Securing VNC (fail2ban?)

[raindog308]

I use VNC so I can run some desktop apps on a VPS (chiefly Vuze and Firefox).  I'm running Debian and use vnc4server.

Unfortunately, VNC is limited to an 8-character password.  And I sometimes login and find "too many security failures" which means someone has been knocking.

I could setup fail2ban for it, but VNC doesn't write in auth.log or any system log.  It's in ~user/.vnc/hostname:X.log.  I suppose I could have fail2ban watch that log, but I'm wondering if that's the best way or if there is something easier I'm overlooking.

Does anyone have a jail.conf entry for VNC to share?

 

[WebSearchingPro]

I use VNC so I can run some desktop apps on a VPS (chiefly Vuze and Firefox).  I'm running Debian and use vnc4server.

Unfortunately, VNC is limited to an 8-character password.  And I sometimes login and find "too many security failures" which means someone has been knocking.

I could setup fail2ban for it, but VNC doesn't write in auth.log or any system log.  It's in ~user/.vnc/hostname:X.log.  I suppose I could have fail2ban watch that log, but I'm wondering if that's the best way or if there is something easier I'm overlooking.

Does anyone have a jail.conf entry for VNC to share?

the "VNC" protocol is insecure itself. Generally the recommendation is to use SSH tunneling, that adds the layer of security you are looking for as well as encapsulating the VNC protocol within SSH.

 

[Raymii]

the "VNC" protocol is insecure itself. Generally the recommendation is to use SSH tunneling, that adds the layer of security you are looking for as well as encapsulating the VNC protocol within SSH.

This. Do this. Let the vnc server listen on localhost, then tunnel via ssh (like so: ssh -L 5900:localhost:5900 user@vps). Then connect your vnc client to localhost:5900.

That's at least how I do it on my vps's with a GUI.

 

[BuyCPanel-Kevin]

Try doing "find -name AuthHosts" or something like that in the VNC directory and see if you can't limit the IP's that connect to the server.

 

[wlanboy]

Let the vnc server listen on localhost, then tunnel via ssh (like so: ssh -L 5900:localhost:5900 user@vps). Then connect your vnc client to localhost:5900.

That's at least how I do it on my vps's with a GUI.

Me too. VNS is insecure as hell.

 

[raindog308]

This. Do this. Let the vnc server listen on localhost, then tunnel via ssh (like so: ssh -L 5900:localhost:5900 user@vps). Then connect your vnc client to localhost:5900.

That's at least how I do it on my vps's with a GUI.

Months later...finally getting around to this

So I did some googling and haven't found an guides on setting this up going from a Windows client (VNC viewer) to a Linux host.  The Linux side is pretty straightforward as far as listening on localhost, but the Windows client side (tunnelling) is mysterious to me.  I've been using the RealVNC viewer and vnc4server on the Linux side.

 

[WebSearchingPro]

If you happen to be connecting with a Windows machine you can do it with putty, I don't actually have instructions on that though.

Another option for Windows connecting to linux would be xRDP.

 

[Sunshine]

It's fairly simple actually

Putty > Connection > SSH > Tunnels

Source port: 5900

Destination: 127.0.0.1:5900

Click "Add" button.

Then connect as usual with putty. Now you can connect with VNC viewer to 127.0.0.1 on your Windows machine.

(It tunnels 127.0.0.1:5900 on your Windows machine to 127.0.0.1:5900 on your Linux machine)

If you need to do this on a regular basis, then you can save the configuration to a putty profile (called a "session" in putty) along with your server IP, etc.

 

[Sunshine]

Or you could use MyEnTunnel:

Right click tray icon > Profiles > Create Profile > enter a profile name > OK

SSH server: write your IP here

Username: write your username here

Password: write your password here

Tick reconnect on failure.

Tick connect on startup.

Tunnels tab >  Local text box, write:

127.0.0.1:5900:127.0.0.1:5900

Click save. Click cancel.

Right click tray icon > Profiles > click name of your profile

Wait a little bit and the tray icon will turn green when connected.

 

[raindog308]

It's fairly simple actually

Putty > Connection > SSH > Tunnels

Source port: 5900

Destination: 127.0.0.1:5900

Click "Add" button.

Then connect as usual with putty. Now you can connect with VNC viewer to 127.0.0.1 on your Windows machine.

(It tunnels 127.0.0.1:5900 on your Windows machine to 127.0.0.1:5900 on your Linux machine)

If you need to do this on a regular basis, then you can save the configuration to a putty profile (called a "session" in putty) along with your server IP, etc.

That worked great.  Thanks!

But one followup question...if I nmap my public-facing internet address (eth0's address) I see:



Host is up (0.000049s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
443/tcp  open  https
873/tcp  open  rsync
6001/tcp open  X11:1

(SSH is on a high port not shown)

https and rsync are supposed to be open, but I sure don't want X11 listening to the Internet.  I can close it off with iptables, but I'm wondering if there is something in the vnc or X config I should change so it doesn't listen on that address?

 

[fixidixi]

My suggestion: move to nomachine/x2go. better performance, no mouse-sync problems and even more secure