Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sharing an X11 Server Across Hosts with FamilyWild

dobrowolski.dev

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Sharing an X11 Server Across Hosts with FamilyWild

#11

Post by wahern »

maxwell_smart wrote: post #10
bobmcnamara wrote: post #9

Earlier quoted context omitted.

X11TCP is blazing fast compared to X11SSH

SSH can't send out a packet for every keystroke as soon as it gets it-- otherwise it's susceptible to timing attacks based on minute variations in speed of hitting different combinations of letters on the keyboard.

If I understand the code correctly, OpenSSH only injects delays and chaff when you're actively typing data through an interactive session directly to the ssh client itself (i.e. it's reading your key strokes from the TTY, as opposed to keystrokes being sent as opaque data over the X11 channel). There would be no disruption to X11 forwarding while you're not actively typing, and even then there's no delay if it can bundle key presses with non-interactive data. See https://github.com/openssh/openssh-portable/blob/088ca00/cli...

For a full desktop session, X11 over TCP should be much faster just because each X11 client app has it's own TCP connection, whereas for SSH X11 forwarding every app is tunneled over a single TCP connection.

Re: Sharing an X11 Server Across Hosts with FamilyWild

#12

Post by jolmg »

wahern wrote: post #11
maxwell_smart wrote: post #10

Earlier quoted context omitted.

SSH can't send out a packet for every keystroke as soon as it gets it-- otherwise it's susceptible to timing attacks based on minute variations in speed of hitting different combinations of letters on the keyboard.

If I understand the code correctly, OpenSSH only injects delays and chaff when you're actively typing data through an interactive session directly to the ssh client itself (i.e. it's reading your key strokes from the TTY, as opposed to keystrokes being sent as opaque data over the X11 channel). There would be no disruption to X11 forwarding while you're not actively typing, and even then there's no delay if it can bu…

> For a full desktop session, X11 over TCP should be much faster just because each X11 client app has it's own TCP connection, whereas for SSH X11 forwarding every app is tunneled over a single TCP connection.

But even with a single X11 connection, the difference in performance is huge between it being tunneled through SSH and not.

Also, whether you have one connection or multiple between 2 hosts, it's still the same bandwidth for the most part.

Re: Sharing an X11 Server Across Hosts with FamilyWild

#13

Post by somat »

Running X open as a sort of shared network attached monitor is pretty fun, granted it is only really useful as a sort of large control room style display as all window operation have to run via cli tools.

But it is neat for anyone to just be able to throw a application up on the big master display.

Re: Sharing an X11 Server Across Hosts with FamilyWild

#14

Post by guenthert »

jolmg wrote: post #8
yjftsjthsd-h wrote: post #5

> You'll often see xhost + suggested as the "just make it work" answer, and it does — by turning host-based access control off entirely. Every client from every host can then connect to your display without any cookie at all. > On a single-user machine that sounds harmless, but X has no isolation between clients: anyone who can reach the server can read your keystrokes, grab the contents of any window, and inject syn…

> Does modern Xorg even support TCP? Yes. It works well. X11 over Wireguard works so much better than ssh -X. Haven't tried over the internet, but in a LAN you can't tell the difference between local and remote windows, at least with Emacs.

> Haven't tried over the internet,

It works, the user experience however might not be great. Latency is your enemy, as are occasional drop-outs. For remote connections outside a LAN, naked X11 isn't recommended. NoMachine's NX (or the shrink wrapped X2Go) were better suited for such.

Re: Sharing an X11 Server Across Hosts with FamilyWild

#15

Post by inigyou »

yjftsjthsd-h wrote: post #5

> You'll often see xhost + suggested as the "just make it work" answer, and it does — by turning host-based access control off entirely. Every client from every host can then connect to your display without any cookie at all. > On a single-user machine that sounds harmless, but X has no isolation between clients: anyone who can reach the server can read your keystrokes, grab the contents of any window, and inject syn…

Yes it supports TCP. It needs some obscure option to enable it.

Re: Sharing an X11 Server Across Hosts with FamilyWild

#16

Post by jolmg »

guenthert wrote: post #14
jolmg wrote: post #8

Earlier quoted context omitted.

