Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

PC-A: the local machine, from where i want to see the remote machine [Fedora]
PC-B: the remote machine, where the vnc server will be [Ubuntu]
install a vnc client [from where you want to connect] on PC-A

yum -y install vinagre

ssh to the target machine [from PC-A to PC-B], then: [if PC-B is behind NAT, then port forward the ssh port!]
with root on PC-B
you will need the "universe" repositories [ vi /etc/apt/sources.list ]

apt-get update; apt-get -y upgrade; apt-get install -y tightvncserver
exit

with the normal user still on PC-B

tightvncserver give a very-very-very good password!!
echo 'gnome-session &' >> ~/.vnc/xstartup

if you need help with the port forwarding rule in you're OpenWrt router [tested on 10.03]
add the port forward rules

iptables -t nat -I prerouting_wan -p tcp --dport 22 -j DNAT --to REMOTE-PC-B-PRIVATE-IPADDRESS:22
iptables -I forwarding_wan -p tcp --dport 22 -d REMOTE-PC-B-PRIVATE-IPADDRESS -j ACCEPT

delete the port forward rules

iptables -t nat -D prerouting_wan -p tcp --dport 22 -j DNAT --to REMOTE-PC-B-PRIVATE-IPADDRESS:22
iptables -D forwarding_wan -p tcp --dport 22 -d REMOTE-PC-B-PRIVATE-IPADDRESS -j ACCEPT

keep in mind that the vnc traffic in unencrypted! So ssh tunnel to the target machine [from PC-A to PC-B]

ssh -f -L 5901:localhost:5901 USERNAME@REMOTE-PC-B-PUBLIC-IPADDRESS -N -p 22

then connect with vinagre: "127.0.0.1:5901" on PC-A

p.s.: if you press the "d" key, and it has an effect like "show desktop", then press "ALT+F2" then type: "gnome-keybinding-properties"

important: remove vnc on target side after you have finished!!

pkill vnc
apt-get purge -y tightvncserver


HERE comes the QUESION: is this howto secure enough? Does the VNC connection really goes through only the SSH tunnel?

share|improve this question

3 Answers 3

up vote 6 down vote accepted

If you are connecting to localhost (127.0.0.1) on an ssh forwarded port (the 5901 your forwarded), then yes your connection to the remote host is encrypted.

share|improve this answer

Bear in mind that any local apps which are able to connect to localhost will have no barrier to attacking the listening vnc service, so at a minimum still ensure vnc auth remains enabled.

share|improve this answer

If you want to make 100% sure it's secure make sure that the only open port on your remote host is port 22, the SSH port. You definitely don't want to see anything on ports 59xx. If they are open then someone can connect directly to VNC. Always use nmap or some other port scanner to verify your open ports when you make firewall changes:

nmap ip_of_your_remote_host

or

nmap -PN -p 22,5900-5999 ip_of_your_remote_host
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.