0

I have an Ubuntu 12.04 computer in the other room that I remote into using Remmina Remote Desktop Client and VNC on another Ubuntu 12.04 desktop. It worked about 1 month ago. Now Remmina hangs at "Connecting to remoteComputerName".

I've verified that remote connections are enabled on the remote computer. I've turned on Remmina Debug Window which shows nothing. I've checked /var/log for any indication of an error on both systems. On the remote system I checked using sudo ufw status verbose and found that the firewall I had enabled was no longer running. So it wasn't blocking my access. On the remote system I checked using sudo iptables -L and found that the rules I had set to only enable the ip address of my second desktop were no longer there, iptables are empty. On both systems sudo service --status-all does not show vnc nor vncserver nor vino nor anything that looks like a vnc server is running. I've tried which vnc and which vncserver and nothing shows up on either system. I've tried looking for the vncserver sudo apt-get -s install vncserver and I get back Package vncserver is not available, but is referred to by another package. This may mean that the package is missing, has been obsoleted, or is only available from another source. I've also googled numerous terms to no avail.

I did find that there are settings I must make so that iptables and ufw are reloaded at boot? Though I do not remember nor can I find the commands I used to set this up. I did this after hackers filled up my login log causing the system to crash.

I assume vino or vncservice or whatever the service name actually is, is no longer supported in Ubuntu 12.04 just as it no longer comes with Ubuntu 16.04? So the update deleted it? If so do I follow instructions for getting VNC to work on 16.04 on my 12.04 box? Or do I just have to manually restart it?

  • If you are referring to the default 'Desktop Sharing' option, it doesn't run as a system service, but as an ordinary user process under the currently logged in user. If you're probing this remotely (e.g. via ssh), try ps -fu $USER | grep vino to see if it's running, or DISPLAY=:0 gsettings list-recursively org.gnome.Vino to see its configuration settings in a terminal (replace :0 with the correct primary display number if different). If you have local access to the desktop you can start the preferences editor from a terminal using the vino-preferences command. – steeldriver May 12 '16 at 19:43
  • @steeldriver Thank you. I had used pf ax | grep vino yesterday and nothing showed up. Today I obtain /usr/lib/vino/vino-server --sm-disable even though I have enabled using remote control through vino-preferences. I'll search for how to enable vino-server and reconfigure and start the firewall later when I have time. – Kurt Sanger May 13 '16 at 12:51
  • I don't think --sm-disable means the actual vino-server is disabled: you should still be able to connect to it provided all the other ducks are lined up (port open / forwarded, appropriate security settings in place) – steeldriver May 13 '16 at 12:58
0

It took me a while but I figured this one out and am currently VNC'ing into my ubuntu 12.04 box again from my ubuntu 12.04 desktop machine. Here's what I had to do.

ufw (uncomplicated fire wall) and iptables are not persistent. So upon reboot all the trouble I took to only enable my desktop and laptop to log in remotely were disabled. Then I found my .xsession-errors file to be > 32GB and I could not log in remotely using VNC. So the first thing to fix is disable remote logins. Then make iptables reload at boot and enter in the rules to block everybody but my local ip addresses for vnc.

To disable remote logins we search for remote and select Desktop Sharing. Then disable Allow other users to control your desktop and disable Allow other users to view your desktop. Reboot. Now no one else will be allowed to try hacking in while we fix this.

To make iptables persistent using the terminal cntrl alt t.
sudo apt-get update
and then
sudo apt-get install iptables-persistent
Select yes to save both ip4 and ip6 current table rules. We'll save them again after testing the new ones out.

First check your existing INPUT rules to see if you want to keep them. Copy them down if your not sure.
sudo iptables -S

Steps to delete existing INPUT rules. I only changed my input rules.
sudo iptables -F INPUT

Entered in my current INPUT rules. You will need to change your address ranges for your local system. Also note that I am not enabling port 22 for SSH tunneling. I'm using VNC on my local network. I still have to verify that my router does not retransmit my VNC traffic out to the Ethers. It might retransmit on my wireless and I'll have to verify that WPA2 encryption keeps me safe from the neighbors.

sudo iptables -A INPUT -i lo -j ACCEPT  -m comment  --comment "Enable Loopback::"
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT  -m comment --comment "Enable Already Established:"
sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP -m comment --comment "Disable Invalid Packets::"
sudo iptables -A INPUT -p icmp --icmp-type 8  -d 192.168.1.100  -m iprange --src-range 192.168.1.64-192.168.1.127 -m state --state NEW -j ACCEPT -m comment --comment "Enable Local Ping::"
sudo iptables -A INPUT -p tcp --dport 80   -m iprange --src-range 192.168.1.64-192.168.1.127 -m state --state NEW -j ACCEPT -m comment --comment "Enable Website::"
sudo iptables -A INPUT -p tcp --dport 3306 -m iprange --src-range 192.168.1.64-192.168.1.127 -m state --state NEW -j ACCEPT -m comment --comment "Enable MySQL Server::"
sudo iptables -A INPUT -p udp --dport 137  -m iprange --src-range 192.168.1.64-192.168.1.127 -m state --state NEW -j ACCEPT -m comment --comment "Enable Samba Share::"
sudo iptables -A INPUT -p udp --dport 138  -m iprange --src-range 192.168.1.64-192.168.1.127 -m state --state NEW -j ACCEPT -m comment --comment "Enable Samba Share::"
sudo iptables -A INPUT -p tcp --dport 139  -m iprange --src-range 192.168.1.64-192.168.1.127 -m state --state NEW -j ACCEPT -m comment --comment "Enable Samba Share::"
sudo iptables -A INPUT -p tcp --dport 445  -m iprange --src-range 192.168.1.64-192.168.1.127 -m state --state NEW -j ACCEPT -m comment --comment "Enable Samba Share::"
sudo iptables -A INPUT -p tcp --dport 5800 -m iprange --src-range 192.168.1.64-192.168.1.127 -m state --state NEW -j ACCEPT -m comment --comment "Enable VNC Input::"
sudo iptables -A INPUT -p tcp --dport 5900 -m iprange --src-range 192.168.1.64-192.168.1.127 -m state --state NEW -j ACCEPT -m comment --comment "Enable VNC Input::"
sudo iptables -A INPUT -p tcp --dport 6000 -m iprange --src-range 192.168.1.64-192.168.1.127 -m state --state NEW -j ACCEPT -m comment --comment "Enable VNC Input::"
sudo iptables -A INPUT -j DROP -m comment --comment "Drop Everything Else::"

You will need to change the above rules based on what you are doing. For instance we're running Apache2 website on port 80, and mySQL, and Samba, which you may not need. There is a lot written on iptables and I'm not an expert. After setting this up and testing that everything you need still works we'll update iptables-persistent.

But first ad rules for ip6. First see what rules you have that you might want to keep. Write them down if you don't know.
sudo ip6tables -S

Delete existing ip6 INPUT rules.
sudo ip6tables -F INPUT

Add new rules. Mine are simple I only allow loopback and drop everything else. Someday when we're using ip6 we might need to change these.

sudo ip6tables -A INPUT -i lo -j ACCEPT  -m comment  --comment "Enable Loopback::"
sudo ip6tables -A INPUT -j DROP  -m comment --comment "Drop Everything Else::"

Note to print your rules out I use either sudo iptables -S or sudo iptables -L --line-numbers. For ip6 rules we use sudo ip6tabls -S or sudo ip6tables -L --line-numbers

Lastly after verifying we like the new rules we save them. Otherwise reboot and your old rules are reapplied and you get to start over.

`sudo service iptables-persistent save`

Now its safe to re-enable remote control using Desktop Sharing Preferences. Search again for remote, select Desktop Sharing, then Allow other users to view your desktop, Allow other users to control your desktop. I recommend require confirmation, and a password, and disable automatically configuring UUPnP router. Then Always show notification icon.

Lastly we should do something with our 32GB .xsession-errors file. Note after the reboot it might be renamed to .xsession-errors.old. You can check from the terminal ls -l .xs* will list any files starting in .xs and show you how big they are. rm .xsession-errors.old will get rid of the file. But then you loose the ip addresses of the guys trying to break in. Which I might want to know some day.

Lastly vnc runs using vino-server. From the terminal, cntrl alt t, the command ps aux | grep vino will list /usr/lib/vino/vino-server if it is running.

I don't know yet if I've broken something else we need. And probably won't know until then.

Good luck. (Just in case you are reading this next century and still think its relevant. Today's date is May 18,2016. I'm working with Ubuntu 12.04.05 LTS. We have less than a year left before having to update.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.