- X11vnc
- Contents
- Setting up x11vnc
- Installation
- Starting
- Setting X authority
- Setting a password
- Running constantly
- Accessing
- SSH Tunnel
- Troubleshooting
- Screensaver problem
- IPv6 port different from IPv4 port
- Copying and Pasting
- Session closes unexpectedly
- Tips and tricks
- Run x11vnc «system-wide» in (GDM and GNOME Shell)
- Run x11vnc «system-wide» in (SDDM and Plasma)
- Change x11vnc password in each boot
- TigerVNC
- Contents
- Installation
- Running vncserver for virtual (headless) sessions
- Initial setup
- Starting and stopping tigervnc
- Expose the local display directly
- Running x0vncserver to directly control the local display
- Starting x0vncserver via xprofile
- Starting and stopping x0vncserver via systemd
- Running Xvnc with XDMCP for on demand sessions
- Connecting to vncserver
- Passwordless authentication
- Example GUI-based clients
- Accessing vncserver via SSH tunnels
- On the server
- On the client
- Connecting to a vncserver from Android devices over SSH
- Tips and tricks
- Connecting to an OSX system
- Recommended security settings
- Toggling fullscreen
- Workaround for mouse back and forward buttons not working
- Substituting mouse back/forward buttons with keyboard keys XF86Back/XF86Forward
- Mapping the keyboard key presses back to mouse button clicks on the server
- Troubleshooting
- Terminals in vncserver start in / (root dir)
- Unable to type ‘
- Black rectangle instead of window
- Empty black window with mouse cursor
- No mouse cursor
- Copying clipboard content from the remote machine
- «Authentication is required to create a color managed device» dialog when launching GNOME 3
- No window decoration / borders / titlebars / cannot move windows around
- systemd service unit run as user
X11vnc
x11vnc is a VNC server, it allows one to view remotely and interact with real X displays (i.e. a display corresponding to a physical monitor, keyboard, and mouse) with any VNC viewer. While it is not developed any longer by its original author Karl Runge, LibVNC and the GitHub community have taken over the development.
x11vnc does not create an extra display (or X desktop) for remote control. Instead, it shows in real time the existing X11 display, unlike Xvnc, part of TigerVNC, which is an alternatives VNC server available in the official repositories.
Also note that x11vnc is not shipped with a client viewer. Any VNC viewer should do the job and be compatible with the x11vnc server while not necessarily using all its functionalities. TigerVNC’s vncviewer is a recommended client.
Contents
Setting up x11vnc
Installation
Install x11vnc from the official repositories.
Starting
First, start X either by startx or through a display manager. You may need to set up X to run headless too.
Then, run the following command, all available options are explained in x11vnc(1) .
Another option is to place the x11vnc command line in a script which is called at login, for example:
Setting X authority
You may set an X authority file for the VNC server. This is accomplished by using the -auth argument followed by the appropriate file, which will depend on how your X server was started. Generally, assigning an X authority file requires running x11vnc as root.
Start X
If that fails, you may have to run instead (as root):
Where user is the username of the user who is running the X server.
Running from xinetd
X11vnc can be run using a xinetd service, which only starts X11vnc once a user connects.
Create an xinetd service entry for x11vnc, for example:
After reloading xinetd.service , X11vnc will start once a client connects to port 5900.
Systemd
To run x11vnc when system boots, create the override with systemctl edit x11vnc.service . The content should be like the following
Replace the second ExecStart with the command you run interactively. Run systemctl enable x11vnc.service if you need.
Newer versions of GDM uses /run/user. Example for user 120 (gdm), used for login screen.
or see Troubleshooting section below
Lightdm
Running from the bash:
SDDM uses an unpredictable UUID for the auth file [1] therefore one needs to:
Embedding this into a systemd .service file will require a trick to evaluate the find command as shown here [2].
Setting a password
uses the password found in
/.vnc/passwd , where the password is obscured with a fixed key in a VNC compatible format, or alternatively in
/.vnc/passwdfile , where the first line of the file contains the password. If none of these files can be located, it prompts the user for a password which is saved in
/.vnc/passwd and is used right away.
The VNC viewer should then prompt for a password when connecting.
Running constantly
By default, x11vnc will accept the first VNC session and shutdown when the session disconnects. In order to avoid that, start x11vnc with either the -many or the -forever argument, like this:
It is also possible to use the following command :
this will restart the server once the session is finished
Accessing
Get a VNC client on another computer, and type in the IP address of the computer running x11vnc. Hit connect, and you should be set.
If you are attempting to access a VNC server / computer (running x11vnc) from outside of its network then you will need to ensure that it has port 5900 forwarded.
SSH Tunnel
You need to have SSH installed and configured.
Use the -localhost flag with x11vnc for it to bind to the local interface. Once that is done, you can use SSH to tunnel the port; then, connect to VNC through SSH.
