Share your Linux desktop with x11vnc

x11vnc is a pretty useful program that you can use to share your Linux desktop with someone far away. To start x11vnc while using X11 windows, issue the following command:

x11vnc -display :0

This command will work in most cases, assuming there is only one instance of X11 Windows server running. However, the display number could be different. To be sure, type the following command:

xdpyinfo | head

x11vnc will output a lot of information, including the port number it runs on:

The VNC desktop is:      bootcd:2
PORT=5902

Subtracting 5900 from the port number (5902), you'll get the display number (2). Use this number to connect to your desktop remotely. I use gvncviewer.

gvncviewer 192.168.200.83:2

Administrator To Monitor Someone's Desktop with X11VNC

Let's assume that you are a system administrator with root privilege and want to monitor a user's X11 Windows desktop. You can't just run “x11vnc -display :0” because you are not the user currently using display :0. In that case, you need access to the X11 Windows' xauth file which is located at one of the following locations:

• /var/lib/gdm
  
• /var/lib/kdm
  
• /var/lib/xdm/authdir/authfiles
  
• /home/USER/.Xauthority
  

Once you locate the xauth file associated with the user's X11 desktop, you can use x11vnc to monitor his desktop activity.

x11vnc -display :0 -auth /var/lib/gdm/\:0.Xauth

Then, on your desktop as administrator, connect to the user's desktop with a vnc client.

gvncviewer 192.168.200.83:2

x11vnc with SSL

x11vnc supports various connection schemes, including SSL. On Debian and Ubuntu, type the following command to create a SSL certificate for use with x11vnc.

cat /etc/ssl/private/ssl-cert-snakeoil.key /etc/ssl/certs/ssl-cert-snakeoil.pem > /tmp/x11vnc.pem

Then, start x11vnc with -ssl option to run x11vnc in secure mode.

x11vnc -display :0 -auth /var/lib/gdm/\:0.Xauth -ssl /tmp/x11vnc.pem

ssvnc and gvncviewer can be used to connect to x11vnc via SSL connection. The following example command starts x11vnc in anonymous SSL mode that doesn't require X509 exchange.

x11vnc -display :0 -xauth /var/lib/xdm/authdir/authfiles/A\:0-R2x5Db -xkb -nopw -nc_cr -ssl /tmp/x11vnc.pem -vencrypt newdh:nox509:support

VNC4 vs TightVNC

A frequent question people have when setting up and using VNC is what differences are there between VNC4 and TightVNC. These differences are summarized in the table below.

	VNC4	TightVNC
Developer	RealVNC Limited	TightVNC.com
License	Only free edition is open-source	Open-source
Platfrom	Windows, Linux	Windows, Linux
Installed Size	4648 KB	1432 KB
Linux Dependencies	libsm6, libstdc++6, libxext6, zlib1g	libxext6, libjpeg62, zlib1g
Supported Encodings	ZRLE, Hextile, Raw	copyrect, tight, hextile, zlib, corre, rre, raw
Inetd supported mode	Wait, Nowait	Nowait
Shared Sessions from Inetd	Shared, Non-shared	Non-shared

Manually Starting a VNC Server

Manually starting a VNC server is necessary for testing VNC. Once you got VNC to work correctly, you can copy the command line to a script or inetd.conf. First, I created an executable script ~/.vnc/xstartup with the following contents:

#!/bin/sh

exec /etc/X11/Xsession

This file has to be made executable, of course. Prior to starting vnc4server, make sure your X session can start normally by checking your ~/.xsession file. My .xsession file looks like this:

#!/bin/sh

exec openbox

Then, I started vnc4server:

vnc4server -geometry 800x600 -depth 16 -name VNC4

The first time you run vnc4server, it will ask you for the password. Create a password that only you can guess and memorize it. Next, I installed TightVNC U3 package on my Sandisk U3 flash. I went over to another PC running Windows and plugged in my USB flash. The U3 menu popped up and I clicked on the TightVNC icon. Then, I specified the address of my Linux box running vnc4server:

192.168.1.234:1 or

192.168.1.234::5901

After I was done with vnc session, I killed the vnc4server with the following command:

vnc4server -kill :1

When vnc sessions don't seem working, check the log file: ~/.vnc/*.log

Related Posts

• Remote Desktop Session with VNC4Server & TightVNC
  
• Connecting to a VNC Server through a SSH Tunnel
  

Connecting to a VNC Server through a SSH Tunnel

For security and privacy, VNC connection should be done through a SSH tunnel. Here, I am using Putty to set up a SSH Tunnel. First, type in the host name:

Next, type in the user name:

Check the following options. Also, move Blowfish up for speed:

Set up a SSH tunnel. The Source port will be the local port through which the VNC viewer will connect. The destination port is the remote port whereby the VNC server listens. Click Add button:

Save the Putty session.

Now that you set up a SSH tunnel, you can use a VNC viewer like TightVNC to connect through the SSH tunnel to the remote VNC server. For example, specify localhost::5900 as the server host to TightVNC.

