4

I've been searching for hours now, can't figure this one out.

I am trying to make the following happen:

Client: remmina + ssh tunnel

Server: Lubuntu + openssh server (public key authentication) + vino server over ssh tunnel ONLY + allow client to only open 1 port (vnc port)

So far I can connect to my server apparently in both ways (with ssh tunnel and without it), which is unacceptable.

Running vino-preferences GUI doesn't help me much :s

So my question basically is:

  • "How do I block any port opening on server and only single SSH port (22) and allow client to tunnel VNC over SSH via specific port (If it makes sense)?"
  • No other type of VNC connection should be allowed

P.S. I plan to forward port 22 on router to my server and only allow SSH connections.

1 Answer 1

4

AFAIK the vino-preferences GUI does not include it, but I believe the parameter you are looking for is network-interface

gsettings get org.gnome.Vino network-interface

If unset (i.e. the above command returns the empty string, '') then vino-server listens on all available interfaces, whereas if set to lo

gsettings set org.gnome.Vino network-interface 'lo'

then it will listen only on the lo (localhost) interface.

You could also use the GUI dconf-editor, where the parameter is listed under the org -> gnome -> desktop -> remote-access item.


You can confirm that the server is listening on the desired interface using netstat e.g. the default is

$ sudo netstat -nlp | grep ':5900'
tcp        0      0 0.0.0.0:5900            0.0.0.0:*               LISTEN      10927/vino-server
tcp6       0      0 :::5900                 :::*                    LISTEN      10927/vino-server

(listening on all available interfaces); then after

$ gsettings set org.gnome.Vino network-interface 'lo'

you should see that it is only listening on the localhost interface(s):

$ sudo netstat -nlp | grep ':5900'
tcp        0      0 127.0.0.1:5900          0.0.0.0:*               LISTEN      10927/vino-server
tcp6       0      0 ::1:5900                :::*                    LISTEN      10927/vino-server

Alternatively (or additionally), you could use iptables or ufw to close the port - by default, it is port 5900 + display number.

6
  • Thanks for introducing me to gsettings/dconf and iptables/ufw, very useful!
    – GogromaT
    Dec 26, 2015 at 2:35
  • Nice, works like a charm! I am able to connect like so: ssh -L LOCAL_PORT:localhost:SERVER_VNC_PORT USER@SERVER_IP and then going to remmina connect like so: 127.0.0.1:LOCAL_PORT. Fantastic!
    – GogromaT
    Dec 26, 2015 at 2:59
  • @GogromaT glad to help Dec 26, 2015 at 3:03
  • Alternatively, the OP could just close port 5900 (or whatever port he has the VNC daemon running on.
    – Daniel
    Dec 26, 2015 at 3:54
  • @Daniel yes I think I did mention that Dec 26, 2015 at 4:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .