1

I've been searching for hours now, can't figure this one out.

I am trying to make the following happen:

Client: remmina + ssh tunnel

Server: Lubuntu + openssh server (public key authentication) + vino server over ssh tunnel ONLY + allow client to only open 1 port (vnc port)

So far I can connect to my server apparently in both ways (with ssh tunnel and without it), which is unacceptable.

Running vino-preferences GUI doesn't help me much :s

So my question basically is:

  • "How do I block any port opening on server and only single SSH port (22) and allow client to tunnel VNC over SSH via specific port (If it makes sense)?"
  • No other type of VNC connection should be allowed

P.S. I plan to forward port 22 on router to my server and only allow SSH connections.

2

AFAIK the vino-preferences GUI does not include it, but I believe the parameter you are looking for is network-interface

gsettings get org.gnome.Vino network-interface

If unset (i.e. the above command returns the empty string, '') then vino-server listens on all available interfaces, whereas if set to lo

gsettings set org.gnome.Vino network-interface 'lo'

then it will listen only on the lo (localhost) interface.

You could also use the GUI dconf-editor, where the parameter is listed under the org -> gnome -> desktop -> remote-access item.


You can confirm that the server is listening on the desired interface using netstat e.g. the default is

$ sudo netstat -nlp | grep ':5900'
tcp        0      0 0.0.0.0:5900            0.0.0.0:*               LISTEN      10927/vino-server
tcp6       0      0 :::5900                 :::*                    LISTEN      10927/vino-server

(listening on all available interfaces); then after

$ gsettings set org.gnome.Vino network-interface 'lo'

you should see that it is only listening on the localhost interface(s):

$ sudo netstat -nlp | grep ':5900'
tcp        0      0 127.0.0.1:5900          0.0.0.0:*               LISTEN      10927/vino-server
tcp6       0      0 ::1:5900                :::*                    LISTEN      10927/vino-server

Alternatively (or additionally), you could use iptables or ufw to close the port - by default, it is port 5900 + display number.

  • Thanks for introducing me to gsettings/dconf and iptables/ufw, very useful! – GogromaT Dec 26 '15 at 2:35
  • Nice, works like a charm! I am able to connect like so: ssh -L LOCAL_PORT:localhost:SERVER_VNC_PORT USER@SERVER_IP and then going to remmina connect like so: 127.0.0.1:LOCAL_PORT. Fantastic! – GogromaT Dec 26 '15 at 2:59
  • @GogromaT glad to help – steeldriver Dec 26 '15 at 3:03
  • Alternatively, the OP could just close port 5900 (or whatever port he has the VNC daemon running on. – Daniel Dec 26 '15 at 3:54
  • @Daniel yes I think I did mention that – steeldriver Dec 26 '15 at 4:08

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.