5.2p1 no longer sets DISPLAY

[Parsons, Rick]

Hi, I have Solaris 8+ systems with a working OpenSSH 3.9p1 build which
work perfectly. We set X11Forwarding to yes in the config and get
DISPLAY=3Dlocalhost:10.0 allowing X tunnelling back.

I have just recently built OpenSSH 5.2p1 and installed sshd on some
machines and now the DISPLAY env variable is not set at all. As far as I
can tell, nothing else has changed (account dot files are the same,
client ssh is still 3.9p1 and sshd_config is the same). The only way I
can get DISPLAY to work is to set X11UseLocalhost to no in sshd_config
and then it gets <hostname>:10.0 and works just fine.

I have tried forcing X11DisplayOffset and XAuthLocation (and checked
that it was right). I have tried ssh -X (though that is the default) and
ssh -Y and none of these make any difference. The messages from -vv show
the two calls to xauth followed by "Requesting X11 forwarding with
authentication spoofing" and "channel 0: request x11-req confirm 0" just
the same as the working version.

I can only presume that I have done something wrong with the build but
can't see what. Any ideas please?

--=20
Cheers,

Rick Parsons

Bristol, England

[Darren Tucker]

Post by Parsons, Rick
Hi, I have Solaris 8+ systems with a working OpenSSH 3.9p1 build which
work perfectly. We set X11Forwarding to yes in the config and get
DISPLAY=localhost:10.0 allowing X tunnelling back.
I have just recently built OpenSSH 5.2p1 and installed sshd on some
machines and now the DISPLAY env variable is not set at all. As far as I
can tell, nothing else has changed (account dot files are the same,
client ssh is still 3.9p1 and sshd_config is the same). The only way I
can get DISPLAY to work is to set X11UseLocalhost to no in sshd_config
and then it gets <hostname>:10.0 and works just fine.
I have tried forcing X11DisplayOffset and XAuthLocation (and checked
that it was right). I have tried ssh -X (though that is the default) and
ssh -Y and none of these make any difference. The messages from -vv show
the two calls to xauth followed by "Requesting X11 forwarding with
authentication spoofing" and "channel 0: request x11-req confirm 0" just
the same as the working version.
I can only presume that I have done something wrong with the build but
can't see what. Any ideas please?

Try adding "AddressFamily inet" to sshd_config and restarting.

If that works: what's happening is that the OS is asked for a list of
addresses for localhost and is returning a list that includes the inet6
address, however attempting to bind to it fails. Previously sshd would
ignore this failure, but that allows third parties to bind to inet6
ports in the X11 forwarding range and potentially hijack X connections.
For more detail see the 5.1 release notes
(http://www.openssh.com/txt/release-5.1).

[Parsons, Rick]

Post by Darren Tucker
Try adding "AddressFamily inet" to sshd_config and restarting.

Thanks Darren, that works perfectly. I must have missed that in my trawl
through the changes. I must try to keep more up to date in the future so
the delta is not so great. We have no plans to go to IPv6 in the near
future so it shouldn't be a problem.

--=20
Cheers,

Rick Parsons

Bristol, England