On my server, all but port 22 (ssh) are closed. VNC is possible, but only with a VNC-over-ssh method.
Right now x11vnc is started
-forever at boot. With the right ssh tunnel, anybody can initiate a VNC session. I would like VNC sessions to be possible only for a certain group of users (sudoers).
Non-sudoers have legitimate access to the machine via ssh, but how can I make sure that they are denied a VNC session?