(You will likely have to provide passwords/passphrases to login from your current location into your remote_host Unix account; we assume you have a login account on remote_host and it is running the SSH server)
And then in another terminal window on your current machine run the command:
Troubleshooting
1. You can check your ip address and make sure port 5900 is forwarded by visiting this [dead link 2020-04-03 ⓘ] website.
The factual accuracy of this article or section is disputed.
2. Tested only on GNOME + GDM
If you cannot start the tunnel, and get error like XOpenDisplay(«:0») failed, Check if you have a
/.Xauthority directory. If that does not exist, You can create one easily (Actually a symlink to actual one) by running command given below as normal user NOT ROOT OR USING Sudo as below:
then try above tunneling example and it should work fine. Further if you want this to be automatically done each time Xorg is restarted, create the xprofile file & make is executable as below
3. GNOME 3 and x11vnc
If you are using GNOME 3 and x11vnc and you get the following errors
Try running x11vnc like
Please update if this works / not works for any other display manager or desktop environment.
Screensaver problem
If screensaver starts every 1-2 second, start x11vnc with -nodpms key.
IPv6 port different from IPv4 port
The default behavior for the command:
is for the server to listen to TCP port 5908 and TCP6 port 5900. For the server to listen to the same TCP6 port, also use the -rfbportv6 option to force the IPv6 listening port. For example:
Copying and Pasting
If copying and pasting does not work as expected, particularly if pasting to the remote side is not working or clipboard behaviour is not as expected, try adding -xkb :
Although the documentation does not indicate -xkb specifically for clipboard problems, it resolved an issue where vim complained that there was nothing in the * register.
Session closes unexpectedly
x11vnc enables the X Damage extension by default, which significantly reduces the load when the screen is not changing much and detects changed areas more quickly. This extension is known to cause issues[4][5][6][7], and it may cause the session to close unexpectedly with caught XIO error messages appearing at the log. This issue can be circumvented by using the -noxdamage option.
Tips and tricks
This article or section needs language, wiki syntax or style improvements. See Help:Style for reference.
Run x11vnc «system-wide» in (GDM and GNOME Shell)
Perform the following steps to run x11vnc in GDM to log in and then run x11vnc in a GNOME shell user session for a «system-wide» x11vnc:
First we need to create a systemd service to launch an x11vnc server in GDM:
This will start an x11vnc server protected by the password stored at user_home/.vnc/passwd that shows GDM to any connected VNC client, however as you may notice, if you click on any of the users, as soon as you log in, all the VNC clients will show a black screen. To fix this, we need to create another systemd service that will start another x11vnc server in the GNOME Shell session as soon as you log in:
Now, you need to keep the following in mind:
- As you may notice in the ExecStart part of the systemd service, the command that executes can be separated in two tasks: first it stops x11vnc-gdm.service (killing the GDM x11vnc server) and then it starts the x11vnc server for the user in the GNOME shell session. This is done because if you keep running the GDM x11vnc server in the background, the new x11vnc server for the user will use the next available port, and you would need to change your client connection settings to connect either to the GDM x11vnc server or for your user-specific x11vnc server. A setup like this is useful because the GDM x11vnc server stops as soon as you log in into your account.
- You need to create a service like this for each user that you want to have this functionality. (Do not forget to replace your_user and user_home with your actual username.)
- You may need to change the -display :X part of the command to match your system settings. You can view your current display by running echo $DISPLAY . Use the resulting output to match the systemd service.
Now, as you might notice, x11vnc-gnome-shell.service is executed as your (probably) unprivileged user. This presents a problem if we want to stop the x11vnc-gdm.service , so we need to allow the user to stop the GDM service. This can be accomplished using sudo, but we need to allow the execution of only that specific command without a password. This can be done as follows:
Execute visudo(8) as root:
At the end of the file, add the following line and save your changes:
Now you simply need to enable x11vnc-gdm.service and x11vnc-gnome-shell-your_user.service . When you restart your computer, both of them will start running and you can connect to your GDM and GNOME Shell using VNC.
Run x11vnc «system-wide» in (SDDM and Plasma)
To run x11vnc when the system boots into SDDM (if the aforementioned methods do not work for you), just edit x11vnc.service as follows:
Remember to change your_user in the path, or use the preferred auth method. Disable the old x11vnc.service and reload the systemd manager configuration. Reenable the x11vnc.service unit afterwards.
Change x11vnc password in each boot
A setup like this could be useful if you need to share your desktop with several people that you do not trust and if you do not want to manually change the password every time. Such a setup would generate boot-unique passwords, so if you share your password with someone, you only need to reboot your computer (or re-run the systemd service) to change the password.
The new generated password will be stored as plain text in
/.vnc/autovncpass , so it can be accessed with
To accomplish this, perform the following steps:
First install the expect package.
