0

First, we need to make sure VNC server only listens on localhost.

What is the meaning of this line will it listen remote connection when we onfigure it to listen localhost only?

Recommended Step - Secure your VNC server session with encryption. A basic VNC server setup has no encryption, which makes it vulnerable to snooping.

We will create an SSH tunnel with Putty and connect to VNC via this tunnel.

First, we need to make sure VNC server only listens on localhost.

Edit /etc/init.d/vncserver and add -localhost to OPTIONS:

I am not able to understand the meaning of this can someone explain

OPTIONS="-depth ${DEPTH} -geometry ${GEOMETRY} :${DISPLAY} -localhost"

  • I guess it's to set display size – Blanca Higgins Jun 4 '14 at 7:55
  • But its saying it will listen only localhost – subodh Jun 4 '14 at 8:14
1

The -localhost option (which is probably actually passed by the VNC server wrapper to an underlying Xvnc command) tells the server to only accept incoming connections that originate - or at least appear to originate - on the same server. From Xvnc --help:

localhost      - Only allow connections from localhost (default=0)

The port (by default, port 5900+n where n is the number of the display set using the :{DISPLAY} variable in your example) will appear closed when probed from outside e.g. using nmap

$ nmap 192.168.1.16 -p 5901

Starting Nmap 5.21 ( http://nmap.org ) at 2014-06-04 12:47 UTC
Nmap scan report for 192.168.1.16
Host is up (0.0015s latency).
PORT     STATE  SERVICE
5901/tcp closed vnc-1

In this configuration, the only way to connect to the VNC service is via tunneling the VNC traffic over an open port/service, typically the - more secure - SSH service. This is done because raw VNC traffic is unencrypted and the native VNC password-based authentication scheme is weak.

  • Right now i am connecting VNC server from my location by TightVNC viewer after this change ,can it will allow me to login? – subodh Jun 4 '14 at 13:01
  • 1
    You would need to install openssh-server (or similar) on the VNC server machine and set up a tunnel for your VNC connection. If you only have remote access to the machine, make sure you have configured and tested SSH thoroughly before you apply the -localhost option - else you may lock yourself out. – steeldriver Jun 4 '14 at 13:08
  • Hmm thanks Better not to make changes right now as i am newbie i do not want any big trouble for development – subodh Jun 4 '14 at 13:38
  • Just be aware that externally open VNC ports will get attacked – steeldriver Jun 4 '14 at 13:58
  • Do you have any Step guide how to make changes for SSH so system should be safe from attacks – subodh Jun 4 '14 at 14:27

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.