2.9p1 SCO OS 5.0.5 server and Linux client hang on exit when using X11 forwarding and protocol 2

[Aran Cox]

When I run this command:

ssh -1 -v -n -l root njdb1b /usr/bin/X11/xterm -sb -sl 1000 -T njdb1b -e find /etc           

An xterm appears on my screen, the contents of /etc scroll by and then ssh exits.

When I invoke the same command with the -2 option, the xterm appears (and disappears) but 
ssh never exits.  netstat says the (ssh) connection is still established but the xterm 
is no longer running.  

I'll include the output as attachments.  Any idea as to what is going on?

The client is RedHat 7.1 using RPMS from the openbsd.com ftp site.  The server
is SCO OpenServer 5.0.5 built with the SCO development environment.  I configured
with :

export CCFLAGS='-L/usr/local/lib -I/usr/local/include' 
./configure --sysconfdir=/etc/ssh --with-rsh=/usr/bin/rcmd --exec-prefix=/usr 


Thanks, Aran


-------------- next part --------------
OpenSSH_2.9p1, SSH protocols 1.5/2.0, OpenSSL 0x0090600f
debug1: Reading configuration data /home/spin/.ssh/config
debug1: Applying options for *
debug1: Applying options for njdb*
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Seeding random number generator
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 1000 geteuid 0 anon 1
debug1: Connecting to njdb1b [X.X.X.X] port 22.
debug1: temporarily_use_uid: 1000/100 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 1000/100 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/spin/.ssh/identity type 0
debug1: Remote protocol version 1.99, remote software version OpenSSH_2.9p1
debug1: match: OpenSSH_2.9p1 pat ^OpenSSH
debug1: Local version string SSH-1.5-OpenSSH_2.9p1
debug1: Waiting for server public key.
debug1: Received server public key (768 bits) and host key (1024 bits).
debug1: Host 'njdb1b' is known and matches the RSA1 host key.
debug1: Found key in /home/spin/.ssh/known_hosts:3
debug1: Encryption type: blowfish
debug1: Sent encrypted session key.
debug1: Installing crc compensation attack detector.
debug1: Received encrypted confirmation.
debug1: Trying RSA authentication via agent with 'spin at benway'
debug1: Received RSA challenge from server.
debug1: Sending response to RSA challenge.
debug1: Remote: RSA authentication accepted.
debug1: RSA authentication accepted by server.
debug1: Requesting X11 forwarding with authentication spoofing.
debug1: Requesting authentication agent forwarding.
debug1: Sending command: /usr/bin/X11/xterm -sb -sl 1000 -T njdb1b -e find /etc
debug1: Entering interactive session.
debug1: Sending eof.
debug1: Received X11 open request.
debug1: fd 4 setting O_NONBLOCK
debug1: fd 4 IS O_NONBLOCK
debug1: channel 0: new [X11 connection from X.X.X.X port 1482]
debug1: channel 0: rcvd ieof
debug1: channel 0: output open -> drain
debug1: channel 0: obuf empty
debug1: channel 0: output drain -> closed
debug1: channel 0: send oclose
debug1: channel 0: close_write
debug1: channel 0: read<=0 rfd 4 len 0
debug1: channel 0: read failed
debug1: channel 0: input open -> drain
debug1: channel 0: close_read
debug1: channel 0: input: no drain shortcut
debug1: channel 0: ibuf empty
debug1: channel 0: input drain -> wait_oclose
debug1: channel 0: send ieof
debug1: channel 0: rcvd oclose
debug1: channel 0: input wait_oclose -> closed
debug1: channel 0: is dead
debug1: channel_free: channel 0: status: The following connections are open:
  #0 X11 connection from X.X.X.X port 1482 (t4 r2 i8/0 o128/0 fd 4/4)

