First, we need to make sure VNC server only listens on localhost.

What is the meaning of this line will it listen remote connection when we onfigure it to listen localhost only?

Recommended Step - Secure your VNC server session with encryption. A basic VNC server setup has no encryption, which makes it vulnerable to snooping.

We will create an SSH tunnel with Putty and connect to VNC via this tunnel.

First, we need to make sure VNC server only listens on localhost.

Edit /etc/init.d/vncserver and add -localhost to OPTIONS:

I am not able to understand the meaning of this can someone explain

OPTIONS="-depth ${DEPTH} -geometry ${GEOMETRY} :${DISPLAY} -localhost"

  • I guess it's to set display size Jun 4, 2014 at 7:55
  • But its saying it will listen only localhost
    – subodh
    Jun 4, 2014 at 8:14

1 Answer 1


The -localhost option (which is probably actually passed by the VNC server wrapper to an underlying Xvnc command) tells the server to only accept incoming connections that originate - or at least appear to originate - on the same server. From Xvnc --help:

localhost      - Only allow connections from localhost (default=0)

The port (by default, port 5900+n where n is the number of the display set using the :{DISPLAY} variable in your example) will appear closed when probed from outside e.g. using nmap

$ nmap -p 5901

Starting Nmap 5.21 ( http://nmap.org ) at 2014-06-04 12:47 UTC
Nmap scan report for
Host is up (0.0015s latency).
5901/tcp closed vnc-1

In this configuration, the only way to connect to the VNC service is via tunneling the VNC traffic over an open port/service, typically the - more secure - SSH service. This is done because raw VNC traffic is unencrypted and the native VNC password-based authentication scheme is weak.

  • Right now i am connecting VNC server from my location by TightVNC viewer after this change ,can it will allow me to login?
    – subodh
    Jun 4, 2014 at 13:01
  • 1
    You would need to install openssh-server (or similar) on the VNC server machine and set up a tunnel for your VNC connection. If you only have remote access to the machine, make sure you have configured and tested SSH thoroughly before you apply the -localhost option - else you may lock yourself out. Jun 4, 2014 at 13:08
  • Hmm thanks Better not to make changes right now as i am newbie i do not want any big trouble for development
    – subodh
    Jun 4, 2014 at 13:38
  • Just be aware that externally open VNC ports will get attacked Jun 4, 2014 at 13:58
  • Do you have any Step guide how to make changes for SSH so system should be safe from attacks
    – subodh
    Jun 4, 2014 at 14:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .