vnc - dwilson2547/wiki_demo GitHub Wiki

• 1. What is VNC?
• 2. How VNC Works
  • 2.1. VNC Architecture
  • 2.2. Connection Process
• 3. VNC Components
  • 3.1. VNC Server
  • 3.2. VNC Client (Viewer)
  • 3.3. RFB Protocol
• 4. Setting Up VNC
  • 4.1. Install VNC Server (Linux)
    • Ubuntu/Debian:
    • RHEL/CentOS:
  • 4.2. Configure VNC Server
  • 4.3. Configure VNC to Start as a Service
    • Systemd (Ubuntu/Debian):
  • 4.4. Connect to VNC Server
    • From Linux/macOS:
    • From Windows:
• 5. Securing VNC
  • 5.1. Use SSH Tunneling
  • 5.2. Restrict Access by IP
  • 5.3. Use Strong Passwords
  • 5.4. Disable Unused Displays
  • 5.5. Use TLS Encryption
• 6. VNC vs. RDP vs. SSH
• 7. Common VNC Clients and Servers
• 8. Troubleshooting VNC
  • 8.1. Connection Refused
  • 8.2. Black Screen or Frozen Display
  • 8.3. Authentication Failed
  • 8.4. Slow Performance
  • 8.5. Cannot Connect via SSH Tunnel
• 9. Advanced VNC Features
  • 9.1. File Transfer
  • 9.2. Clipboard Sharing
  • 9.3. Multiple Monitors
  • 9.4. VNC over the Internet
  • 9.5. Headless VNC Server
• 10. VNC Security Best Practices
• 11. VNC Alternatives
• 12. Summary

VNC (Virtual Network Computing) is a graphical desktop-sharing system that allows you to remotely control another computer over a network. It transmits the keyboard and mouse inputs from the client to the server and updates the display from the server to the client in real-time. VNC is platform-independent, meaning you can control a Linux machine from Windows, macOS, or even a mobile device.

VNC operates on the RFB (Remote Frame Buffer) protocol, which is optimized for remote display. Here’s how it works:

• VNC Server: Runs on the machine you want to control. It captures the screen, accepts input, and sends updates to the client.
• VNC Client (Viewer): Runs on the machine you’re using to control the server. It sends keyboard/mouse inputs and displays the remote screen.
• RFB Protocol: The protocol used to transmit input and display updates between the server and client.

1. Initiate Connection:

   • The VNC client connects to the VNC server on a specified port (default: 5900 + display number, e.g., 5901 for display :1).
   • Example: vncviewer server-ip:5901

2. Authentication:

   • The server prompts the client for a password or other authentication method (e.g., SSH tunneling).

3. Session Establishment:

   • Once authenticated, the server starts sending screen updates to the client.
   • The client sends keyboard and mouse inputs to the server.

4. Real-Time Interaction:

   • The server updates the client’s display in real-time as changes occur (e.g., window movements, typing).

• Purpose: Hosts the remote desktop session.
• Examples:
  • TigerVNC: vncserver (Linux)
  • RealVNC: vncserver-x11 (Linux/Windows)
  • TightVNC: tightvncserver (Windows/Linux)
• Configuration:
  • Set a password: vncpasswd
  • Start the server: vncserver :1 -geometry 1920x1080 -depth 24
  • Kill the server: vncserver -kill :1

• Purpose: Connects to the VNC server to control it.
• Examples:
  • TigerVNC Viewer: vncviewer server-ip:5901
  • RealVNC Viewer: GUI-based client for Windows/macOS.
  • Remmina: Linux client with RDP/VNC support.
• Usage:

  vncviewer 192.168.1.100:5901

• Purpose: Transmits input and display updates between client and server.
• Features:
  • Efficient: Only transmits changes to the screen (not the entire display).
  • Cross-Platform: Works on any OS with a VNC client/server.
  • Extensible: Supports extensions for features like file transfer or clipboard sharing.

sudo apt update
sudo apt install tigervnc-standalone-server tigervnc-common

sudo yum install tigervnc-server

1. Set a Password:

   vncpasswd

   • Prompts you to set a password for VNC access.

2. Start the VNC Server:

   vncserver :1 -geometry 1920x1080 -depth 24

   • Starts a VNC server on display :1 with a resolution of 1920x1080 and 24-bit color.