Waiting for forwarded connections to terminate...
The following connections are open:
  #2 X11 connection from X.X.X.X port 1482 (t4 r0 i4/0 o16/0 fd 8/8)
debug1: Transferred: stdin 0, stdout 0, stderr 164 bytes in 1.7 seconds
debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 96.3
debug1: Exit status 0
-------------- next part --------------
OpenSSH_2.9p1, SSH protocols 1.5/2.0, OpenSSL 0x0090600f
debug1: Reading configuration data /home/spin/.ssh/config
debug1: Applying options for *
debug1: Applying options for njdb*
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Seeding random number generator
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: restore_uid
debug1: ssh_connect: getuid 1000 geteuid 0 anon 1
debug1: Connecting to njdb1b [X.X.X.X] port 22.
debug1: temporarily_use_uid: 1000/100 (e=0)
debug1: restore_uid
debug1: temporarily_use_uid: 1000/100 (e=0)
debug1: restore_uid
debug1: Connection established.
debug1: read PEM private key done: type DSA
debug1: read PEM private key done: type RSA
debug1: identity file /home/spin/.ssh/id_rsa type 1
debug1: identity file /home/spin/.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_2.9p1
debug1: match: OpenSSH_2.9p1 pat ^OpenSSH
Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_2.9p1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client blowfish-cbc hmac-md5 none
debug1: kex: client->server blowfish-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: dh_gen_key: priv key bits set: 139/256
debug1: bits set: 1040/2049
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'njdb1b' is known and matches the RSA host key.
debug1: Found key in /home/spin/.ssh/known_hosts2:11
debug1: bits set: 1063/2049
debug1: ssh_rsa_verify: signature correct
debug1: kex_derive_keys
debug1: newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: waiting for SSH2_MSG_NEWKEYS
debug1: newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: done: ssh_kex2.
debug1: send SSH2_MSG_SERVICE_REQUEST
debug1: service_accept: ssh-userauth
debug1: got SSH2_MSG_SERVICE_ACCEPT
debug1: authentications that can continue: publickey,password,keyboard-interactive
debug1: next auth method to try is publickey
debug1: userauth_pubkey_agent: testing agent key /home/spin/.ssh/id_rsa
debug1: input_userauth_pk_ok: pkalg ssh-rsa blen 149 lastkey 0x80920e0 hint -1
debug1: ssh-userauth2 successful: method publickey
debug1: fd 4 setting O_NONBLOCK
debug1: channel 0: new [client-session]
debug1: channel_new: 0
debug1: send channel open 0
debug1: Entering interactive session.
debug1: client_init id 0 arg 0
debug1: Requesting X11 forwarding with authentication spoofing.
debug1: Requesting authentication agent forwarding.
debug1: Sending command: /usr/bin/X11/xterm -sb -sl 1000 -T njdb1b -e find /etc
debug1: channel 0: open confirm rwindow 0 rmax 16384
debug1: client_input_channel_open: ctype x11 rchan 3 win 4096 max 2048
debug1: client_request_x11: request from X.X.X.X 1485
debug1: fd 7 setting O_NONBLOCK
debug1: fd 7 IS O_NONBLOCK
debug1: channel 1: new [x11]
debug1: confirm x11
debug1: channel 0: read<=0 rfd 4 len 0
debug1: channel 0: read failed
debug1: channel 0: input open -> drain
debug1: channel 0: close_read
debug1: channel 0: input: no drain shortcut
debug1: channel 0: ibuf empty
debug1: channel 0: input drain -> closed
debug1: channel 0: send eof
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 0: rcvd eof
debug1: channel 0: output open -> drain
debug1: channel 0: rcvd close
debug1: channel 1: rcvd eof
debug1: channel 1: output open -> drain
debug1: channel 0: obuf empty
debug1: channel 0: output drain -> closed
debug1: channel 0: close_write
debug1: channel 0: send close
debug1: channel 0: is dead
debug1: channel_free: channel 0: status: The following connections are open:
  #0 client-session (t4 r0 i8/0 o128/0 fd -1/-1)
  #1 x11 (t4 r3 i1/0 o32/0 fd 7/7)

debug1: channel_free: channel 0: dettaching channel user
debug1: channel 1: obuf empty
debug1: channel 1: output drain -> closed
debug1: channel 1: close_write
debug1: channel 1: read<=0 rfd 7 len 0
debug1: channel 1: read failed
debug1: channel 1: input open -> drain
debug1: channel 1: close_read
debug1: channel 1: input: no drain shortcut
debug1: channel 1: ibuf empty
debug1: channel 1: input drain -> closed
debug1: channel 1: send eof
debug1: channel 1: send close
debug1: channel 1: rcvd close
debug1: channel 1: is dead
debug1: channel_free: channel 1: status: The following connections are open:
  #1 x11 (t4 r3 i8/0 o128/0 fd 7/7)