43

I just upgraded to MacOS Sierra, and I realized that I can't seem to run the "ssh -X" command in the Terminal anymore. It used to launch xterm windows, but now it's like I didn't even put the -X option anymore. It was working absolutely fine right before I updated. Other than going from OS X Yosemite to MacOS Sierra, I didn't change anything else in the setup.

EDIT:

As suggested, this is what I found in the debug logs that might be causing this problem.

debug1: No xauth program.
Warning: untrusted X11 forwarding setup failed: xauth key data not generated
5
  • Did you upgrade the client or the server?
    – arkascha
    Commented Sep 21, 2016 at 16:46
  • 1
    @arkascha sorry, lemme clarify. I'm running MacOS Sierra (client) trying to ssh into an Ubuntu Server.
    – Dodie
    Commented Sep 21, 2016 at 17:10
  • 1
    Are you actually running an X server on your mac? In your mac shell, what is the DISPLAY environment set to? Could you run ssh with the "-vv" option and edit your question to include the debugging output?
    – Kenster
    Commented Sep 21, 2016 at 17:26
  • @Kenster I found one reference to X11 that might be the problem. Any thoughts on what could have happened? Or should I just wait for an update from XQuartz or something?
    – Dodie
    Commented Sep 21, 2016 at 18:03
  • I've solved my problem by reinstalling XQuartz on High Sierra. Commented Apr 14, 2018 at 19:13

11 Answers 11

65

I didn't need to reinstall XQuartz, but, based on Matt Widjaja's answer, I came up with a refinement.

  • sudo vi /etc/ssh/ssh_config (This is ssh client config, not sshd_config)
    • Under the Host * entry add (or add where appropriate per-host)
      • XAuthLocation /usr/X11/bin/xauth (The location of xauth changed in Sierra)
      • ServerAliveInterval 60 (Pings the server every 60 seconds to keep your ssh connection alive)
      • ForwardX11Timeout 596h (Allows untrusted X11 connections beyond the 20 minute default)

No need to restart ssh, except, of course, existing ssh client connections.

It sounds like -Y (trusted X11) would be preferable to untrusted. If you switch over to trusted, the ForwardX11Timeout line can probably be removed.

The ServerAliveInterval line is also an optional preference.

It may also be possible to make these changes in ~/.ssh/config (the user's config file) but the permissions have to be correct.

EDIT: I removed ForwardX11 and ForwardX11Trusted. They aren't needed and ForwardX11 is less secure and causes problems for git (or other tools using ssh).

6
  • I have been using ssh -Y for years now. However there does still seem to be a new problem with Sierra: If the remote window is using OpenGL, then it fails in various ways depending on the X-server. XQuartz seems to just give up, whereas someone else reports that xorg doesn't crash but also doesn't re-paint damaged windows.
    – bodgesoc
    Commented Nov 22, 2016 at 22:56
  • On 10.12 I had to use this: sudo /etc/ssh/ssh_config and I added these lines: Host * XAuthLocation /opt/X11/bin/xauth ServerAliveInterval 60 ForwardX11Timeout 596h
    – dajobe
    Commented May 27, 2017 at 21:11
  • 1
    It is possible to just stick this in $HOME/.ssh/config on a per-user basis.Thanks for finding the setting. Commented Apr 25, 2018 at 21:04
  • I think it makes sense to put the XAuthLocation for all. Maybe the other settings can be per-user, but I haven't tried it.
    – Christian
    Commented Apr 27, 2018 at 13:48
  • Just came here to comment that 3+ years later, this solution is still necessary and valid on Mojave. X knowledge is slowly becoming more arcane!
    – user3909192
    Commented Dec 14, 2019 at 22:56
31

I noticed macOS Sierra resetted my X11 settings so that it disabled my xAuth program. To re-enable xAuth on macOS Sierra:

  1. Reinstall X11/xQuartz to presumably reset any changes macOS Sierra made. I made the following changes below too although it sounds like this might be enough.
  2. Load up a Terminal
  3. sudo <text editor of your choice> /etc/ssh/sshd_config
  4. In that file, uncomment the following lines, and set it to these values:
    • X11Forwarding yes
    • X11DisplayOffset 10
    • [Update on 10/07/2017] When you reinstall X11/XQuartz, above all else, it should add an: XAuthLocation <path_to_your_xauth> where mine was in /opt/X11/bin/xauth. This was probably the golden step that explained why reinstalling worked.
  5. Restart ssh via the terminal. I did this by running:
    • sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
    • sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
6
  • I tried doing this but it didn't change anything for me. Any thoughts on what might be different with my machine?
    – Dodie
    Commented Sep 26, 2016 at 15:17
  • Did you try reinstalling whatever xAuth tool your Mac's using (my guess would be X11) as well? I did that too. I was skeptical if that's all it takes, so that's why I didn't mention it, but I guess that's the other thing I tried. Commented Sep 27, 2016 at 15:33
  • 3
    Reinstalling XQuartz finally made it work! Didn't occur to me to try that because I was waiting for a new version of XQuartz. Thanks!
    – Dodie
    Commented Sep 29, 2016 at 10:15
  • 3
    I think Matt's observation of the XAuthLocation being required is the key. I had only X11Forwarding yes turned on (the display offset defaults to 10, so I left that unset), and X still didn't work, but once I set XAuthLocation, I am now able to use X11 on my mini. @MattWidjaja you get extra bonus points for including the instructions to reset sshd on OSX -- thanks!!! Commented Nov 23, 2017 at 15:15
  • 3
    /System/Library/LaunchDaemons/ssh.plist: Could not find specified service
    – holms
    Commented Nov 30, 2017 at 20:40
13

I'm having the same issues with X11 forwarding with the -X option after upgrading to Mac OS X Sierra.

Have a look at the ssh option -Y (trusted X11 forwarding). While using ssh -Y <host> things work for me.

2
  • When I try -Y I still get this error: Warning: No xauth data; using fake authentication data for X11 forwarding.
    – Dodie
    Commented Sep 24, 2016 at 11:44
  • 1
    ssh -Y fixed it for me (after upgrading to High Sierra), I get the warning that @Dodie writes but it still worked.
    – BjornW
    Commented Sep 15, 2018 at 15:12
10

It's an old question but I recently ran into the same issue on my Mac running 10.12.6. The DISPLAY variable is not set in the terminal and ssh -X doesn't work. This is what I did that solved the problem:

  1. Reinstall XQuartz using Homebrew: brew cask install xquartz (the option --forced may be necessary)

  2. Add the XQuartz launcher to the system default (following the solution in this Reddit post: launchctl load -w /Library/LaunchAgents/org.macosforge.xquartz.startx.plist

  3. Restart the system.

After doing these, my DISPLAY variable is set properly:

$ echo $DISPLAY /private/tmp/com.apple.launchd.mfXFpzZ0gC/org.macosforge.xquartz:0

And X11 forwarding in ssh works as well.

1
  • 4
    brew install --cask xquartz
    – Maziyar
    Commented Feb 9, 2021 at 9:01
5

Just adding the one line XAuthLocation /usr/X11/bin/xauth to /etc/ssh/ssh_config works on my Mac, running MacOS Sierra, to ssh into a Linux host and be able to run X Windows programs remotely and have them display under XQuartz on my Mac.

1
  • Naturally you need to restart existing ssh connections. I got stuck for a while that connections with ControlPersist needed to shut down completely before this setting took effect — it evidently applies only to master connections, not slave connections.
    – James
    Commented May 26, 2018 at 13:21
5

My solution to this was the following.

(1) Launch xquartz before trying the ssh -X. In the xquartz options, I just enabled 'Open at login', and then it is always running in the background.

(2) Go to the xquartz Preferences menu, and on the Security window, click the box that says "Allow connections from clients".

After doing these things, everything works fine.

3

Just upgraded my macbook from El Capitan to Sierra. Simply reinstalling Xquartz has done the trick for me, using ssh -X [linux server]

1
  • This is the thing to try first. Worked for me. Commented Apr 22, 2017 at 1:12
1

I spent the whole day looking for solution only to realize that the recent Sierra does not ship with XQuartz installed https://support.apple.com/en-gb/HT201341. Upon install (https://www.xquartz.org/) all works.

1

If Quartz is installed, all that is needed is to add the line "X11Trusted yes" under "Host *" in the /etc/ssh/ssh_config file.

0

restarting XQuartz worked for me.

0

In my case, adding XAuthLocation /opt/X11/bin/xauth to /etc/ssh/sshd_config (note that it's not /etc/ssh/ssh_config) on macOS host worked after installing XQaurtz via brew install --cask xquartz as XQaurtz provide xauth binary

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.