As part of my work on Xen I've been playing with
Xephyr (a replacement for Xnest). My plan is to use Xen instances for running different versions of desktop environments. You can't just
ssh -X to a Xen image and run things. One problem is that some programs such as Firefox do strange things to try and ensure that you only have one instance running. Another problem is with security, the X11 security extensions don't seem to do much good. A quick test indicates that a
ssh -X session can't copy the window contents of a
ssh -Y session, but can copy the contents of all windows run in the KDE environment. So this extension to X (and the matching ssh support) seem to do little good.
One thing I want to do is to have a Xen image for running Firefox with risky extenstions such as Flash and keep it separate from my main desktop for security and managability.
Xephyr :1 -auth ~/.Xauth-Xephyr -reset -terminate -screen 1280x1024
My plan is to use a command such as the above to run the virtual screen. That means to have a screen resolution of 1280x1024, to terminate the X server when the last client exits (both the
-reset and the
-terminate options are required for this), to be display :1 and listen with TCP (the default), and to use an authority file named
~/.Xauth-Xephyr.
xauth generate :1 .The first problem is how to generate the auth file, the
xauth utility is documented as doing it via the above command. But this really connects to a running X server and copies the auth data from it.
The solution (as pointed out to me by Dr. Brian May) is to be found in the
startx script which solves this problem. The way to do it is to use the
add :1 . $COOKIE command in
xauth to create the auth file used by the X server, and to generate the cookie with the
mcookie program.
In ~/.ssh/config:Host server
SendEnv DISPLAY
In /etc/ssh/sshd_config:AcceptEnv DISPLAY
The next requirement is to tell the remote machine (which incidentally doesn't need to be a Xen virtual machine, it can be any untrusted host that contains X applications you want to run) which display to use. The first thing to do is to ssh to the machine in question and run the xauth program to add the same cookie as is used for the X server. Then the
DISPLAY environment variable can be sent across the link by setting the
~/.ssh/config file at the client end to have the above settings (where
server is the name of the host we will connect to via SSH) and in the
sshd_config file on the server have the line
AcceptEnv DISPLAY to accept the DISPLAY environment variable. It would have been a little easier to configure if I had added the auth entry to the main
~/.Xauthority file and used the command
DISPLAY=:1 ssh -X server, this would be the desired configuration when operating over an untrusted network. But when talking to a local Xen instance it gives better performance to not encrypt the X data.
The following script will generate an xauth entry, run a 1280x1024 resolution Xephyr session, and connect to the root account on machine
server and run the twm window manager. Xephyr will exit when all X applications end. Note that you probably want to use passwordless authentication on the server as typing a password twice to start the session would be a drag.
#!/bin/shCOOKIE= mcookie FILE=~/.Xauth-Xephyrrm -f $FILE#echo "add 10.1.0.1:1 . $COOKIE" xauthssh root@server "echo \"add 10.1.0.1:1 . $COOKIE\" xauth"echo "add :1 . $COOKIE" xauth -f $FILEXephyr :1 -auth $FILE -reset -terminate -screen 1280x1024 $* &DISPLAY=10.1.0.1:1 ssh root@server twmwait