How to configure X11 forwarding for sudo and root users in SSH

X11 forwarding can work in a normal SSH session and still fail as soon as a graphical program is started through sudo or a root shell. The forwarded display belongs to the login user, while the elevated process reads root's own X authorization file, so privileged GUI tools commonly stop with "Can't open display" even though the same program opens without sudo.

OpenSSH creates a forwarded DISPLAY value such as localhost:10.0 and stores a matching MIT-MAGIC-COOKIE-1 token through xauth. The token is usually available only in the unprivileged account's .Xauthority file, so root must receive the same cookie before it can authenticate to the forwarded X server.

A repeatable pattern is to copy the current cookie with xauth extract and xauth merge, pass the same DISPLAY value to the privileged command, and point root at /root/.Xauthority. The copied cookie lets root draw on and observe the local display for that forwarded session, so remove it after the privileged GUI work is finished.

Steps to use SSH X11 forwarding as root:

Open an SSH session with X11 forwarding enabled.
```
$ ssh -X user@host.example.net 'echo "$DISPLAY"'
localhost:10.0
```
Use -Y only for trusted servers or applications that require trusted X11 forwarding. Trusted forwarding relaxes X11 security restrictions.

Related: How to run a GUI application over SSH with X11 forwarding
Confirm that xauth has a cookie for the forwarded display.
```
$ xauth list "$DISPLAY"
host.example.net/unix:10  MIT-MAGIC-COOKIE-1  0123456789abcdef0123456789abcdef
```
If this command returns no entry, fix the regular X11 forwarding session before copying anything to root.

Related: How to enable or disable X11 forwarding on an SSH server
Reproduce the root-side failure before changing root's X authority file.
```
$ sudo env DISPLAY="$DISPLAY" XAUTHORITY=/root/.Xauthority xclock
Error: Can't open display: localhost:10.0
```
A system that already has the active cookie in /root/.Xauthority may open the window at this step and does not need the merge step for the current session.
Prepare root's X authority file without loosening its permissions.
```
$ sudo sh -c 'umask 077; touch /root/.Xauthority'
```
Merge the current forwarded-display cookie into root's X authority file.
```
$ xauth extract - "$DISPLAY" | sudo XAUTHORITY=/root/.Xauthority xauth merge -
```
The X11 cookie grants access to the forwarded display. Do not copy it to untrusted accounts or leave the SSH session open longer than needed.

Verify that root can see the same forwarded-display cookie.

$ sudo XAUTHORITY=/root/.Xauthority xauth list "$DISPLAY"
host.example.net/unix:10  MIT-MAGIC-COOKIE-1  0123456789abcdef0123456789abcdef

Start a test X11 program as root with the forwarded display and root authority file.
```
$ sudo env DISPLAY="$DISPLAY" XAUTHORITY=/root/.Xauthority xclock &
[1] 1238
```
For an interactive root shell, export the same DISPLAY value and set XAUTHORITY=/root/.Xauthority before starting graphical programs.
Confirm the test X11 program is running as root.
```
$ pgrep -u root -a xclock
1241 xclock
```
Close the root-owned test program.
```
$ sudo pkill -u root xclock
```
Remove the copied root X11 cookie after closing privileged GUI programs.
```
$ sudo XAUTHORITY=/root/.Xauthority xauth remove "$DISPLAY"
```