Mailing List Archive

X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key"
X-forwarding used to work for me but I haven't used it in a while and now I get:

Warning: untrusted X11 forwarding setup failed: xauth key data not generated
Warning: No xauth data; using fake authentication data for X11 forwarding.
Xlib: connection to "localhost:10.0" refused by server
Xlib: Invalid MIT-MAGIC-COOKIE-1 key
Cannot open display:

I have:

# cat /etc/ssh/sshd_config | grep X11Forwarding
X11Forwarding yes

Does anyone know how to fix this?

- Grant
Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
On Fri, Apr 24, 2009 at 11:01 AM, Grant <emailgrant@gmail.com> wrote:

> X-forwarding used to work for me but I haven't used it in a while and now I
> get:
>
> Warning: untrusted X11 forwarding setup failed: xauth key data not
> generated
> Warning: No xauth data; using fake authentication data for X11 forwarding.
> Xlib: connection to "localhost:10.0" refused by server
> Xlib: Invalid MIT-MAGIC-COOKIE-1 key
> Cannot open display:
>

Ah, I had this problem for months; it was driving me crazy!

I don't remember the specifics, but it had to to with some wankery of glibc
not working properly with xauth. I'm pretty sure the fix is to update to
>=sys-libs/glibc-2.9_p20081201-r2 or regress glibc back a few ticks.

Regards,
Wyatt
Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
>> X-forwarding used to work for me but I haven't used it in a while and now
>> I get:
>>
>> Warning: untrusted X11 forwarding setup failed: xauth key data not
>> generated
>> Warning: No xauth data; using fake authentication data for X11 forwarding.
>> Xlib: connection to "localhost:10.0" refused by server
>> Xlib: Invalid MIT-MAGIC-COOKIE-1 key
>> Cannot open display:
>
> Ah, I had this problem for months; it was driving me crazy!
>
> I don't remember the specifics, but it had to to with some wankery of glibc
> not working properly with xauth.  I'm pretty sure the fix is to update to
>>=sys-libs/glibc-2.9_p20081201-r2 or regress glibc back a few ticks.
>
> Regards,
> Wyatt

Thanks Wyatt. I upgraded the server and client to the latest glibc in
portage with the same result. When I tried to downgrade glibc, I got:

* Sanity check to keep you from breaking your system:
* Downgrading glibc is not supported and a sure way to destruction

- Grant
Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
On Fri, 24 Apr 2009 08:01:59 -0700
Grant <emailgrant@gmail.com> wrote:

> X-forwarding used to work for me but I haven't used it in a while and now I get:
>
> Warning: untrusted X11 forwarding setup failed: xauth key data not generated
> Warning: No xauth data; using fake authentication data for X11 forwarding.
> Xlib: connection to "localhost:10.0" refused by server
> Xlib: Invalid MIT-MAGIC-COOKIE-1 key
> Cannot open display:
>
> I have:
>
> # cat /etc/ssh/sshd_config | grep X11Forwarding
> X11Forwarding yes
>
> Does anyone know how to fix this?

I remember fixing similar problem with "xhost +localhost" line.
Don't really remember why it helped, since I lack basic knowledge of X
authentication mechanisms.

--
Mike Kazantsev // fraggod.net
Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
On Saturday 25 April 2009 19:25:26 Grant wrote:
> >> X-forwarding used to work for me but I haven't used it in a while and
> >> now I get:
> >>
> >> Warning: untrusted X11 forwarding setup failed: xauth key data not
> >> generated
> >> Warning: No xauth data; using fake authentication data for X11
> >> forwarding. Xlib: connection to "localhost:10.0" refused by server
> >> Xlib: Invalid MIT-MAGIC-COOKIE-1 key
> >> Cannot open display:
> >
> > Ah, I had this problem for months; it was driving me crazy!
> >
> > I don't remember the specifics, but it had to to with some wankery of
> > glibc not working properly with xauth. I'm pretty sure the fix is to
> > update to
> >
> >>=sys-libs/glibc-2.9_p20081201-r2 or regress glibc back a few ticks.
> >
> > Regards,
> > Wyatt
>
> Thanks Wyatt. I upgraded the server and client to the latest glibc in
> portage with the same result. When I tried to downgrade glibc, I got:
>
> * Sanity check to keep you from breaking your system:
> * Downgrading glibc is not supported and a sure way to destruction

And there's a very good reason for that message - I'm sure you can figure it
out. However, some downgrades are safe. You should be able to get away with
downgrading to any lower version in the same minor release - 2.9 in your case.

