> remember to set up X-forwarding enable on sshd_config
>
>
>
>
>
>
>
> On 11/14/06, Karun <karunanidhis@...> wrote:
>>
>> Hi Guys !
>> I have the following problem. I need to know if ssh port forwarding
>> can be
>> done for this.
>>
>> I have Server A (Solaris)which needs to run a grpahics program.
>> Server A resides behind a Firewall.
>> Server B (Solaris) has access to Server A through ssh. There is a
>> Firewall
>> Rule that was implemented to allow ssh traffic from Server B to Server A.
>> Both Server A and Server B do not have Graphics monitor attached to it.
>> I have PC C in which I'm running cygwin (X server). I would like to
>> display
>> the grpahics program that is invoked on Server A on my PC C. My PC can
>> ssh
>> (using putty) to Server B as they are in the same network.
>>
>> Obviously, when I export the display on Server A to my PCs IP address,
>> I'm
>> getting "Can't open Display" because Server A cannot talk to my PC
>> directly.
>>
>> Thanks very much for your input.
>>
>> --
>> View this message in context:
>> http://www.nabble.com/SSH-Port-Forwarding-and-X11-Question-%21-tf2632425.html#a7347094
>>
>> Sent from the SSH (Secure Shell) mailing list archive at Nabble.com.
>>
>>
>
>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFYrG4jKoWsBzmW8oRAi9OAKDa0wwvvizdo5DQxVmChrYCaYVeVwCgrF0L
B+kPRedJXCQ8tAzw4RMasbg=
=a1bB
-----END PGP SIGNATURE-----