What are some of the security concerns and reasons either for or against allowing X11 Forwarding. I have generally taken an approach of not allowing it under the blanket guise of security. Recently, I had a user indicated that they thought that the security implications of resulting from allowing X11 Forwarded sessions were negligible. I was curious to learn more about what the harm is in allowing X11 Forwarding and why one might want to allow it.

  • 2
    See also the more general question Risks of ssh to an untrusted host? May 9, 2012 at 20:59
  • 1
    This doesn't make sense. The setting for disabling X11 forwarding is on the server. So if the server gets compromised, the attacker (who now has access to the server) can easily re-enable this feature even if it has been disabled earlier, and you are back to where you started, which is the ability to compromise the client.
    – NeeHow
    Jun 24, 2015 at 16:31
  • 1
    > With X11 forwarding, the server is likely to gain shell access to the > client. Could anyone confirm this? I tried to google it but couldn't find anything. Is there some further reading about it?
    – Diver
    Jun 15, 2016 at 9:26

3 Answers 3


The implication of X11 forwarding is that it opens a channel from the server back to the client. In a simple SSH session, the client is more trusted than the server: anyone in control of the client can run commands on the server (assuming shell access), but the converse is not true. With X11 forwarding, the server is likely to gain shell access to the client.

In a text session, there is a limited channel from the server back to the client: the server determines the output that is displayed on the client, and can in particular try to exploit escape sequences in the terminal running on the client,

In an X11 session, the server can send X11 commands back to the client. X11 was not designed with security in mind, it was designed with the idea that all programs that you're displaying are run by you and hence trusted anyway. By default, SSH subjects commands from the server to restrictions through the X11 SECURITY extension. The SECURITY extension disables some obvious attacks such as keyboard grabs and key injection, but allows others like focus stealing.

  • 5
    Just to add to this, if I remember correctly, about 4 years ago, OpenSSH's -X behaviour was changed to use the X11 SECURITY extension by default, but it can still be disabled with -Y (or ForwardX11Trusted). (See man page.)
    – Bruno
    May 10, 2012 at 0:45
  • 2
    The poster seems to be asking in regards to whether to allow or disallow X11 forwarding in the server config, however your implication is applicable only in deciding whether the client configuration should allow or disallow X11 forwarding. So is there a security implication in allowing X11 forwarding on in the SSHD server config? Apr 19, 2016 at 2:23
  • 2
    @DavidM.Syzdek I don't know of any security concern in allowing it on the server side. I don't know why it isn't always allowed (for a general account, that is — for an account that can only run a specific command, allowing port forwarding does increase what the account can do). Apr 19, 2016 at 11:09
  • Using firejail for example would I be safer?
    – rhuanpk
    Nov 17, 2023 at 23:35
  • @rhuanpk I'm not familiar with firejail but I don't see how it could help. This thread is about protecting the local machine from an untrusted application running on a remote machine. The application already doesn't have direct access to your local machine, because it's not running on the same machine: you can't isolate it more than that. The problem is that you're giving the untrusted application access to your local X server (because you want to interact with it), and it can leverage the X server into doing things you might not want. Nov 18, 2023 at 14:54

Let's say I open a SSH connection to someserver, with X11 forwarding enabled. The primary risk is that if someserver is malicious, then someserver can do all sorts of nasty stuff to the windows/applications I have open on my own computer.

For instance, someserver can open up windows on my computer, can close other windows I have open, can spy on the contents of other windows I have open, can spy on the keys I type into other windows, can inject spoofed keystrokes and mouse events into other windows I have open, and generally just mess with every other window I have open on my machine -- even if some of those other windows are local applications running locally.

  • Maybe even pop up a dialog that says something crashed and requires your password for sudo access.
    – munchkin
    Jun 25, 2015 at 6:19
  • 1
    How does something like XQuartz say for example on macOS get access to all windows other than the one that it created and opened for a particular session? Does't the OS prevent something like that?
    – Makmeksum
    Apr 13, 2020 at 1:29

One solution to the risks of X forwarding over ssh discussed in the other answers would be to use what might be called a masquerade X server, which is not really an X server but presents an pseudo X interface and a pseudo X screen to the client software on the container, while passing some X work off to the real X server behind it. The pseudo X screen is displayed as a single X window on the host actual X desktop.

Even though it wasn't intended as a security tool, Xephyr does fit that description.

For that reason I wrote a javascript program to create an lxd/lxc container from a vanilla ubuntu image, and populate it with firefox, openvpn, Xephyr, and pusleaudio.



I wouldn't make any strong security claims about - it was a proof of concept exercise.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .