X11

Linux windows on this PC (X11)

This page explains the SSH option that shows the windows of Linux programs on your Windows desktop (X11 forwarding), what the server needs, the X server that comes with Cablebag, the firewall question Windows may ask the first time, and the licence of that X server.

Switching it on

In an SSH session's editor, under SSH options and jump hosts, tick Show Linux windows on this PC (X11). Programs with windows that you start on the server (a graphical editor, a settings tool) then open as ordinary windows on the Windows desktop, each its own window, without a Linux desktop around it.

A folder can switch it on for every SSH session inside: Folder settings, Show Linux windows on this PC (X11, SSH). A session's own choice wins; the session editor shows the folder's value when the session has none.

It works through jump hosts and WireGuard networks as well: the windows travel inside the SSH connection, so nothing else has to be open. Sessions imported from MobaXterm that had X11 switched on there get it too.

What the server needs

The SSH server has to allow it: X11Forwarding yes in its sshd_config, and the xauth program installed. When a server does not allow it, the terminal says so in one line, "This server does not allow showing Linux windows on this PC (X11Forwarding is off in its SSH server settings).", and the session goes on as usual without it.

Then start a program with a window from the terminal; DISPLAY is set by the server for the session.

The X server that comes with Cablebag

The windows are drawn by an X server, VcXsrv 21.1.16.1, which is installed with Cablebag in the folder vcxsrv next to it. You do not install or start anything yourself:

• It starts by itself when the first window of any session arrives, not when the session connects, so a session with the option on but no windows costs nothing.
• One X server is shared by every session that shows windows.
• It stops when the last session that used it closes, and when Cablebag closes, also after a crash.
• It has no tray icon of its own; Cablebag manages it.

Because of the X server the installer is about 47 MB rather than 6 MB, and VcXsrv takes about 100 MB on disk, most of it fonts that many X programs need.

The Windows firewall question

The X server listens on a port on this PC, and it can only listen on all network addresses, so the first time it starts Windows may ask whether VcXsrv may use networks. Cancel is fine: Cablebag only needs it on this PC, Windows then blocks it from the network, and connections from Cablebag still work. Even when it is allowed, nobody gets in without the session's cookie (below).

Security

Each session gets a random cookie of its own, which is what the SSH server hands to the programs it starts. Every window connection the server opens has to present that cookie; Cablebag then swaps it for the real cookie of the X server on this PC, so the server never learns the real one, and connections with another cookie, another protocol or no cookie are closed. The X server itself only accepts clients with the real cookie; its cookie file is kept in your temporary files folder (cablebag-x11) and removed when the server stops.

Licence

VcXsrv is a separate program, shipped unchanged from its official release; Cablebag only starts it and talks to it over the X protocol. It is free software under the GNU General Public License version 3 (GPL-3.0), which applies to it instead of Cablebag's own licence: you may use, copy, change and pass it on under the terms of the GPL. Its licence text is installed next to it as vcxsrv\COPYING, and THIRD-PARTY-NOTICES.md names the version, links to the complete source code of that exact release (https://github.com/marchaesen/vcxsrv/tree/21.1.16.1) and carries a written offer: for at least three years after the last Cablebag release that contains this version, a copy of the source is also available from the Cablebag maintainer; ask in an issue.

When it does not work

• The terminal says the server does not allow it: ask its administrator for X11Forwarding yes and xauth.
• "the X server (vcxsrv) was not found next to Cablebag": installing Cablebag again brings it back.
• The X server did not start, or stopped right after starting: its log is in the cablebag-x11 folder in your temporary files folder (%TEMP%); the message names it.
• The program on the server says it cannot open the display: check that the session has the option on and that it was connected after you switched the option on.

More in Troubleshooting and FAQ.