Related Posts

• Remote Desktop Session with VNC4Server & TightVNC
  
• Manually Starting a VNC Server
  

Remote Desktop Session with VNC4Server & TightVNC

We are in a computing era in which we run applications from a remote computer or server. There are many ways for us to have remote desktop sessions. RDP, NX and VNC all are protocols designed to implement remote desktops. Of those, VNC is the most used and supported. This post is about many ways of setting up and using VNC in Linux and Windows. Below I explain how I set up a VNC remote session between my Linux box and a TightVNC viewer running on a Windows PC.

Setting up Inetd to start VNC on Incoming Connections

First, I installed vnc4server on my Debian Linux box. Alternatively, I could install tightvncserver instead. TightVNC is lighter than vnc4server. Anyway, to have inetd automatically start a VNC server on incoming connections, I added the following line to my /etc/inetd.conf file. This is all one line:

5995 stream tcp,rcvbuf=64k,sndbuf=256k wait nobody:nogroup /usr/bin/Xvnc Xvnc -inetd -query localhost -once -geometry 960x600 -depth 16 -AlwaysShared -rfbauth /etc/vnc/passwd -desktop myOffice -dpi 96 -fp /usr/share/fonts/X11/Type1 -co /etc/X11/rgb

For tightvncserver, the inetd.conf line would look slightly different because tightvncserver panics when wait is used instead of nowait. This means that tightvncserver sessions can never be shared when started from inetd:

5960 stream tcp,rcvbuf=64k,sndbuf=256k nowait nobody:nogroup /usr/bin/Xvnc Xvnc -inetd -query localhost -once -geometry 960x600 -depth 16 -desktop myOffice -dpi 96 -fp /usr/share/fonts/X11/Type1 -co /etc/X11/rgb

Typical port values are in the range from 5900 to 5999. Make sure everything in the following checklist is OK for VNC to work:

• A display manager, such as gdm, kdm, xdm or wdm, must be running and set up to accept XDMCP requests. Read the sections below about setting up XDMCP for VNC sessions.
  
• A VNC password must be created and stored in the readable file /etc/vnc/passwd. To create it, run:
  
  

  vncpasswd
  
  mkdir /etc/vnc
  
  mv ~/.vnc/passwd /etc/vnc
  
  chmod 644 /etc/vnc/passwd

  
  
• At least, fixed and cursor fonts must be present in the default font paths. If not, specify the font paths with -fp parameter.
  

Tell inetd to reload settings in /etc/inetd.conf with the following command:

kill -1 $(pidof inetd)

Setting up GDM to handle VNC logins

It is rather simple to make GDM accept XDMCP requests from a VNC server. Open the file /etc/gdm/gdm.conf and add the following lines in the [XDMCP] section:

[xdmcp]

Enable=true

Port=177

DisplaysPerHost=8

The lines above enable GDM to accept logins at UDP port 177. Also, GDM is set up to accept up to 8 users from localhost. Otherwise, GDM may refuse remote logins through SSH tunnel when there are already a couple of users logged in at localhost.

For security, it is recommended to add the following line to /etc/hosts.deny:

gdm: ALL

Then, add the following line to /etc/hosts.allow:

gdm: 127.0.0.1

Setting up XDM for use with VNC

XDM is lighter than gdm or kdm, so XDM is ideal for VNC sessions where network bandwidth and CPU resource are precious. In fact, XDM can coexist with gdm or kdm. In Debian, set HEED_DEFAULT_DISPLAY_MANAGER to false in the script /etc/init.d/xdm:

[ -z "$HEED_DEFAULT_DISPLAY_MANAGER" ] && HEED_DEFAULT_DISPLAY_MANAGER=false

To set up XDM to handle VNC logins and deliver a user's desktop, XDMCP support has to be enabled first. Open the file /etc/X11/xdm/xdm-config and locate the following line:

DisplayManager.requestPort: 0

Change the number 0 to 177. Then, open the file /etc/X11/xdm/Xaccess and specify the range of addresses to allow access to XDM. Usually, it is sufficient to add only the following lines to /etc/X11/xdm/Xaccess:

localhost

127.0.0.1

Optionally, you can change the look of the login screen. Open the file /etc/X11/xdm/Xsetup and enter a command to set the background image:

#!/bin/sh

hsetroot -fill /usr/local/share/pixmaps/Repressed.jpg

You can also change the welcome line and the face image by editing the file /etc/X11/xdm/Xresources:

xlogin*greeting: Remote VNC Session

xlogin*logoFileName: /usr/share/X11/xdm/pixmaps/xorg.xpm

Using TightVNC in Windows to Run a Linux Destop

I installed TightVNC U3 package on my USB thumbdrive so I can connect to my VNC server anywhere. However, I had to tweak TightVNC a little bit to open a VNC session to my Linux desktop.

The default encoding Tight doesn't work well with vnc4server. So I had to change it to CoRRE.

Related Posts

• Manually Starting a VNC Server
  
• Connecting to a VNC Server through a SSH Tunnel