One more wrinkle; sometimes X will run fine over SSH under your own individual user account, then throw "X11 connection rejected because of wrong authentication. Unable to init server: Could not connect: Connection refused" the moment you use "sudo" or attempt any operation as 'root'.
The solution appears to be to run "xauth list" as your individual user, then "sudo xauth add" to add all the same the individual keys for the 'root' administrator.
ie:
$ xauth list
sophia/unix:10 MIT-MAGIC-COOKIE-1 af8901b66c15a26f10d70e7e0199ea0b
sophia/unix:11 MIT-MAGIC-COOKIE-1 9f9bf2b2cacc242d20d06d9523b2d304
sophia/unix:12 MIT-MAGIC-COOKIE-1 ec167527428b7726d7f36b514a6daec3
sophia/unix:13 MIT-MAGIC-COOKIE-1 133573e87fc32af9634b04307df478fa
in a non-root user session which already has working X-over-ssh. Then "sudo xauth add" each of those keys, in this example:
$ sudo xauth add sophia/unix:13 MIT-MAGIC-COOKIE-1 133573e87fc32af9634b04307df478fa
$ sudo xauth add sophia/unix:12 MIT-MAGIC-COOKIE-1 ec167527428b7726d7f36b514a6daec3
$ sudo xauth add sophia/unix:11 MIT-MAGIC-COOKIE-1 9f9bf2b2cacc242d20d06d9523b2d304
$ sudo xauth add sophia/unix:10 MIT-MAGIC-COOKIE-1 af8901b66c15a26f10d70e7e0199ea0b
Now you should be able to use "sudo" with any command that needs X window support:
$ sudo baobab
...or whatever. There are a few useful admin-type commands (ranging from 'gparted' to xenserver administration) which can make use of the graphics support if it's available - even over an ssh connection to a distant, remote datacentre.