Re: ssh connection with localhost.6010

Edgardo Mina wrote:

>
> Hi SSH gurus,

This in fact is expected behavior and is a side effect of X11 forwarding. When an X11 application wants to write to the screen, it writes to a TCP port. It determines the host (often localhost for a local X server) and port to connect to by the value of the DISPLAY shell variable, this port is normally 6000 + Display_number. So, if DISPLAY=localhost:0, it really tells the X client that the X server it needs to connect to is running on the local machine at port 6000. When you start an X server, it will usually take the first display 0 (port 6000 + 0) for applications to connect to. When you SSH to a server with X forwarding, SSH needs to open a display on the local machine for the X applications to connect, it will then forward these connections to the connecting client's display over the secure tunnel. By default, SSH will normally start at display 10 (6000 + 10, or port 6010), or the next free display after that (11, 6000 + 11). The end result is that SSH will make a tunnel from 6010:localhost:6000 (presuming that ssh takes display 10 on the server and the client is running under display 0). so if then on those ssh sessions you were to run "echo $DISPLAY" you should see that they are "localhost:10" and "localhost:11" respectively

As such, the open ports you are seeing is normal behavior and nothing to be concerned about.

Chris

-- 
"The box said requires Windows 95 or better... So I installed Linux"

Chris Hendrickson
QSS Group. Inc - MEDS
NASA/Goddard Space Flight Center
Voice: (301) 867-0081 Fax: (301) 867-0089
GSFC Email: Christopher.E.Hendrickson.1@gsfc.nasa.gov
QSS  Email: chendric@qssmeds.com

AETD Security Engineering Team
GOES GRODAS East Coast System Administrator