Configuring X11 for RHEL server and OSX client

Problem:
We have a remote Red Hat Enterprise Linux (RHEL) server; We have a OSX (Apple) laptop. We want to connect from the laptop client to the RHEL server over ssh and then run graphical utilities (like system-config-users) on the RHEL server but have its graphical output be shown on the laptop.

Approach:
To accomplish this task, we make use of a very handy tool called X. To read more about X, go here.
Now for the X to work properly in our case we need a few things on both the server (RHEL) and client (OSX):
  -ssh configuration to allow XForwarding on RHEL
  -X server on client.

Note:
The way X treats client and server are opposite to the way ssh treats client and server.
For ssh, the client is OSX laptop, and the server is the remote RHEL host we are trying to connect to.
For X, the client is the RHEL host we are going to run the graphical tools on, and the server is the OSX laptop where the X software will run.

Steps:
1- On RHEL server edit the ssh configuration file (/etc/ssh/sshd_config) and uncomment/edit the following lines to look like this:


X11Forwarding yes                    ###This allows X output to be forwarded over ssh
X11UseLocalhost yes                 ###This allows X to use the localhost (OSX client) to display

2- Then restart ssh service:

[root@redhat2 ~]# service sshd restart
Stopping sshd:                                             [  OK  ]
Starting sshd:                                               [  OK  ]

3- On the client (OSX laptop) side, install X server:
Note: In recent versions of OSX, X server is not installed by default and you need to download (and install) X software called XQuartz from here.
4- Once the download of XQuartz is completed, you need to install it by double clicking the file.
5- Once installed you need to enable remote login for ssh. To do so, open 'System Preferences' > click 'Sharing' and check 'Remote Login' as shown.

6- Then open a terminal on your OSX laptop and ssh to the RHEL server:

msarkar$ ssh -X root@10.10.80.102
root@10.10.80.102's password:
Last login: Wed Apr 10 22:31:38 2013 from 10.250.0.223
[root@redhat2 ~]#

This will put you on the remote RHEL server whose graphical output you want to see on your laptop over X system.
To verify that the Display is properly set, echo the display--this should be localhost or the IP address of the laptop as shown below:

[root@redhat2 ~]# echo $DISPLAY
localhost:10.0
[root@redhat2 ~]#

7- To test out that everything related to X working fine run a sample X application like xeyes or xclock

[root@redhat2 ~]# xeyes &
[1] 24575
[root@redhat2 ~]#

It should show you the applet running on your laptop (here xeyes).
If that works out fine, simply invoke your graphical application whose output you want to see on your local client (here OSX laptop).


[root@redhat2 ~]# system-config-users &
[2] 27604
[root@redhat2 ~]#

And thats it!
Hope you found this useful.

Note:
If you encounter errors like "xhost:  unable to open display" or "Error: Can't open display:", make sure the /etc/ssh/sshd_config file is properly configured (see step #1 above) and you have restarted sshd service after that (step #2) before you attempt to login over ssh.

How to Password Protect your Folder in Linux

In Linux (like most other Unix), file permissions under DAC (Discretionary Access Control, ie rwx combination on user,group and world/others) are usually enough to protect files at a high level. And since Folders are nothing but special files, it applies to them aswell.
That said, sometimes (especially when using the GUI on a desktop), it is desirable to have a mechanism where users simply cant open a folder because they had read permissions on it (even if you yourself are the owner of the files in that folder). This can be handy when dealing with sensitive data.
The catch though is that you cant actually password protect a folder unless you zip it. If you dont zip it, it can still be protected with the DAC permissions).
Now, back to the password protection -- there are two ways to do this -- via GUI or via CLI (command line interface).

By GUI, its simple: right click on the folder you want protected, choose 'encrypt', choose password ' 'protect' and provide a secret password. This will create a zip file of the folder with its underlying directories and files in the current directory. You would then go on to delete the folder you zipped (because now you have a copy of it in the zip file).

By CLI, a little more extra hoops but the same result as shown below:

~# mkdir -p /home/mrinal/secdir   <----- you want to password protect this folder called secdir
~# cd /home/mrinal/secdir
secdir# touch a b c d e                   <----- create afew files in secdir
secdir# echo hello world > a          <----- populate the files with some words here 'hello world'
secdir# echo hello world > b
secdir# echo hello world > c
secdir# echo hello world > d
secdir# echo hello world > e

secdir]# cd ..                                   <----- go one folder up
mrinal# zip -e -r secret /home/mrinal/secdir/              <----- zip encrypt recursively the secdir dir/folder

Enter password:
Verify password:
  adding: home/mrinal/secdir/ (stored 0%)
  adding: home/mrinal/secdir/d (stored 0%)
  adding: home/mrinal/secdir/c (stored 0%)
  adding: home/mrinal/secdir/b (stored 0%)
  adding: home/mrinal/secdir/e (stored 0%)
  adding: home/mrinal/secdir/a (stored 0%)
mrinal# ls -l
total 8
drwxr-xr-x. 2 root root 4096 Apr  3 13:51 secdir
-rw-r--r--. 1 root root 1228 Apr  3 13:58 secret.zip

mrinal# rm -rf  secdir                    <----- remove the dir as you have a protected copy in the zip [Relax, its safe!]

Now you can access the file via GUI or the CLI, either way you would be prompted for a password.
When you provide the right password, it unzips the folder and puts it back for you to view.

For instance on CLI:

mrinal# unzip secret.zip
Archive:  secret.zip
   creating: home/mrinal/secdir/
[secret.zip] home/mrinal/secdir/d password:
 extracting: home/mrinal/secdir/d  
 extracting: home/mrinal/secdir/c  
 extracting: home/mrinal/secdir/b  
 extracting: home/mrinal/secdir/e  
 extracting: home/mrinal/secdir/a  
mrinal#

Hope this helps.