How to use VNC with SSH tunnel - "is this howto secure"?

Question

PC-A: the local machine, from where i want to see the remote machine [Fedora]
PC-B: the remote machine, where the vnc server will be [Ubuntu]
install a vnc client [from where you want to connect] on PC-A

yum -y install vinagre

ssh to the target machine [from PC-A to PC-B], then: [if PC-B is behind NAT, then port forward the ssh port!]
with root on PC-B
you will need the "universe" repositories [ vi /etc/apt/sources.list ]

apt-get update; apt-get -y upgrade; apt-get install -y tightvncserver
exit

with the normal user still on PC-B

tightvncserver give a very-very-very good password!!
echo 'gnome-session &' >> ~/.vnc/xstartup

if you need help with the port forwarding rule in you're OpenWrt router [tested on 10.03]
add the port forward rules

iptables -t nat -I prerouting_wan -p tcp --dport 22 -j DNAT --to REMOTE-PC-B-PRIVATE-IPADDRESS:22
iptables -I forwarding_wan -p tcp --dport 22 -d REMOTE-PC-B-PRIVATE-IPADDRESS -j ACCEPT

delete the port forward rules

iptables -t nat -D prerouting_wan -p tcp --dport 22 -j DNAT --to REMOTE-PC-B-PRIVATE-IPADDRESS:22
iptables -D forwarding_wan -p tcp --dport 22 -d REMOTE-PC-B-PRIVATE-IPADDRESS -j ACCEPT

keep in mind that the vnc traffic in unencrypted! So ssh tunnel to the target machine [from PC-A to PC-B]

ssh -f -L 5901:localhost:5901 USERNAME@REMOTE-PC-B-PUBLIC-IPADDRESS -N -p 22

then connect with vinagre: "127.0.0.1:5901" on PC-A

p.s.: if you press the "d" key, and it has an effect like "show desktop", then press "ALT+F2" then type: "gnome-keybinding-properties"

important: remove vnc on target side after you have finished!!

pkill vnc
apt-get purge -y tightvncserver

HERE comes the QUESION: is this howto secure enough? Does the VNC connection really goes through only the SSH tunnel?

Answer 1

If you are connecting to localhost (127.0.0.1) on an ssh forwarded port (the 5901 your forwarded), then yes your connection to the remote host is encrypted.

Answer 2

Bear in mind that any local apps which are able to connect to localhost will have no barrier to attacking the listening vnc service, so at a minimum still ensure vnc auth remains enabled.

Answer 3

If you want to make 100% sure it's secure make sure that the only open port on your remote host is port 22, the SSH port. You definitely don't want to see anything on ports 59xx. If they are open then someone can connect directly to VNC. Always use nmap or some other port scanner to verify your open ports when you make firewall changes:

nmap ip_of_your_remote_host

or

nmap -PN -p 22,5900-5999 ip_of_your_remote_host