Hi! NetworkManager has the possibility to change the hostname when the user moves from one network to another. NM also updates the 127.0.0.1 entry in /etc/hosts, with this new hostname. When sshd is running on such a machine, that is reached remotely with X11 forwarding enabled, the ~/.Xauthority file will contain several entries for the same couple (unix socket, port number), that will differ only by the hostname that _was_ the localhost when the cookie had been previously added. For example : bonobo.domain1.com/unix:12 MIT-MAGIC-COOKIE-1 de1b9xxxxxx bonobo.domain2.com/unix:12 MIT-MAGIC-COOKIE-1 da78bxxxxxx [bellet@bonobo ~]$ xhost X11 connection rejected because of wrong authentication. xhost: unable to open display "localhost:12.0" It seems to me that the problem with xau-1.0.4-local.patch is, that without checking the hostname, when family is FamilyLocal, you try to authenticate with the wrong cookie. Rebuilding the rpm with this patch disabled gives back the expected behaviour: [bellet@bonobo ~]$ xhost access control enabled, only authorized clients can connect SI:localuser:bellet I think that, this case would also be resolved, if xauth is modified so that the command "xauth remove :xx.0" invoked by the ssh client, removes _all_ entries matching "unix/xx", and not only the one matching the current hostname for localhost.
This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle. Changing version to '11'. More information and reason for this action is here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
fixed in 1.0.4-5