Tip: quickpkg glibc, portage, python, gcc and other vital stuff befoore you
try this stunt:

Edit the desired build, and look for this in pkg_setup():

if has_version '>'${CATEGORY}/${PF} ; then
eerror "Sanity check to keep you from breaking your system:"
eerror " Downgrading glibc is not supported and a sure way to
destruction"
die "aborting to save your system"
fi

Comment out the die call, re-digest, re-emerge.

The very very latest ebuild has it in files/eblits/pkg_setup.eblit instead,
but you won't be using that for a downgrade.

--
alan dot mckinnon at gmail dot com
Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
Grant wrote:
> X-forwarding used to work for me but I haven't used it in a while and now I get:
>
> Warning: untrusted X11 forwarding setup failed: xauth key data not generated
> Warning: No xauth data; using fake authentication data for X11 forwarding.
> Xlib: connection to "localhost:10.0" refused by server
> Xlib: Invalid MIT-MAGIC-COOKIE-1 key
> Cannot open display:
>
> I have:
>
> # cat /etc/ssh/sshd_config | grep X11Forwarding
> X11Forwarding yes
>
> Does anyone know how to fix this?

Before using ssh (i.e. telnet, rsh and the likes) one had to manually
copy the mmc using: "xauth extract - $DISPLAY | rsh otherhost xauth
merge -" or something similar (i.e. the Xforwarding mechanism relies on
that the display that you want use have an identical mmc in the user
directory on the remote machine). The message "Warning: No xauth
data..." seems to indicate it's not creating a .Xauthority (=mmc) file
or an invalid one.

Further reading:
http://x2x.dottedmag.net/wiki/MIT-MAGIC-COOKIE-1

Hope this helps...

Best regards

Peter K
Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
Grant wrote:
> X-forwarding used to work for me but I haven't used it in a while and now I get:
>
> Warning: untrusted X11 forwarding setup failed: xauth key data not generated
> Warning: No xauth data; using fake authentication data for X11 forwarding.
> Xlib: connection to "localhost:10.0" refused by server
> Xlib: Invalid MIT-MAGIC-COOKIE-1 key
> Cannot open display:
>
> I have:
>
> # cat /etc/ssh/sshd_config | grep X11Forwarding
> X11Forwarding yes
>
> Does anyone know how to fix this?

First, ssh to the box without X forwarding and:

rm ~/.Xauthority
rm ~/.ICEauthority
logout

Then try to ssh again with X forwarding enabled. It should work.
Re: Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
>> X-forwarding used to work for me but I haven't used it in a while and now
>> I get:
>>
>> Warning: untrusted X11 forwarding setup failed: xauth key data not
>> generated
>> Warning: No xauth data; using fake authentication data for X11 forwarding.
>> Xlib: connection to "localhost:10.0" refused by server
>> Xlib: Invalid MIT-MAGIC-COOKIE-1 key
>> Cannot open display:
>>
>> I have:
>>
>> # cat /etc/ssh/sshd_config | grep X11Forwarding
>> X11Forwarding yes
>>
>> Does anyone know how to fix this?
>
> First, ssh to the box without X forwarding and:
>
>  rm ~/.Xauthority
>  rm ~/.ICEauthority
>  logout
>
> Then try to ssh again with X forwarding enabled.  It should work.

Unfortunately I still get the same error. I'll try to put together an
xauth command, but does anyone know what happened here? Usually you
just enable X11Forwarding and you can use it right?