Then, create the following script anywhere in your home directory:
Now we need to create a systemd unit file that will execute the script at boot time:
Finally, start/enable the service to change the password. You can access the current password with
Источник
TigerVNC
TigerVNC is an implementation of the Virtual Network Computing (VNC) protocol. This article focuses on the server functionality.
Contents
Installation
Running vncserver for virtual (headless) sessions
Initial setup
For a quick start, see the steps below. Users are encouraged to read vncserver(8) for the complete list of configuration options.
- Create a password using vncpasswd which will store the hashed password in
/.vnc/passwd .
/.vnc/config and at a minimum, define the type of session desired with a line like session=foo where foo corresponds to whichever desktop environment is to run. One can see which desktop environments are available on the system by seeing their corresponding .desktop files within /usr/share/xsessions/ . For example:
Starting and stopping tigervnc
Start an instance of the vncserver@.service template and optionally enable it to run at boot time/shutdown. Note that the instance identifier in this case is the display number (e.g. instance vncserver@:1.service for display number :1 ).
Expose the local display directly
Tigervnc comes with libvnc.so which can be directly loaded during X initialization which provides better performance. Create a following file and restart X:
Running x0vncserver to directly control the local display
tigervnc also provides x0vncserver(1) which allows direct control over a physical X session. After defining a session password using the vncpasswd tool, invoke the server like so:
Starting x0vncserver via xprofile
A simple way to start x0vncserver is adding a line in one of the xprofile files such as:
Starting and stopping x0vncserver via systemd
In order to have a VNC Server running x0vncserver, which is the easiest way for most users to quickly have remote access to the current desktop, create a systemd unit as follows replacing the user and the options with the desired ones:
Running Xvnc with XDMCP for on demand sessions
One can use systemd socket activation in combination with XDMCP to automatically spawn VNC servers for each user who attempts to login, so there is no need to set up one server/port per user. This setup uses the display manager to authenticate users and login, so there is no need for VNC passwords. The downside is that users cannot leave a session running on the server and reconnect to it later.
To get this running, first set up XDMCP and make sure the display manager is running. Then create:
Use systemctl to start and enable xvnc.socket . Now any number of users can get unique desktops by connecting to port 5900.
If the VNC server is exposed to the internet, add the -localhost option to Xvnc in xvnc@.service (note that -query localhost and -localhost are different switches) and follow #Accessing vncserver via SSH tunnels. Since we only select a user after connecting, the VNC server runs as user nobody and uses Xvnc directly instead of the vncserver script, so any options in
/.vnc are ignored. Optionally, autostart vncconfig so that the clipboard works (vncconfig exits immediately in non-VNC sessions). One way is to create:
Connecting to vncserver
Any number of clients can connect to a vncserver. A simple example is given below where vncserver is running on 10.1.10.2 port 5901, or :1 in shorthand notation:
Passwordless authentication
The -passwd switch allows one to define the location of the server’s
/.vnc/passwd file. It is expected that the user has access to this file on the server through SSH or through physical access. In either case, place that file on the client’s file system in a safe location, i.e. one that has read access ONLY to the expected user.
The password can also be provided directly.
Example GUI-based clients
TigerVNC’s vncviewer also has a simple GUI when run without any parameters:
Accessing vncserver via SSH tunnels
For servers offering SSH connection, an advantage of this method is that it is not necessary to open any other port than the already opened SSH port to the outside, since the VNC traffic is tunneled through the SSH port.
On the server
On the server side, vncserver or x0vncserver must be run.
When running either one of these, it is recommended to use the localhost option in
/.vnc/config or the -localhost switch (for x0vncserver) since it allows connections from the localhost only and by analogy, only from users ssh’ed and authenticated on the box. For example:
Make sure to Start or Restart the vncserver@.service , for example (see also #Initial setup):
or for x0vncserver:
On the client
The VNC server has been setup on the remote machine to only accept local connections. Now, the client must open a secure shell with the remote machine (10.1.10.2 in this example) and create a tunnel from the client port, for instance 9901, to the remote server 5901 port. For more details on this feature, see OpenSSH#Forwarding other ports and ssh(1) .
Once connected via SSH, leave this shell window open since it is acting as the secured tunnel with the server. Alternatively, directly run SSH in the background using the -f option. On the client side, to connect via this encrypted tunnel, point the vncviewer to the forwarded client port on the localhost.
What happens in practice is that the vncviewer connects locally to port 9901 which is tunneled to the server’s localhost port 5901. The connection is established to the right port within the secure shell.
What it does is that the -f switch will make ssh go in the background, it will still be alive executing sleep 10 . vncviewer is then executed and ssh remains open in the background as long as vncviewer makes use of the tunnel. ssh will close once the tunnel is dropped which is the wanted behavior.
