How can I disallow VNC if the connection isn't via a SSH tunnel?
1 Answer
Although it's not explicitly listed as an option to vnc4server
, you should be able to pass the -localhost
option to the underlying Xvnc
process.
From man vncserver
:
You can add Xvnc options at the command line. They will be added to the
invocation of Xvnc without changes.
From man Xvnc
:
-localhost
Only allow connections from the same machine. Useful if you use
SSH and want to stop non-SSH connections from any other hosts.
See the guide to using VNC with SSH on the web site.
Alternatively, you could use ufw
or iptables
to default deny external connections, only opening the chosen SSH port.