Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I had an issue several months back with VNC writing several lines to the xsession-errors log. (Here's the link). I got rid of the log and go it working, but every couple weeks, I'd have the EXACT SAME ISSUE. Kind of annoying, but I delete the log, restart machine and I'm running again. I finally figured out how to send that log (which contained NOTHING else) to /dev/null. Worked great. Today, I had the SAME PROBLEM AGAIN! Only instead of the xsession-errors file, the logfile in question was in my .vnc directory.

Again, it's logging the same line "AM Authentication deferred - ignoring client message" several thousand times per second until the log fills up. I can't find anything online regarding this error. Any ideas what the root cause of this might be?

Thanks for any ideas!

share|improve this question

2 Answers 2

That might be an DOS attack of your VNC service, you could change the default port 5901 to something else, this will probably minimize the problem if it's a DOS attack.

Another go at the issue, if it's still DOS related, is to let VNC server listening on local network interface and use SSH tunneling which also would give you increased security for remote access to your desktop.

Setup tunnel from your client to server using ssh command:

ssh user@at.your.server -L 5901:localhost:5901

and then connect to localhost:5901 using vncviewer on the client.

share|improve this answer

I just wrote a post in the forums of what I found to be the root cause of this issue. In my logs it appeared as if what caused the log file to grow so large was a brute-force attack not a DOS attack. Although I did find that the brute force attack seemed to be distributed (a characteristic more common to DOS type attacks).

The log filling up is a result of the failed attempts to authenticate to your system's VNC server. After a certain number of failed attempts it appears as if the VNC server just starts rejecting the attempted connections without giving them a chance to authenticate (which is good). Luckily, if these are still happening then most likely they haven't hacked you yet. Check out my post if you are interested.

http://ubuntuforums.org/showpost.php?p=12507381&postcount=9

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.