X11 Mystery

Question

I connect to an HP-UX via ssh. There I access, or need to access, a suite of applications. This suite has 5 applications, all launched via .sh script. One of the applications is a command line interface for the application suite. When I run the .sh to launch this portion of the suite, everything works like a charm. Another portion of the suite launched via a different .sh [same folder] and it is graphical. It too launches just fine. The other portions, they are graphical too, do not launch. Well they launch their login window, I can login, the splash screen appears and then quickly, too quickly, disappears. The app never populates a window and there is no process running. SO ... why would some portion of an application launch just fine and others not? Also, using Exceed for windows on various windows boxes, the applications ALL work. My Mac is the only Mac and the only computer experiencing the issue.
Ideas? Help...? Recap - Two graphical [GUI] applications run and one cmd line app work... Two graphical [GUI] apps do not....

Answer 1

Hi Ashler,
> what is the difference?
   If ssh -Y, which is more permissive, ssh -X won't work. Is there anything in the logs when the apps crash? You can read more about the X11 Security Extension Specification by downloading the PDF document from security.pdf.
   The use of the -Y option will cause all X11 apps that you forward to be treated as "trusted". In the X11 Security Extension Specification, this means that the application can be trusted to be harmless and thus that security may be lax. For instance, xclock only conveys the local time and this information can be compromised without serious risk. However, if you designate a forwarded word processor app as "trusted", you are saying that your keystrokes need not be closely guarded. If the app is specified as "untrusted" it is isolated, preventing the sharing of those keystrokes. Of course it's difficult for most apps to function in such isolation.
   Older versions of ssh were found to cause the client xauth vulnerability described in SSH client xauth Vulnerability. When they communicate the (usually MIT-MAGIC-COOKIE-1) cookie for your local XServer to the remote machine, it is placed in the remote machine's authorization cache for use by X11 apps to negotiate connections with your local XServer. Thus, if the remote machine's authorization cache is compromised, so is your XServer.
   To minimize the risk, when ssh connects with the -X option it sends an untrusted cookie to the remote machine so that X11 applications that obtain authorization with this cookie are marked as untrusted and restricted in what they can do. While this is safer, the X11 Security Extension Specification is in its infancy and many apps crash as a result of the limitations. Thus the -Y option is often necessary. However, it is less secure and should only be used when necessary!
Gary
~~~~
      A domineering man married a mere wisp of a girl.
   He came back from his honeymoon a chastened man.
   He'd become aware of the will of the wisp.