- Grant
Re: Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
2009/4/30 Grant <emailgrant@gmail.com>

> >> X-forwarding used to work for me but I haven't used it in a while and
> now
> >> I get:
> >>
> >> Warning: untrusted X11 forwarding setup failed: xauth key data not
> >> generated
> >> Warning: No xauth data; using fake authentication data for X11
> forwarding.
> >> Xlib: connection to "localhost:10.0" refused by server
> >> Xlib: Invalid MIT-MAGIC-COOKIE-1 key
> >> Cannot open display:
> >>
> >> I have:
> >>
> >> # cat /etc/ssh/sshd_config | grep X11Forwarding
> >> X11Forwarding yes
> >>
> >> Does anyone know how to fix this?
> >
> > First, ssh to the box without X forwarding and:
> >
> > rm ~/.Xauthority
> > rm ~/.ICEauthority
> > logout
> >
> > Then try to ssh again with X forwarding enabled. It should work.
>
> Unfortunately I still get the same error. I'll try to put together an
> xauth command, but does anyone know what happened here? Usually you
> just enable X11Forwarding and you can use it right?
>
> - Grant
>
>
You also need ForwardX11 yes in your client configuration. Try ssh -v to get
more output.
Re: Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
In your /etc/ssh/ssh_config (not sshd_config), make sure you have:

ForwardAgent yes
ForwardX11 yes

I used to get the same error, and after I enabled these options, it
worked like it should. I also do ssh -Y user@machine - but that may
be redundant, I'm not sure.

Denis
Re: Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
On 30 Apr 2009, at 16:59, Grant wrote:

>>> X-forwarding used to work for me but I haven't used it in a while
>>> and now
>>> I get:
>>>
>>> Warning: untrusted X11 forwarding setup failed: xauth key data not
>>> generated
>>> Warning: No xauth data; using fake authentication data for X11
>>> forwarding.
>>> Xlib: connection to "localhost:10.0" refused by server
>>> Xlib: Invalid MIT-MAGIC-COOKIE-1 key
>>> Cannot open display:
>>>
>>> ...
>
> Unfortunately I still get the same error. I'll try to put together an
> xauth command, but does anyone know what happened here? Usually you
> just enable X11Forwarding and you can use it right?

Hi,

I seem to have missed a couple of posts in this thread.

Have you got xauth installed? When I set up a new machine recently
there was a missing dependency - I _think_ it was xauth. I installed a
base system + knode + mozilla. I never installed X11 explicitly, as I
never log into this machine locally, only use a couple of X11 apps
remotely (because those aren't available on my Mac). I'm not sure if
X11 itself was installed or only some X11~ish libraries, but there was
definitely a dependency missing as a result of the way I installed.
Unfortunately I didn't file a bug.

Secondly, when you ssh in, you need to use `ssh -Y hostname` in order
to enable ssh forwarding.

Hope these observations are not unhelpful,

Stroller.
Re: Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
>>>> X-forwarding used to work for me but I haven't used it in a while and
>>>> now
>>>> I get:
>>>>
>>>> Warning: untrusted X11 forwarding setup failed: xauth key data not
>>>> generated
>>>> Warning: No xauth data; using fake authentication data for X11
>>>> forwarding.
>>>> Xlib: connection to "localhost:10.0" refused by server
>>>> Xlib: Invalid MIT-MAGIC-COOKIE-1 key
>>>> Cannot open display:
>>>>
>>>> ...
>>
>> Unfortunately I still get the same error.  I'll try to put together an
>> xauth command, but does anyone know what happened here?  Usually you
>> just enable X11Forwarding and you can use it right?
>
> Hi,
>
> I seem to have missed a couple of posts in this thread.
>
> Have you got xauth installed? When I set up a new machine recently there was
> a missing dependency - I _think_ it was xauth. I installed a base system +
> knode + mozilla. I never installed X11 explicitly, as I never log into this
> machine locally, only use a couple of X11 apps remotely (because those
> aren't available on my Mac). I'm not sure if X11 itself was installed or
> only some X11~ish libraries, but there was definitely a  dependency missing
> as a result of the way I installed. Unfortunately I didn't file a bug.
>
> Secondly, when you ssh in, you need to use `ssh -Y hostname` in order to
> enable ssh forwarding.
>
> Hope these observations are not unhelpful,
>
> Stroller.

