#1069236 openssh-server: X over ssh fails with "cannot open display"

Package:
openssh-server
Source:
openssh-server
Description:
secure shell (SSH) server, for secure access from remote machines
Submitter:
allan
Date:
2024-04-23 11:09:03 UTC
Severity:
normal
#1069236#5
Date:
2024-04-18 11:33:00 UTC
From:
To:
On four Sid machines here X over ssh fails with "cannot open display".

Resolved the issue by editing /etc/ssh/sshd_config and changing

#AddressFamily any

to

AddressFamily inet

and restarting sshd.

#1069236#10
Date:
2024-04-18 12:53:52 UTC
From:
To:
More info - IPv6 is disabled on all four machines.  I think
"AddressFamily any" should have supported an IPv4 connection.

#1069236#15
Date:
2024-04-23 10:38:52 UTC
From:
To:
This is not a reasonable change to make to the default configuration,
because it would mean that ssh did not work out of the box in IPv6
environments.

*How* is it disabled? More information will be needed to figure out
exactly what's gone on in your environment.

I speculate that the hostnames you were trying to connect to were
resolving as IPv6 addresses, and the connection failing because the
hosts are rejecting IPv6 traffic. If that's right, the ultimate fix
is to correct whatever name resolution is giving you the wrong
addresses in your environment.

If you are prepared to experiment, we might be able to drill down and
check that. If so, can you

1) reverse the sshd_config change you made on at least one of the
   hosts, and restart that sshd

2) assuming the troublesome host is named "myhost" in your environment
   (substitute as appropriate), from your client machine, report the
   result of running

    getent hosts myhost
    dig +short myhost
    nslookup myhost
    ping -c 1 myhost

    (one or more of these commands may not exist on your machine)

2) re-attempt to connect from your client, this time passing -vv or
   -vvv, and capture the logging output

#1069236#20
Date:
2024-04-23 11:06:42 UTC
From:
To:
I'm not using a hostname with ssh, I'm sshing directly to an IPv4 address.

*How* was it disabled?  net.ipv6.conf.all.disable_ipv6 = 1 in /etc/sysctl.conf

My point is that "AddressFamily any" should not fail to set $DISPLAY
if IPv6 is not available.