VNC: Virtual Network Computing

VNC is a set of programs available under a number of operating systems that allows for the network sharing of a single desktop by a number of users. Any application that can be run on the desktop can be manipulated by any of the parties, or changes can be restricted to be controlled by a single user. The programs implement what is often referred to as "application sharing".

Security

The session password for a VNC connection does not go out over the Internet, but the traffic generated by the session itself is not encrypted and, therefore, is susceptible to sniffing, hijacking and having commands inserted into the stream. It is therefore recommended that an ssh tunnel be used to encrypt the session traffic. The documents on VNC through an ssh tunnel (Making VNC secure using SSH) indicate that by using the compression feature of ssh, the response of the session may be faster using ssh than when not using it. This statement is probably true as long as the CPU overhead for encryption-compression/decompression-decryption is reasonable for the machines being used, but the ssh documentation appears to indicate that compression is only available with protocol 1.

• Getting the Software
• VNC Server on Linux
• VNC Server on Windows
• VNC Client on Linux
• VNC Client on Windows
• VNC Java Client
• Multiple ssh Tunnels

The software is available from RealVNC and is available for:

• Windows 9x/2000/NT/XP (x86)
• Linux (x86)
• Solaris 2.5 (SPARC)

In addition, versions for other operating systems are available from a UK site (on the above link, click on "Click here for other platforms" on the right side of the window).

VNC Server

The VNC Server under Linux is called Xvnc, but it is usually started with the vncserver script. The first time the server script is run, you will be asked for a number of items, including a "session password". This password is used to authenticate users to the sessions handled by the server and needs to be communicated to the participants prior to their accessing the VNC session.

Use the -alwaysshared option to allow multiple simultaneous clients to connect to the server.

To start the server using display 1, use the following:
 
vncserver -alwaysshared :1
 

Since a VNC server running on a Windows machine makes the entire Windows desktop available to the session participants, some people may not want to run the server on a Windows machine. In contrast, the Linux server starts a fresh desktop with only the application desired in it.

When the VNC server is installed under Windows, you are given the option of making it a system service. If it is made a service, then it will start when Windows starts. If it is not made a service, then the server must be started manually.

During installation, you will be prompted for a session password.

The Windows VNC client is not intended to run on the same Windows machine as the VNC server. Since the entire desktop is shared under windows, running the client on the server machine will open a window with the entire desktop in it, which, in turn will have a window in it containing the entire desktop, ad infinitum. This is similar to aiming a video camera at the monitor displaying the video camera's image.

To run a VNC client through an ssh tunnel makes it look like the client is on the same machine as the server, but, of course, the display is not. One then has to change the VNC server configuration to allow clients on the local machine. Unfortunately, one has to edit the Windows Registry to enable the server's "loop-back" feature. The procedure follows:

• Run "regedit" and go to
   
  HKEY_LOCAL_MACHINE\Software\ORL\WinVNC3
   
  The only entry there should be "default"
• Click on the right hand window to activate it
• Pull down the "Edit" menu and click on "New → DWORD value"
• Set the key (the highlighted box) to "AllowLoopback"
• Right click on the new key and select "Modify"
• Set the "value data" to 1 and click the OK button
• Exit regedit

When you next start the VNC server, it will allow tunneled connections from the local machine.

VNC Client

VNC uses port 5900 + display number for its connection, so to use the recommended ssh tunnel for the VNC client to connect to the server one does the following (assuming that the server is running with display number 1):

• If the VNC Server is running on a Linux machine or it is running on a Windows machine that is also running sshd, then setup a tunnel from client machine to server machine with:
   
  ssh -L 5901:localhost:5901 <user>@<server.name>
   
  
• Start the client with
   
  vncviewer localhost:1
   
  
• If the server was not started with the -alwaysshared option, then you should add the -shared option to the above
• If the VNC Server is running on a Windows machine that does not have sshd running on it, then you will have to open a "remote" tunnel from the Windows machine running the Server. (The following instructions are for PuTTY, adjust accordingly.)
  • After entering the address of the client machine, go to the "Tunnels" section under SSH.
  • Enter 5901 in the "Source port" box under the "Add new forwarded port" section.
  • Enter "localhost:5901" in the "Destination" box
  • Toggle the "Remote" radio button on
  • Click the "Add" button and the information should appear in the "Forwarded ports:" box.
  • One can now initiate the connection by pressing the "Open" button
  • Once the connection is established, on the client machine enter
     
    vncviewer -shared localhost:1
     
    and the client should start

VNC uses port 5900 + display number for its connection, so to use the recommended ssh tunnel for the VNC client to connect to the server one does the following (assuming that the server is running with display number 1):

• If the VNC Server is running on a Linux machine or it is running on a Windows machine that is also running sshd, then setup a tunnel from client machine to server machine with: (The following instructions are for PuTTY, adjust accordingly.)
  • After entering the address of the client machine, go to the "Tunnels" section under SSH.
  • Enter 5901 in the "Source port" box under the "Add new forwarded port" section.
  • Enter "localhost:5901" in the "Destination" box
  • Make sure that the "Local" radio button is selected
  • Click the "Add" button and the information should appear in the "Forwarded ports:" box.
  • One can now initiate the connection by pressing the "Open" button
  • Once the connection is established, the VNC client can be started from the Windows menu (use display 1)
• If the VNC Server is running on a Windows machine that is not running an sshd, then you will have to setup sshd on the client machine and setup a remote tunnel from the Windows VNC Server machine. The procedure on the Windows Server machine is (again, these are instructions for PuTTY):
  • After entering the address of the client machine, go to the "Tunnels" section under SSH.
  • Enter 5901 in the "Source port" box under the "Add new forwarded port" section.
  • Enter "localhost:5901" in the "Destination" box
  • Toggle the "Remote" radio button on
  • Click the "Add" button and the information should appear in the "Forwarded ports:" box.
  • One can now initiate the connection by pressing the "Open" button
  When this is done you can start the VNC client from the Windows Start menu pointing it at the localhost.

The Java client associated with the VNC Server is started by connecting to port 5800 + display number on the Server machine. Again, one wants to make the connection through an ssh tunnel, so one adds the tunnel to your ssh connection tunneling the 59xx port. On a linux machine you would use multiple -L options as (again assuming display 1)
 
ssh -L 5901:localhost:5901 -L 5801:localhost:5801 <user>@<server.name>
 
and then pointing your Java enabled browser at "http://localhost:5801"

On a Windows machine, you would add the second tunnel on the "Tunnels" page of the PuTTY setup, for example. When the connection was established, you would start the java client by pointing your browser at "http://localhost:5801"

ssh tunnels can be chained together to get past gateway machines, for example. One sets up a tunnel on the intermediate machine to some random port number > 1024 and then sets up a tunnel from the intermediate machine forwarding the chosen port to the destination machine and the appropriate port there. For example the the first tunnel would be:
 
ssh -L 5901:localhost:4321 <user>@<gateway.machine>
 
and then on the gateway machine
 
ssh -L 4321:localhost:5901 <user>@<server.machine>