Thanks everyone, but I still get the same error. On the client I
added to /etc/ssh/ssh_config:

Host *
ForwardAgent yes
ForwardX11 yes

and I deleted ~/.Xauthority and ~/.ICEauthority. On the server I
added to /etc/ssh/sshd_config:

X11Forwarding yes

and restarted sshd. I get:

$ ssh -Y 192.168.10.1
The authenticity of host '192.168.10.1 (192.168.10.1)' can't be established.
RSA key fingerprint is.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts
(/home/grant/.ssh/known_hosts).
Password:
Warning: No xauth data; using fake authentication data for X11 forwarding.
Last login: Fri May 1 07:10:12 PDT 2009 from 192.168.10.2 on ssh
$ gimp
Xlib: connection to "localhost:10.0" refused by server
Xlib: Invalid MIT-MAGIC-COOKIE-1 key
Cannot open display:

Should I reboot?

- Grant
Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
On Friday 01 May 2009, Grant wrote:
> $ ssh -Y 192.168.10.1
> The authenticity of host '192.168.10.1 (192.168.10.1)' can't be
> established. RSA key fingerprint is.
> Are you sure you want to continue connecting (yes/no)? yes
> Failed to add the host to the list of known hosts
> (/home/grant/.ssh/known_hosts).

I think the problem is here: too strict permissions in ~/.ssh preventing
ssh to update known_hosts list, needed to continue connection. it
should be 700 for the .ssh directory and 600 for the file known_hosts.

What is the output of: ls -l .ssh -d ? And ls -l .ssh ?
Is 192.168.10.1 in your known_hosts?
With the right RSA key?

Ciao
Francesco


--
Linux Version 2.6.29-gentoo-r2, Compiled #7 SMP PREEMPT Thu Apr 30
19:25:11 CEST 2009
Two 1GHz AMD Athlon 64 Processors, 4GB RAM, 4018.40 Bogomips Total
aemaeth
Re: Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
>> $ ssh -Y 192.168.10.1
>> The authenticity of host '192.168.10.1 (192.168.10.1)' can't be
>> established. RSA key fingerprint is.
>> Are you sure you want to continue connecting (yes/no)? yes
>> Failed to add the host to the list of known hosts
>> (/home/grant/.ssh/known_hosts).
>
> I think the problem is here: too strict permissions in ~/.ssh preventing
> ssh to update known_hosts list, needed to continue connection. it
> should be 700 for the .ssh directory and 600 for the file known_hosts.
>
> What is the output of: ls -l .ssh -d ? And ls -l .ssh ?
> Is 192.168.10.1 in your known_hosts?
> With the right RSA key?
>
> Ciao
>        Francesco

Thanks again everyone, it's working after a reboot. X has been
strange since the xorg-1.5 upgrade. I noticed that ssh -X fails with
the same error message I've been getting, but ssh -Y succeeds. man
ssh says:

-Y Enables trusted X11 forwarding. Trusted X11 forwardings are not
subjected to the X11 SECURITY extension controls.

Security extension controls sounds like a good thing. Does anyone
know why -X isn't working?

- Grant
Re: Re: X-forwarding fails with "Invalid MIT-MAGIC-COOKIE-1 key" [ In reply to ]
>>> $ ssh -Y 192.168.10.1
>>> The authenticity of host '192.168.10.1 (192.168.10.1)' can't be
>>> established. RSA key fingerprint is.
>>> Are you sure you want to continue connecting (yes/no)? yes
>>> Failed to add the host to the list of known hosts
>>> (/home/grant/.ssh/known_hosts).
>>
>> I think the problem is here: too strict permissions in ~/.ssh preventing
>> ssh to update known_hosts list, needed to continue connection. it
>> should be 700 for the .ssh directory and 600 for the file known_hosts.
>>
>> What is the output of: ls -l .ssh -d ? And ls -l .ssh ?
>> Is 192.168.10.1 in your known_hosts?
>> With the right RSA key?
>>
>> Ciao
>>        Francesco
>
> Thanks again everyone, it's working after a reboot.  X has been
> strange since the xorg-1.5 upgrade.  I noticed that ssh -X fails with
> the same error message I've been getting, but ssh -Y succeeds.  man
> ssh says:
>
> -Y   Enables trusted X11 forwarding.  Trusted X11 forwardings are not
> subjected to the X11 SECURITY extension controls.
>
> Security extension controls sounds like a good thing.  Does anyone
> know why -X isn't working?
>
> - Grant

I should also add that the following doesn't seem to be necessary on the client:

/etc/ssh/ssh_config:
Host *
ForwardAgent yes
ForwardX11 yes

- Grant