> Does modern Xorg even support TCP? Yes. It works well. X11 over Wireguard works so much better than ssh -X. Haven't tried over the internet, but in a LAN you can't tell the difference between local and remote windows, at least with Emacs.

> Haven't tried over the internet, It works, the user experience however might not be great. Latency is your enemy, as are occasional drop-outs. For remote connections outside a LAN, naked X11 isn't recommended. NoMachine's NX (or the shrink wrapped X2Go) were better suited for such.

Bit puzzling how one looks at guides for NoMachine's NX / FreeNX / X2Go and they're all about desktop sharing instead of simply remote X11 clients though X11 compression which is what NX was about. It seems the tunneling through NX's X11 compression is done through the bit obscure nxproxy.

Re: Sharing an X11 Server Across Hosts with FamilyWild

#17

Post by [deleted] »

inigyou wrote: post #15
yjftsjthsd-h wrote: post #5

> You'll often see xhost + suggested as the "just make it work" answer, and it does — by turning host-based access control off entirely. Every client from every host can then connect to your display without any cookie at all. > On a single-user machine that sounds harmless, but X has no isolation between clients: anyone who can reach the server can read your keystrokes, grab the contents of any window, and inject syn…

Yes it supports TCP. It needs some obscure option to enable it.

[deleted]

Re: Sharing an X11 Server Across Hosts with FamilyWild

#18

Post by guenthert »

jolmg wrote: post #16
guenthert wrote: post #14

Earlier quoted context omitted.

> Haven't tried over the internet, It works, the user experience however might not be great. Latency is your enemy, as are occasional drop-outs. For remote connections outside a LAN, naked X11 isn't recommended. NoMachine's NX (or the shrink wrapped X2Go) were better suited for such.

Bit puzzling how one looks at guides for NoMachine's NX / FreeNX / X2Go and they're all about desktop sharing instead of simply remote X11 clients though X11 compression which is what NX was about. It seems the tunneling through NX's X11 compression is done through the bit obscure nxproxy.

The proxy is needed for session management (specifically suspending sessions), no?

Re: Sharing an X11 Server Across Hosts with FamilyWild

#19

Post by jolmg »

guenthert wrote: post #18
jolmg wrote: post #16

Earlier quoted context omitted.

Bit puzzling how one looks at guides for NoMachine's NX / FreeNX / X2Go and they're all about desktop sharing instead of simply remote X11 clients though X11 compression which is what NX was about. It seems the tunneling through NX's X11 compression is done through the bit obscure nxproxy.

The proxy is needed for session management (specifically suspending sessions), no?

No...

> nxproxy is a tool that allows one to tunnel X sessions through the NX compression library. nxproxy is a backend application utilized by various client application (Remmina, X2Go Client, PyHoca-Gui, Arctica Client, TheQVD Client, etc.).

https://manpages.debian.org/trixie/nxproxy/nxproxy.1.en.html

It's what implements the X11 compression tunneling. "X sessions" in this case seems to refer to "X11 connection sessions" rather than "desktop sessions".

Checking

https://en.wikipedia.org/wiki/NX_technology

there's a diagram of how NX works. Both hosts have nxproxy for the compression tunneling, and the remote has nxagent which is basically like Xnest/Xephyr (which would do more of the "desktop session management" role). Things like X2Go and FreeNX seem to add ssh tunneling on top of that.

The important bit for purposes of remote X11 clients over the internet seems to be nxproxy. Hope I'm right anyway. Kind of hate having to deal with windows inside desktops inside windows.

Re: Sharing an X11 Server Across Hosts with FamilyWild

#20

Post by jolmg »

inigyou wrote: post #15
yjftsjthsd-h wrote: post #5

> You'll often see xhost + suggested as the "just make it work" answer, and it does — by turning host-based access control off entirely. Every client from every host can then connect to your display without any cookie at all. > On a single-user machine that sounds harmless, but X has no isolation between clients: anyone who can reach the server can read your keystrokes, grab the contents of any window, and inject syn…

Yes it supports TCP. It needs some obscure option to enable it.

The option(s):

https://man.archlinux.org/man/Xserver.1#nolisten

The executable may be X, Xorg, Xserver. The call may be handled and configurable by xinit or the display manager being used.

Post reply on HN