I want to use X forwarding in my work because some tasks are just easier with GUI. I trust the administrators not to be malicious, but I don't trust their competence in security (almost nil). Hence the machines I ssh into are not that reliable.

So what measures can I take to minimize the risk of X forwarding, except for not using it?


There is a rather extreme measure, which should work: run a virtual machine on your side. That machine will power some minimal Linux system with X11. You do the ssh from that machine. That way, if the worst happens, the evil people on the remote machine may compromise your virtual machine, but just the virtual machine.

(Beware of "guest additions" from the VM: this is the kind of extension included in the guest system so that things like copy-paste work between host and guest; such a system may help a compromised guest X11 obtaining information from the host X11. Don't install such extensions. For extra safety, deactivate support for guest additions in the VM engine.)

A lighter version involves Xnest: it is a X11 server that uses for its display a window within an outer X11 server. This will be enough to protect your other applications from X11-based attacks (e.g. sending synthetic events), but not if the attacker succeeds at compromising the connected X11 server through some buffer overflow or a similar hole.

  • In Mac OS X, X server is a separate application, and most applications don't speak X. Does this offer the similar protection as Xnest? – Siyuan Ren Nov 6 '14 at 1:30
  • @SiyuanRen: yes, this would be similar. – Tom Leek Nov 6 '14 at 11:51
  • Then it seems that the risk of X forwarding is mitigated on systems where X is not native (e.g. Windows and Mac OS X). – Siyuan Ren Nov 11 '14 at 3:44

Tom's answer is spot on but I'll add an alternative snippet for you. Instead of running full blown X, run only the application you need, e.g.:

ssh -X yourserver /usr/bin/gimp yourpicture.jpg


ssh -X yourserver /usr/bin/jdk/eclipse yourscript.jar

  • 2
    Is this really more secure? The only difference is that this method doesn't open a shell. – Siyuan Ren Nov 6 '14 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.