This document was stolen and modified from the UIC Academic and Computing Communications Center. The original url at the time of the theft was http://www.uic.edu/depts/accc/software/exceed
This document explains how to set up the Hummingbird Exceed X Server and SSH Secure Shell on your Windows personal computer and how to use them to display X-Windows output -- securely -- from enigma, or arwen, or from any other Unix machine that supports SSH X11 tunneling (and for which you have ssh privileges.
Using X Windows with SSH and X11 tunneling is both secure and easy -- it's by far the best way to do X Windows.
SSH X11 tunneling is by far the best way to do X Windows.
SSH is also the best way to do telnet and file transfer too -- SSH client software takes the place of telnet and generally comes with a secure file transfer utility.
A noncommercial version of ssh is available for download.
Need some instructions on how to use it here. In the meantime, mouse around after installing or (gasp!) click on the ssh help button after installing. There are other ssh client's available some free, some not, but the above is the one this author likes.
The SSH FAQ: http://www.employees.org/~satch/ssh/faq/ssh-faq.html
Exceed is an X Server program that you run on your Microsoft Windows personal computer. It provides the graphical features of an X Server for use with remote Unix machines. Generally speaking, there are two classes of Unix programs that benefit from X Windows display: number crunchers or graphics programs such as Matlab, ProMAX, and utility programs such as ghostview (a PostScript document viewer),
Exceed is part of the Hummingbird Communications package, which includes various other communications tools, such as whois, finger, nslookup, traceroute, telnet (bad!), ftp (bad!), and lpr, and with tar compression and archiving.
Exceed is available at CERI for use on University owned PC's. See the computer staff for the CD. It is already installed on CERI public machines.
About Client/Server Software and X Windows
This section is a brief description client/server software as it applies to X Windows. If you don't want to know about it and are not confused about the idea of running an X Server on your personal computer, you might want to skip it, and go down to the how-to sections.
X Windows is client/server software, where the "client software" goes to a "server" to request services from it.
In normal client/server software, the software you run on your personal computer -- your "local host" -- is the client software and the software on the other machine -- the "remote host" -- is the server. That's the case, say, for electronic mail. The Entourage or Outlook or Mozilla that you use on your personal computer is your email client, and it talks to the POP or IMAP server on the remote machine that your email account is on -- ummail for example -- which serves your email.
In normal client server software the security question -- making sure that only you can access your own email, to continue our example -- is taken care of on the server side. You start your client, tell it which remote server to use and what your login id and password for that service is. Then your client contacts the server and gives it your id and password, which the server either accepts or rejects.
But in X Windows, client/server works the other way around -- you run an X Server, such as Exceed, on your local machine, and client processes running on the remote machine use your X Server to display their output on your local machine. Thus, when you use Exceed, the server is on your personal computer -- the local host -- and the clients are on the remote host -- enigma, arwen, or whatever other Unix workstations you access to.
While this local server vs. remote client idea actually makes some sense for X Windows, it vastly complicates the client/server security question for X Windows -- how to determine which client processes on which remote machines should be allowed to display their output using your X Server on your personal computer.
The obvious answer to the "which processes should be allowed write output to my personal computer" question is only those client process that you start using your own Unix account(s). That is, unfortunately, rather hard to do. So people often set their X Servers up by defining "trusted hosts" using Xhost security, which is easier (but still somewhat hard), and which gives any account an a specific Unix host permission to open up an X-Windows window on your personal computer. If that doesn't scare you, think again. It ought to.
Thus, if you tell Exceed that enigma is a trusted host, as described in [link censored by CERI security fanatics] Using Exceed X Server with Xhost Security, then anyone logged into enigma will be able to open an X-Windows window on your personal computer, read all the windows managed by your X Server, including those where you typed passwords, regardless of whether you can read the password on your screen, or change the X Server settings that are read by other clients. This really should scare you.
And as insecure as Xhost "security" is, even that level of security is reasonably hard to set up, because your local machine has to know about each remote host you're going to be using X Windows with, and because each remote host has to know which personal computer your X Server is on. (The latter makes it hard to use X Windows from different machines -- say the one in your office or dorm room and one in a public lab -- you have to change settings on your Unix account each time you change local machines.)
SSH with X11 tunneling, on the other hand, is both easy to set up and secure, because it puts the client software back on your personal computer. You can use it on any personal computer to run X Windows from any remote Unix host that you have an account on and that supports SSH X11 tunneling, without changing any settings on the X Server or on the remote host.
When using SSH's X11 tunneling, you set your X Server up with Xhost security, but you tell it that the only host it should trust is the localhost -- your own personal computer. Then you use SSH in place of telnet to login to your account on the remote host. As part of the login process, your SSH client software talks to the SSH server on the remote host, and together, they automatically set up the X-Windows connection between your account on the remote host and your X Server.
Install and Configure Exceed on your PC Step 1: Install Exceed and SSH on your PC (do once)
Use the program installation media to install Exceed on your PC, and download and install SSH according to the instructions in SSH - A Secure Replacement for Telnet, including setting up SSH X11 tunneling.
Setting up tunneling will be dependent on your flavor of ssh but could
be something like this:
Step 2: Configure Exceed for Passive mode and Multiple Windows (do once)
Exceed's passive mode allows you to start the X Server on your personal computer without it making any initial attempt to connect to a specific remote host.
Set Exceed up to use Passive mode (Security) and Multiple Windows Mode (Screen Definition). Both of these settings are Exceed defaults, but it pays to check it out if you've used Exceed before.
The Passive Mode (3), and Multiple Window Mode (4) settings are necessary to minimize the amount of network traffic being sent along the SSH tunnel.
Step 3: Configure Localhost Security (do once; works for all Unix machines that support SSH X11 tunneling)When using SSH X11 tunneling, the only "host" that Exceed will ever talk to is your own personal computer, a.k.a. the localhost. Thus, regardless of which or how many Unix machines or accounts you're going to use Exceed with, you only have to tell Exceed to answer to one machine -- your local host. Here's how.
That completes the steps needed to install and configure Exceed to use SSH X11 tunneling. Step 4: Unconfigure your Unix Account (do once per Unix account, if you've used X Windows before on that account)
If you've ever used X Windows before with one or more of your Unix accounts, then you've probably set your account(s) up to talk to your X Server. You have to remove these settings before you can use it with SSH X11 tunneling.
In the above, the somemachine.ceri.memphis.edu is used as an example; yours will be something else.
Use X Windows with SSH X11 TunnelingAfter that, an X-Windows window will automatically open whenever you start an X-Windows program on any remote Unix host that supports SSH and X11 tunneling, which includes the ACCC's tigger, icarus, and argo Unix servers.
A good X-Windows program to test with when you first set Exceed up is xclock.
On your Unix account, enter: xclock &
and a small X-Windows window containing a clock will open on your PC's
screen. (It might open minimized; if you don't see it right away, check your
taskbar.)