VNC Server Security

Question

First, we need to make sure VNC server only listens on localhost.

What is the meaning of this line will it listen remote connection when we onfigure it to listen localhost only?

Recommended Step - Secure your VNC server session with encryption. A basic VNC server setup has no encryption, which makes it vulnerable to snooping.

We will create an SSH tunnel with Putty and connect to VNC via this tunnel.

First, we need to make sure VNC server only listens on localhost.

Edit /etc/init.d/vncserver and add -localhost to OPTIONS:

I am not able to understand the meaning of this can someone explain

OPTIONS="-depth ${DEPTH} -geometry ${GEOMETRY} :${DISPLAY} -localhost"

Answer 1

The -localhost option (which is probably actually passed by the VNC server wrapper to an underlying Xvnc command) tells the server to only accept incoming connections that originate - or at least appear to originate - on the same server. From Xvnc --help:

localhost      - Only allow connections from localhost (default=0)

The port (by default, port 5900+n where n is the number of the display set using the :{DISPLAY} variable in your example) will appear closed when probed from outside e.g. using nmap

$ nmap 192.168.1.16 -p 5901

Starting Nmap 5.21 ( http://nmap.org ) at 2014-06-04 12:47 UTC
Nmap scan report for 192.168.1.16
Host is up (0.0015s latency).
PORT     STATE  SERVICE
5901/tcp closed vnc-1

In this configuration, the only way to connect to the VNC service is via tunneling the VNC traffic over an open port/service, typically the - more secure - SSH service. This is done because raw VNC traffic is unencrypted and the native VNC password-based authentication scheme is weak.