On my server, all but port 22 (ssh) are closed. VNC is possible, but only with a VNC-over-ssh method.

Right now x11vnc is started -forever at boot. With the right ssh tunnel, anybody can initiate a VNC session. I would like VNC sessions to be possible only for a certain group of users (sudoers).

Non-sudoers have legitimate access to the machine via ssh, but how can I make sure that they are denied a VNC session?


You can use the -unixpw option to use the user's OS name/password to authenticate instead of a single shared VNC password. The same option also allows you to specify a list of which users to allow. There are also a couple of other variants of that option (-unixpw_nis & -unixpw_cmd) that offer more ways of hooking into the system security and doing something fancier.

The X11VNC command-line options page will give you a taste of how they work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.