2

I'd like to understand about xauth and DISPLAY variable and how ssh -X auto-generate the DISPLAY variable and why it choose those values? I've seen is somewhere that is not correct to set DISPLAY manually as well.

what mean each column of this output?

[root@serverdg ~]# xauth list
serverdg2/unix:11  MIT-MAGIC-COOKIE-1  87b515cf92e356b7702d3afd721f7fe1
serverdg2/unix:10  MIT-MAGIC-COOKIE-1  e8f9bfb5abac8757f4864656ce4f9bd1
serverdg/unix:12  MIT-MAGIC-COOKIE-1  7270008abd9f949a9b1af76c7742da9e
serverdg/unix:11  MIT-MAGIC-COOKIE-1  bb2f1768b445f372e5975d728579517e
serverdg/unix:10  MIT-MAGIC-COOKIE-1  475b9a6cbc7567b956511d5d2d27950b

Why ssh -X generate a value for DISPLAY variable with 10.0 like in this example?

[root@serverdg ~]# echo $DISPLAY
localhost:10.0

Everything I know is that I need to copy those values of xauth list and DISPLAY if I change my current user user to another user (su - user) to be able to use the X because this values are generate when is made a new login with ssh.

1
  • 1
    What is your exact question? "Why is it localhost:10.0 and not localhost:1.0?" A: to leave space for 10 local X11 servers (0..9), assuming they still want to listen on a tcp socket (which they don't anymore do by default). Commented Sep 30, 2020 at 22:20

1 Answer 1

4

The DISPLAY environment variable tells an application how to connect the X server. The X server is the part of the system that displays windows on the screen. A display is something on which windows can be displayed.

A unix system can have multiple displays, for example on multiple virtual consoles, or on multiple real consoles, or because some displays are virtual, or because some displays are accessed over the network. ssh -X forwards a connection to a remote display over the network.

Each display has a number. The purpose of these numbers is just to tell the displays apart. :0 is display number 0, :1 is display number 1, etc. One of the ways the display number is used is in how it allows applications to connect to the X server: it is used to calculate the name of a socket file (/etc/.X11-unix/X0, …) or the number of a TCP port (6000 plus the display number) on which the X server listens.

The .0 part after the display number is an obsolete concept. It's a “screen” number, where a display can consist of multiple screens, and a window is tied to a particular screen. On modern systems, the X server presents a single screen and allows application windows to move between monitors. :NUMBER is equivalent to :NUMBER.0.

There can be a machine name before the colon. This allows TCP communication between the application and the X server. This communication is not protected against network snooping and man-in-the-middle, so it's mostly deprecated on real networks, but can be useful in some cases, for example on a network between virtual machines running on the same host. In practice, if both work,localhost:NUMBER is functionally equivalent to :NUMBER (but :NUMBER may use a faster communication mechanism under the hood, and it's possible for only one of them to work because not all X servers listen both locally and via TCP; it's even technically possible to have different servers listening on localhost:NUMBER and :NUMBER but that would be a misconfiguration somewhere).

The entity that creates an X display must choose a display number. (It might do that by letting the server decide, but if so it needs to find out what number the server picked in order to set DISPLAY for applications.) Most programs pick the lowest available number, or a number that's hard-coded in some configuration file. In order to leave room for physical displays, SSH only picks numbers starting at 10.

It's generally not correct to set DISPLAY manually because only the entity that creates the display can pick the number. For example, in the case of ssh -X, that's SSH itself. If you set DISPLAY manually, you might get the number wrong, or you might advertise a display that doesn't exist (for example if X11 forwarding was refused).

Other users, or users on other machines, could attempt to connect to an X display that isn't their own. Because X was designed to allow remote connection, it couldn't just rely on the unix user. So X has an authorization mechanism: when an application wants to connect to an X display, it must prove that it is authorized. In the modern world, there's just one authorization mechanism, which is a “cookie” in the MIT-MAGIC-COOKIE-1 format (16 bytes, presented in hexadecimal). The cookie is a long random string that is generated when the server starts and stored in a file that only the legitimate user can read. In order to connect to the X display, the application must send the cookie value to the server. If the cookie value is incorrect, the server rejects the connection.

8
  • "The .0 part ... a “screen” number, ..., and an application is tied to a particular screen." An application is/was in no way tied to a particular screen on such a setup. As I already tried (apparently in vain) to explain. Commented Oct 1, 2020 at 22:20
  • @user414777 Well, yes, but only if there's a way to move the application to another screen. What application or window manager in current use allows that? Commented Oct 1, 2020 at 22:23
  • "localhost:NUMBER is functionally equivalent to :NUMBER" That's not true. The display number only has meaning within a protocol (tcp or unix). You can quite easily verify it by starting a Xephyr :10 server, and then running ssh -X localhost. DISPLAY=localhost:10 xclock will show a clock on your main screen, and DISPLAY=:10 xclock within the Xephyr server. Commented Oct 1, 2020 at 22:23
  • The window manager cannot do that, but an application can seemlessly recreate a window on another screen. (I think that emacs was able to that). But that's beside that point; an application or wm may also not let you reparent a window to another window within the same screen, or change its background color from yellow to green, that doesn't mean that it's "tied to yellow" ;-) Commented Oct 1, 2020 at 22:26
  • 1
    @Jeenu I don't know the history, but the range had to be disjoint from port numbers that were already in use. The base isn't configurable, but you can use higher ports by forcing a higher value for the display number. Commented Nov 14, 2024 at 21:31

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.