Using Exceed X Server with SSH X11 Tunneling

This document was stolen and modified from the UIC Academic and Computing Communications Center. The original url at the time of the theft was http://www.uic.edu/depts/accc/software/exceed

This document explains how to set up the Hummingbird Exceed X Server and SSH Secure Shell on your Windows personal computer and how to use them to display X-Windows output -- securely -- from enigma, or arwen, or from any other Unix machine that supports SSH X11 tunneling (and for which you have ssh privileges.

Using X Windows with SSH and X11 tunneling is both secure and easy -- it's by far the best way to do X Windows.

About SSH

SSH X11 tunneling is by far the best way to do X Windows.

SSH is also the best way to do telnet and file transfer too -- SSH client software takes the place of telnet and generally comes with a secure file transfer utility.

A noncommercial version of ssh is available for download.

Need some instructions on how to use it here. In the meantime, mouse around after installing or (gasp!) click on the ssh help button after installing. There are other ssh client's available some free, some not, but the above is the one this author likes.

The SSH FAQ: http://www.employees.org/~satch/ssh/faq/ssh-faq.html

About Exceed

Exceed is an X Server program that you run on your Microsoft Windows personal computer. It provides the graphical features of an X Server for use with remote Unix machines. Generally speaking, there are two classes of Unix programs that benefit from X Windows display: number crunchers or graphics programs such as Matlab, ProMAX, and utility programs such as ghostview (a PostScript document viewer),

Exceed is part of the Hummingbird Communications package, which includes various other communications tools, such as whois, finger, nslookup, traceroute, telnet (bad!), ftp (bad!), and lpr, and with tar compression and archiving.

Exceed is available at CERI for use on University owned PC's. See the computer staff for the CD. It is already installed on CERI public machines.

About Client/Server Software and X Windows

This section is a brief description client/server software as it applies to X Windows. If you don't want to know about it and are not confused about the idea of running an X Server on your personal computer, you might want to skip it, and go down to the how-to sections.

X Windows is client/server software, where the "client software" goes to a "server" to request services from it.

In normal client/server software, the software you run on your personal computer -- your "local host" -- is the client software and the software on the other machine -- the "remote host" -- is the server. That's the case, say, for electronic mail. The Entourage or Outlook or Mozilla that you use on your personal computer is your email client, and it talks to the POP or IMAP server on the remote machine that your email account is on -- ummail for example -- which serves your email.

In normal client server software the security question -- making sure that only you can access your own email, to continue our example -- is taken care of on the server side. You start your client, tell it which remote server to use and what your login id and password for that service is. Then your client contacts the server and gives it your id and password, which the server either accepts or rejects.

But in X Windows, client/server works the other way around -- you run an X Server, such as Exceed, on your local machine, and client processes running on the remote machine use your X Server to display their output on your local machine. Thus, when you use Exceed, the server is on your personal computer -- the local host -- and the clients are on the remote host -- enigma, arwen, or whatever other Unix workstations you access to.

While this local server vs. remote client idea actually makes some sense for X Windows, it vastly complicates the client/server security question for X Windows -- how to determine which client processes on which remote machines should be allowed to display their output using your X Server on your personal computer.

The obvious answer to the "which processes should be allowed write output to my personal computer" question is only those client process that you start using your own Unix account(s). That is, unfortunately, rather hard to do. So people often set their X Servers up by defining "trusted hosts" using Xhost security, which is easier (but still somewhat hard), and which gives any account an a specific Unix host permission to open up an X-Windows window on your personal computer. If that doesn't scare you, think again. It ought to.

Thus, if you tell Exceed that enigma is a trusted host, as described in [link censored by CERI security fanatics] Using Exceed X Server with Xhost Security, then anyone logged into enigma will be able to open an X-Windows window on your personal computer, read all the windows managed by your X Server, including those where you typed passwords, regardless of whether you can read the password on your screen, or change the X Server settings that are read by other clients. This really should scare you.

And as insecure as Xhost "security" is, even that level of security is reasonably hard to set up, because your local machine has to know about each remote host you're going to be using X Windows with, and because each remote host has to know which personal computer your X Server is on. (The latter makes it hard to use X Windows from different machines -- say the one in your office or dorm room and one in a public lab -- you have to change settings on your Unix account each time you change local machines.)

SSH with X11 tunneling, on the other hand, is both easy to set up and secure, because it puts the client software back on your personal computer. You can use it on any personal computer to run X Windows from any remote Unix host that you have an account on and that supports SSH X11 tunneling, without changing any settings on the X Server or on the remote host.

When using SSH's X11 tunneling, you set your X Server up with Xhost security, but you tell it that the only host it should trust is the localhost -- your own personal computer. Then you use SSH in place of telnet to login to your account on the remote host. As part of the login process, your SSH client software talks to the SSH server on the remote host, and together, they automatically set up the X-Windows connection between your account on the remote host and your X Server.

