How to fix X11 forwarding request failed on channel 0 in SSH

The xauth utility is required on the SSH server to handle X11 authentication. Install it based on your Linux distribution:

For Debian/Ubuntu:

sudo apt update
sudo apt install xauth

For RHEL/CentOS/Fedora:

sudo yum install xauth
# or on newer systems:
sudo dnf install xorg-x11-xauth

For Alpine Linux:

apk add xauth

After installation, verify it's in the PATH:

which xauth

This should output something like /usr/bin/xauth.

Edit the SSH server configuration file on the remote machine:

sudo nano /etc/ssh/sshd_config

Find or add these lines (uncomment if they're commented out):

X11Forwarding yes
X11UseLocalhost no
X11DisplayOffset 10

Key settings:
- X11Forwarding yes - Enables X11 forwarding
- X11UseLocalhost no - Binds to wildcard address instead of localhost (required for proper forwarding)
- X11DisplayOffset 10 - Starts X display numbering at :10 (optional, default is fine)

After making changes, restart the SSH service:

sudo systemctl restart ssh
# or on other systems:
sudo systemctl restart sshd
# or older systems:
sudo service ssh restart

If the service fails to restart, check syntax with:

sudo sshd -t

Connect to the remote server with X11 forwarding enabled:

# Untrusted X11 forwarding (safer, 20 minute timeout)
ssh -X [email protected]

# Trusted X11 forwarding (less secure, no timeout)
ssh -Y [email protected]

Once connected, verify the DISPLAY variable is set:

echo $DISPLAY

You should see output like localhost:10.0 or localhost:11.0.

Test with a simple X11 application:

# Run the xeyes window (move to see eyes follow cursor)
xeyes &

# Or try xclock
xclock &

If windows appear on your local screen, X11 forwarding is working. Close them with Ctrl+C.

In some cases, IPv6 can interfere with X11 socket binding. Try forcing IPv4-only mode:

Edit /etc/ssh/sshd_config again:

sudo nano /etc/ssh/sshd_config

Find or add this line:

AddressFamily inet

This forces SSH to listen only on IPv4. Restart SSH:

sudo systemctl restart ssh

Try X11 forwarding again. If this fixes it, you can optionally revert to AddressFamily any if you need IPv6 support for other purposes.

SSH automatically sets the DISPLAY environment variable for X11 forwarding. If your shell startup files manually override it, it will break forwarding.

Check your shell configuration files on the remote server:

grep -n "DISPLAY=" ~/.bashrc ~/.bash_profile ~/.zshrc ~/.profile 2>/dev/null

If you find any DISPLAY assignments, comment them out:

# export DISPLAY=:0  # COMMENTED OUT - Let SSH manage this

Then reconnect and test again.

If you're connecting FROM a Mac, the X11 server (XQuartz) must be properly initialized:

1. Ensure XQuartz is installed:
Download from https://www.xquartz.org/

2. Logout and login again (or reboot) after installing XQuartz so it can register with the system.

3. Verify XQuartz is running:

ps aux | grep Xquartz

4. Test with:

ssh -Y [email protected]
   xeyes

Use -Y (trusted) instead of -X on macOS for better compatibility.

Instead of typing ssh -X every time, add it to your SSH config:

Edit ~/.ssh/config on your LOCAL machine:

nano ~/.ssh/config

Add a host entry:

Host myserver
    HostName remote.example.com
    User myusername
    ForwardX11 yes
    ForwardX11Trusted yes

Now you can simply connect with:

ssh myserver

And X11 forwarding will be enabled automatically.