Alternatively, vncviewer’s -via switch provides a shortcut for the above command:
(Notice the double colon – vncviewer’s syntax is [host]:[display#] or [host]::[port] .)
Connecting to a vncserver from Android devices over SSH
To connect to a VNC server over SSH using an Android device as a client, consider having the following setup:
- SSH running on the server
- vncserver running on server (with -localhost flag for security)
- SSH client on the Android device: ConnectBot is a popular choice and will be used in this guide as an example
- VNC client on the Android device: androidVNC used here
In ConnectBot, connect to the desired machine. Tap the options key, select Port Forwards and add a port:
In androidVNC connect to the VNC port, this is the local address following the SSH connection:
Tips and tricks
Connecting to an OSX system
Recommended security settings
If not #Accessing vncserver via SSH tunnels where the identification and the encryption are handled via SSH, it is recommended to use X509Vnc, as TLSVnc lacks identity verification.
Issuing x509 certificates is beyond the scope of this guide. However, Let’s Encrypt provides an easy way to do so. Alternatively, one can issue certificates using OpenSSL, share the public key with the client and specify it with the -X509CA parameter. An example is given below the server is running on 10.1.10.2:
Toggling fullscreen
This can be done through vnc client’s menu. By default, vnc client’s mkey is F8 .
Workaround for mouse back and forward buttons not working
The VNC protocol currently only uses 7 mouse buttons (left, middle, right, scroll up, scroll down, scroll left, scroll right) which means if your mouse has a back and a forward button these are not usable and input will be ignored.
evrouter can be used to work around this limitation by sending keyboard key presses when clicking the mouse back/forward buttons. Optionally xte found in xautomation and xbindkeys can be used on the server to map the keyboard key presses back to mouse button clicks if needed.
Substituting mouse back/forward buttons with keyboard keys XF86Back/XF86Forward
This method is simple and suitable if you only need a way to navigate backward/forward while using web browsers or file browsers for example.
Install evrouter AUR and xautomation on the client. Configure evrouter, see Mouse buttons#evrouter and evrouter man pages for instructions and tips on how to find the correct device name, window name, button names etc. Example config:
Start evrouter on the client. With above configuration keyboard key XF86Back is sent to the VNC server when clicking the back button on the mouse, and XF86Forward is sent when clicking the forward button.
Mapping the keyboard key presses back to mouse button clicks on the server
If needed it’s possible to map the keyboard keys back to mouse button clicks on the server. In this case it might be a good idea to use keyboard keys which are never on the client or server. In the example below keyboard keys XF86Launch8/XF86Launch9 are used as mouse buttons 8/9.
Evrouter configuration on the client:
Install xautomation and xbindkeys on the server. Configure xbindkeys to map keyboard keys XF86Launch8/XF86Launch9 to mouse buttons 8/9 with xte.
Start xbindkeys $ xbindkeys -f
/.xbindkeysrc . The server will now map XF86Launch8/XF86Launch9 to mouse buttons 8/9.
Troubleshooting
Terminals in vncserver start in / (root dir)
Unable to type ‘
If pressing on a remote client emits the > character, try remapping the incoming key [1] [dead link 2020-04-03 ⓘ] :
Black rectangle instead of window
Most probably this is due to the application strictly requiring the composite Xorg extension. For example webkit based app: midori, psi-plus, etc.
Restart vncserver in this case using something like following:
It looks like Composite extension in VNC will work only with 24bit depth.
Empty black window with mouse cursor
Verify that the user is not logged into a physical X session, unless this option was configured with x0vncserver . Multiple X sessions for a single user are not supported, see https://github.com/TigerVNC/tigervnc/issues/684#issuecomment-494385395.
Conversely, trying to log into a local X session while a VNC server service is running for that user will likely not work, and you may get stuck on a splash screen when using a desktop environment.
No mouse cursor
If no mouse cursor is visible when using x0vncserver, start vncviewer as follows:
Alternatively, put DotWhenNoCursor=1 in the TigerVNC configuration file, which is at
/.vnc/default.tigervnc by default.
Copying clipboard content from the remote machine
If copying from the remote machine to the local machine does not work, run autocutsel on the server, as mentioned in [2]:
Now press F8 to display the VNC menu popup, and select Clipboard: local -> remote option.
«Authentication is required to create a color managed device» dialog when launching GNOME 3
A workaround is to create a «vnc» group and add the gdm user and any other users using vnc to that group. Modify /etc/polkit-1/rules.d/gnome-vnc.rules with the following[3]:
No window decoration / borders / titlebars / cannot move windows around
Start a window manager to fix an empty xterm frame. For example, on Xfce, run xfwm4 & .
systemd service unit run as user
Create the following template:
Start/enable tigervnc@:9 to run the template instance on display 9.
Источник
