• 0

Securing VNC (fail2ban?)

Question

Posted

I use VNC so I can run some desktop apps on a VPS (chiefly Vuze and Firefox).  I'm running Debian and use vnc4server.

 

Unfortunately, VNC is limited to an 8-character password.  And I sometimes login and find "too many security failures" which means someone has been knocking.

 

I could setup fail2ban for it, but VNC doesn't write in auth.log or any system log.  It's in ~user/.vnc/hostname:X.log.  I suppose I could have fail2ban watch that log, but I'm wondering if that's the best way or if there is something easier I'm overlooking.

 

Does anyone have a jail.conf entry for VNC to share?

Share this post


Link to post
Share on other sites

10 answers to this question

  • 0

Posted

I use VNC so I can run some desktop apps on a VPS (chiefly Vuze and Firefox).  I'm running Debian and use vnc4server.

 

Unfortunately, VNC is limited to an 8-character password.  And I sometimes login and find "too many security failures" which means someone has been knocking.

 

I could setup fail2ban for it, but VNC doesn't write in auth.log or any system log.  It's in ~user/.vnc/hostname:X.log.  I suppose I could have fail2ban watch that log, but I'm wondering if that's the best way or if there is something easier I'm overlooking.

 

Does anyone have a jail.conf entry for VNC to share?

 

 

the "VNC" protocol is insecure itself. Generally the recommendation is to use SSH tunneling, that adds the layer of security you are looking for as well as encapsulating the VNC protocol within SSH.

Share this post


Link to post
Share on other sites
  • 0

Posted

the "VNC" protocol is insecure itself. Generally the recommendation is to use SSH tunneling, that adds the layer of security you are looking for as well as encapsulating the VNC protocol within SSH.

 

This. Do this. Let the vnc server listen on localhost, then tunnel via ssh (like so: ssh -L 5900:localhost:5900 user@vps). Then connect your vnc client to localhost:5900.

 

That's at least how I do it on my vps's with a GUI.

Share this post


Link to post
Share on other sites
  • 0

Posted

Try doing "find -name AuthHosts" or something like that in the VNC directory and see if you can't limit the IP's that connect to the server.

Share this post


Link to post
Share on other sites
  • 0

Posted

Let the vnc server listen on localhost, then tunnel via ssh (like so: ssh -L 5900:localhost:5900 user@vps). Then connect your vnc client to localhost:5900.

 

That's at least how I do it on my vps's with a GUI.

Me too. VNS is insecure as hell.

Share this post


Link to post
Share on other sites
  • 0

Posted

This. Do this. Let the vnc server listen on localhost, then tunnel via ssh (like so: ssh -L 5900:localhost:5900 user@vps). Then connect your vnc client to localhost:5900.

 

That's at least how I do it on my vps's with a GUI.

 

Months later...finally getting around to this :-)

 

So I did some googling and haven't found an guides on setting this up going from a Windows client (VNC viewer) to a Linux host.  The Linux side is pretty straightforward as far as listening on localhost, but the Windows client side (tunnelling) is mysterious to me.  I've been using the RealVNC viewer and vnc4server on the Linux side.

Share this post


Link to post
Share on other sites
  • 0

Posted

If you happen to be connecting with a Windows machine you can do it with putty, I don't actually have instructions on that though.

 

Another option for Windows connecting to linux would be xRDP.

Share this post


Link to post
Share on other sites
  • 0

Posted (edited)

It's fairly simple actually :)

 

Putty > Connection > SSH > Tunnels

 

Source port: 5900

Destination: 127.0.0.1:5900

 

Click "Add" button.

 

Then connect as usual with putty. Now you can connect with VNC viewer to 127.0.0.1 on your Windows machine.

 

(It tunnels 127.0.0.1:5900 on your Windows machine to 127.0.0.1:5900 on your Linux machine)

 

If you need to do this on a regular basis, then you can save the configuration to a putty profile (called a "session" in putty) along with your server IP, etc.

Edited by Sunshine
1 person likes this

Share this post


Link to post
Share on other sites
  • 0

Posted (edited)

Or you could use MyEnTunnel:

 

Right click tray icon > Profiles > Create Profile > enter a profile name > OK

 

SSH server: write your IP here

Username: write your username here

Password: write your password here

 

Tick reconnect on failure.

Tick connect on startup.

 

Tunnels tab >  Local text box, write:

 

127.0.0.1:5900:127.0.0.1:5900

 

Click save. Click cancel.

 

Right click tray icon > Profiles > click name of your profile

 

Wait a little bit and the tray icon will turn green when connected.

Edited by Sunshine

Share this post


Link to post
Share on other sites
  • 0

Posted

It's fairly simple actually :)

 

Putty > Connection > SSH > Tunnels

 

Source port: 5900

Destination: 127.0.0.1:5900

 

Click "Add" button.

 

Then connect as usual with putty. Now you can connect with VNC viewer to 127.0.0.1 on your Windows machine.

 

(It tunnels 127.0.0.1:5900 on your Windows machine to 127.0.0.1:5900 on your Linux machine)

 

If you need to do this on a regular basis, then you can save the configuration to a putty profile (called a "session" in putty) along with your server IP, etc.

 

That worked great.  Thanks!

 

But one followup question...if I nmap my public-facing internet address (eth0's address) I see:

 

Host is up (0.000049s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
443/tcp  open  https
873/tcp  open  rsync
6001/tcp open  X11:1

(SSH is on a high port not shown)

 

https and rsync are supposed to be open, but I sure don't want X11 listening to the Internet.  I can close it off with iptables, but I'm wondering if there is something in the vnc or X config I should change so it doesn't listen on that address?

Share this post


Link to post
Share on other sites
  • 0

Posted

My suggestion: move to nomachine/x2go. better performance, no mouse-sync problems and even more secure :)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now