0

I had an issue several months back with VNC writing several lines to the xsession-errors log. (Here's the link). I got rid of the log and go it working, but every couple weeks, I'd have the EXACT SAME ISSUE. Kind of annoying, but I delete the log, restart machine and I'm running again. I finally figured out how to send that log (which contained NOTHING else) to /dev/null. Worked great. Today, I had the SAME PROBLEM AGAIN! Only instead of the xsession-errors file, the logfile in question was in my .vnc directory.

Again, it's logging the same line "AM Authentication deferred - ignoring client message" several thousand times per second until the log fills up. I can't find anything online regarding this error. Any ideas what the root cause of this might be?

Thanks for any ideas!

2 Answers 2

0

That might be an DOS attack of your VNC service, you could change the default port 5901 to something else, this will probably minimize the problem if it's a DOS attack.

Another go at the issue, if it's still DOS related, is to let VNC server listening on local network interface and use SSH tunneling which also would give you increased security for remote access to your desktop.

Setup tunnel from your client to server using ssh command:

ssh [email protected] -L 5901:localhost:5901

and then connect to localhost:5901 using vncviewer on the client.

0

I just wrote a post in the forums of what I found to be the root cause of this issue. In my logs it appeared as if what caused the log file to grow so large was a brute-force attack not a DOS attack. Although I did find that the brute force attack seemed to be distributed (a characteristic more common to DOS type attacks).

The log filling up is a result of the failed attempts to authenticate to your system's VNC server. After a certain number of failed attempts it appears as if the VNC server just starts rejecting the attempted connections without giving them a chance to authenticate (which is good). Luckily, if these are still happening then most likely they haven't hacked you yet. Check out my post if you are interested.

http://ubuntuforums.org/showpost.php?p=12507381&postcount=9

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .