Securing VNC (fail2ban?)

Discussion in 'Questions and Answers' started by raindog308, Nov 1, 2013.

  1. raindog308

    raindog308 vpsBoard Premium Member Moderator

    854
    666
    May 16, 2013
    I use VNC so I can run some desktop apps on a VPS (chiefly Vuze and Firefox).  I'm running Debian and use vnc4server.

    Unfortunately, VNC is limited to an 8-character password.  And I sometimes login and find "too many security failures" which means someone has been knocking.

    I could setup fail2ban for it, but VNC doesn't write in auth.log or any system log.  It's in ~user/.vnc/hostname:X.log.  I suppose I could have fail2ban watch that log, but I'm wondering if that's the best way or if there is something easier I'm overlooking.

    Does anyone have a jail.conf entry for VNC to share?
     
  2. WebSearchingPro

    WebSearchingPro VPS Peddler Verified Provider

    493
    143
    May 15, 2013
    the "VNC" protocol is insecure itself. Generally the recommendation is to use SSH tunneling, that adds the layer of security you are looking for as well as encapsulating the VNC protocol within SSH.
     
  3. Raymii

    Raymii New Member

    114
    43
    Jun 22, 2013
    This. Do this. Let the vnc server listen on localhost, then tunnel via ssh (like so: ssh -L 5900:localhost:5900 [email protected]). Then connect your vnc client to localhost:5900.

    That's at least how I do it on my vps's with a GUI.
     
  4. BuyCPanel-Kevin

    BuyCPanel-Kevin New Member Verified Provider

    121
    23
    Oct 7, 2013
    Try doing "find -name AuthHosts" or something like that in the VNC directory and see if you can't limit the IP's that connect to the server.
     
  5. wlanboy

    wlanboy Content Contributer

    2,125
    1,169
    May 16, 2013
    Me too. VNS is insecure as hell.
     
  6. raindog308

    raindog308 vpsBoard Premium Member Moderator

    854
    666
    May 16, 2013
    Months later...finally getting around to this :)

    So I did some googling and haven't found an guides on setting this up going from a Windows client (VNC viewer) to a Linux host.  The Linux side is pretty straightforward as far as listening on localhost, but the Windows client side (tunnelling) is mysterious to me.  I've been using the RealVNC viewer and vnc4server on the Linux side.
     
  7. WebSearchingPro

    WebSearchingPro VPS Peddler Verified Provider

    493
    143
    May 15, 2013
    If you happen to be connecting with a Windows machine you can do it with putty, I don't actually have instructions on that though.

    Another option for Windows connecting to linux would be xRDP.
     
  8. Sunshine

    Sunshine New Member

    31
    13
    May 15, 2013
    It's fairly simple actually :)

    Putty > Connection > SSH > Tunnels

    Source port: 5900

    Destination: 127.0.0.1:5900

    Click "Add" button.

    Then connect as usual with putty. Now you can connect with VNC viewer to 127.0.0.1 on your Windows machine.

    (It tunnels 127.0.0.1:5900 on your Windows machine to 127.0.0.1:5900 on your Linux machine)

    If you need to do this on a regular basis, then you can save the configuration to a putty profile (called a "session" in putty) along with your server IP, etc.
     
    Last edited by a moderator: Dec 12, 2013
    raindog308 likes this.
  9. Sunshine

    Sunshine New Member

    31
    13
    May 15, 2013
    Or you could use MyEnTunnel:

    Right click tray icon > Profiles > Create Profile > enter a profile name > OK

    SSH server: write your IP here

    Username: write your username here

    Password: write your password here

    Tick reconnect on failure.

    Tick connect on startup.

    Tunnels tab >  Local text box, write:

    127.0.0.1:5900:127.0.0.1:5900

    Click save. Click cancel.

    Right click tray icon > Profiles > click name of your profile

    Wait a little bit and the tray icon will turn green when connected.
     
    Last edited by a moderator: Dec 12, 2013
  10. raindog308

    raindog308 vpsBoard Premium Member Moderator

    854
    666
    May 16, 2013
    That worked great.  Thanks!

    But one followup question...if I nmap my public-facing internet address (eth0's address) I see:



    Host is up (0.000049s latency).
    Not shown: 996 closed ports
    PORT     STATE SERVICE
    443/tcp  open  https
    873/tcp  open  rsync
    6001/tcp open  X11:1

    (SSH is on a high port not shown)

    https and rsync are supposed to be open, but I sure don't want X11 listening to the Internet.  I can close it off with iptables, but I'm wondering if there is something in the vnc or X config I should change so it doesn't listen on that address?
     
  11. fixidixi

    fixidixi New Member

    307
    71
    May 17, 2013
    My suggestion: move to nomachine/x2go. better performance, no mouse-sync problems and even more secure :)