3. Kill the VNC Server:

   vncserver -kill :1

1. Create a systemd service file:

   sudo nano /etc/systemd/system/[email protected]

   Add the following (adjust User and ExecStart):

   [Unit]
   Description=Start TigerVNC server at startup
   After=syslog.target network.target
   
   [Service]
   Type=simple
   User=yourusername
   PAMName=login
   PIDFile=/home/%u/.vnc/%H%i.pid
   ExecStartPre=/bin/sh -c '/usr/bin/vncserver -kill :%i > /dev/null 2>&1 || :'
   ExecStart=/usr/bin/vncserver :%i -geometry 1920x1080 -depth 24 -localhost no
   ExecStop=/usr/bin/vncserver -kill :%i
   
   [Install]
   WantedBy=multi-user.target

2. Enable and start the service:

   sudo systemctl daemon-reload
   sudo systemctl enable [email protected]
   sudo systemctl start [email protected]

vncviewer server-ip:5901

• Use TightVNC Viewer, RealVNC Viewer, or Remmina.
• Enter the server’s IP and port (e.g., 192.168.1.100:5901).

VNC traffic is not encrypted by default. Use SSH to create a secure tunnel:

ssh -L 5901:localhost:5901 user@server-ip

• Connect to localhost:5901 with your VNC client.

• Use a firewall (e.g., ufw or iptables) to allow VNC access only from trusted IPs:

  sudo ufw allow from 192.168.1.100 to any port 5901

• Avoid simple passwords. Use a strong, unique password for VNC access.

• Only run VNC servers on displays you need:

  vncserver -kill :2

• Some VNC servers (e.g., RealVNC) support TLS encryption. Enable it in the server configuration.

• Cause: VNC server is not running or blocked by a firewall.
• Fix:
  • Start the VNC server: vncserver :1
  • Check the firewall: sudo ufw allow 5901

• Cause: VNC server crashed or display settings are incorrect.
• Fix:
  • Restart the VNC server: vncserver -kill :1 && vncserver :1
  • Adjust resolution/color depth: vncserver :1 -geometry 1280x720 -depth 16

• Cause: Incorrect password or misconfigured authentication.
• Fix:
  • Reset the VNC password: vncpasswd
  • Check the VNC server logs for errors.

• Cause: High latency or insufficient bandwidth.
• Fix:
  • Reduce color depth: vncserver :1 -depth 16
  • Use a faster compression method (e.g., Tight or ZRLE in TigerVNC).

• Cause: SSH server is not running or misconfigured.
• Fix:
  • Start the SSH server: sudo systemctl start sshd
  • Verify the tunnel: ssh -L 5901:localhost:5901 user@server-ip

• Some VNC clients (e.g., UltraVNC) support file transfer between local and remote machines.

• Copy and paste text between local and remote machines.

• Configure VNC to span multiple monitors:

  vncserver :1 -geometry 3840x1080  # For two 1920x1080 monitors side-by-side

• Use SSH tunneling or a VPN to securely access VNC over the internet.
• Example with SSH:

  ssh -L 5901:localhost:5901 user@your-server-ip

  • Connect your VNC client to localhost:5901.

• Run a VNC server without a physical display (e.g., on a headless Raspberry Pi):

  vncserver :1 -geometry 1920x1080 -depth 24

• Use x11vnc for headless setups:

  sudo apt install x11vnc
  x11vnc -storepasswd /etc/x11vnc.pass
  x11vnc -rfbauth /etc/x11vnc.pass -foreground -o /var/log/x11vnc.log

1. Always Use SSH Tunneling:

   • Encrypts VNC traffic to prevent eavesdropping.

   ssh -L 5901:localhost:5901 user@server-ip

2. Restrict Access with Firewalls:

   • Allow VNC access only from trusted IPs.

   sudo ufw allow from 192.168.1.100 to any port 5901

3. Use Strong Passwords:

   • Avoid simple passwords. Use a password manager to generate strong passwords.

4. Disable Unused VNC Displays:

   • Kill unused VNC servers to reduce attack surface.

   vncserver -kill :2

5. Enable TLS Encryption:

   • Use VNC servers that support TLS (e.g., RealVNC).

6. Regularly Update VNC Software:

   • Keep your VNC server and client updated to patch vulnerabilities.

   sudo apt update && sudo apt upgrade tigervnc-standalone-server

7. Monitor VNC Logs:

   • Check logs for unauthorized access attempts.

   tail -f ~/.vnc/*:1.log

8. Use One-Time Passwords (OTP):

   • Integrate VNC with Google Authenticator or Duo Security for 2FA.

• VNC allows remote graphical access to a computer over a network.
• VNC Server runs on the machine you want to control; VNC Client connects to it.
• RFB Protocol transmits screen updates and inputs between client and server.
• Security is critical: Use SSH tunneling, firewalls, and strong passwords.
• Performance tips: Adjust resolution, color depth, and compression for slower connections.
• Alternatives: RDP (Windows), X2Go (Linux), or NoMachine (cross-platform).