Install and Configure Exceed on your PC Step 1: Install Exceed and SSH on your PC (do once)

Use the program installation media to install Exceed on your PC, and download and install SSH according to the instructions in SSH - A Secure Replacement for Telnet, including setting up SSH X11 tunneling.

Setting up tunneling will be dependent on your flavor of ssh but could be something like this:

  1. Start ssh click on File->Profiles->Edit Profiles
  2. Select Tunneling Tab: then select Tunnel X11 connections
  3. Click ok

Step 2: Configure Exceed for Passive mode and Multiple Windows (do once)

Exceed's passive mode allows you to start the X Server on your personal computer without it making any initial attempt to connect to a specific remote host.

Set Exceed up to use Passive mode (Security) and Multiple Windows Mode (Screen Definition). Both of these settings are Exceed defaults, but it pays to check it out if you've used Exceed before.

  1. Click the Start button, then select Programs->Hummingbird->Exceed->Xconfig.
  2. A password dialog box will open, asking you to enter your Xconfig password, which you selected when you installed Exceed. Type it in the box provided and click OK.
  3. Set Passive Communications:
    1. Double-click the Communication icon in the Xconfig window to open the Communications dialog box.
    2. Select Passive from the Mode field's drop-down list.
    3. Click OK to return to the Xconfig window.
  4. Set Multiple Windows Screen Definition:
    1. Double-click the Screen Definition icon in the Xconfig window to open the Screen Definition dialog box.
    2. Click the radio button beside Multiple in the Window Mode box on the upper left.
    3. Click OK to return to the Xconfig window.

The Passive Mode (3), and Multiple Window Mode (4) settings are necessary to minimize the amount of network traffic being sent along the SSH tunnel.

Step 3: Configure Localhost Security (do once; works for all Unix machines that support SSH X11 tunneling)

When using SSH X11 tunneling, the only "host" that Exceed will ever talk to is your own personal computer, a.k.a. the localhost. Thus, regardless of which or how many Unix machines or accounts you're going to use Exceed with, you only have to tell Exceed to answer to one machine -- your local host. Here's how.

  1. Double-click the Security icon in the Xconfig window box. The Security dialog box appears.
  2. In the Host Access Control List section of the Security dialog box, click the radio button that is to the immediate left of the word File. (As a result, the name of the file -- xhost.txt -- will darken.)
  3. Click the Edit box to the right of the name xhost.txt. A NotePad editing session will be initiated, editing the xhost.txt file.
  4. Type: localhost
    on a new line in the file.
  5. If your xhost.txt file already has other specific Unix hosts listed, such as icarus, tigger, or an EECS machine, delete those lines.
  6. Save your changes by clicking File in the menu bar, then selecting Save.
  7. Leave NotePad by clicking File in the menu bar, then selecting Exit.
  8. The Security dialog box reappears.
  9. Click OK (on the right side of the Security dialog box) and you'll return to the Xconfig window.
  10. Select File from the Xconfig menu bar; highlight and click Exit.

That completes the steps needed to install and configure Exceed to use SSH X11 tunneling. Step 4: Unconfigure your Unix Account (do once per Unix account, if you've used X Windows before on that account)

If you've ever used X Windows before with one or more of your Unix accounts, then you've probably set your account(s) up to talk to your X Server. You have to remove these settings before you can use it with SSH X11 tunneling.

For Korn/Bourne shell users, check your .profile file, and remove any lines that look like this:
export DISPLAY=somemachine.ceri.memphis.edu:0
For C shell users, check your .cshrc file, and remove any lines that look like this:
setenv DISPLAY somemachine.ceri.memphis.edu:0

In the above, the somemachine.ceri.memphis.edu is used as an example; yours will be something else.

Use X Windows with SSH X11 Tunneling
  1. Start the X Server on your PC -- Exceed, that is -- either each time you reboot your PC or whenever you want to use X Windows:
    1. Click the Start button,
    2. Then select Programs->Hummingbird->Exceed->Exceed
      (Not Exceed (XDMCP-Broadcast).)
    An Exceed button will appear on your taskbar; the icon looks like the letter X with a top hat and cane.
  2. Start SSH with SSH tunneling enabled and login to your Unix account.
    1. Click the Start button,
    2. Then select Programs->SSH Secure Shell->Secure Shell Client
    3. Login.

After that, an X-Windows window will automatically open whenever you start an X-Windows program on any remote Unix host that supports SSH and X11 tunneling, which includes the ACCC's tigger, icarus, and argo Unix servers.

A good X-Windows program to test with when you first set Exceed up is xclock.
On your Unix account, enter: xclock &
and a small X-Windows window containing a clock will open on your PC's screen. (It might open minimized; if you don't see it right away, check your taskbar.)