Home > Linux Admin , Linux Desktop , Open Source-Free Software , Security > Remote access to desktop Linux with SSL encryption: x11vnc + SSVNC client

Remote access to the desktop Linux with SSL encryption: x11vnc + SSVNC client

In the latest versions of the GNOME desktop software is available that allows for remote access to the desktop with a simple client VNC from any other operating system. I'm talking about WINE. Although it is easy to set up, it does not guarantee a sufficiently strong encryption of data. In fact, we may be subject (for technical reasons that I'm not here to explain) to attack man-in-the-middle attack. For this reason I decided to show the configuration of another VNC server and a VNC client slightly more advanced: x11vnc (server) and SSVNC (client). All topped off with an SSL tunnel that provides us shelter from prying eyes!

First, an introduction. The guide covers the installation of the server (x11vnc) on a Debian Sid (unstable version), but the procedure is the same for Ubuntu and other Debian-based distribution with the appropriate changes to the commands to install the packages of interest. Also, it is very important to remember that after you install the server, you must open TCP port of VNC (default 5900) on the firewall you may have installed on the server. Still, to be able to conveniently access from the outside (ie from the Internet) you should evaluate for a free subscription with a service like Dyndns or no-ip that allow you to have a host name in network with our connection. At this point I would say that we are ready to start.

  1. Installing and configuring the server x11vnc + openssl

x11vnc openssl and are present in repositories of debian and ubuntu, so you can type the usual apt-get command in a terminal and logged in as user root:

# Apt-get install x11vnc openssl

The openssl package is needed to create encryption certificates to be used for remote connections protected by SSL. The next step will be to create certificates to be used for subsequent connections. I chose to use the most secure method, ie the use of a Certification Authority (hereafter CA) to sign the various certificates. In this way we will be sure to use the client side of the original certificate and not a counterfeit. Proceed with the creation of the certificate and key to our CA (be careful, you have to type these commands from a simple user and not as root!)

$ X11vnc -sslGenCA

When you have launched the command shown above, you will see that will create all the necessary dir in your home dir of the user and then you will be asked to enter a passphrase. It 'a good idea to choose a password long and difficult and if you are anxious to forget it, think about starting to use some soft of password management as those of which I have spoken on other occasions. After you type the passphrase, you will be prompted for all information regarding our CA We carry a small sample of what you'll see on the terminal, and what I've typed:

Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-
You are about to be asked to enter information That will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', The field will be left blank.
-
Country Name (2 letter code) [AU]: GB
State or Province Name (full name) [mystate]: Italy
Locality Name (eg, city) []: Power
Organization Name (eg, company) [x11vnc server CA]:
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) [zeno x11vnc server CA]:
Email Address [x11vnc@CA.nowhere]:

------------------------
Your public x11vnc CA cert is:

/home/zeno/.vnc/certs/CA/cacert.pem

It may be copied to other applications, eg Web browser, Java
Applet keystore, or stunnel cfg, to use to verify signed server
or client certs, etc.

Your x11vnc CA private key is:

/home/zeno/.vnc/certs/CA/private/cakey.pem

It will be used to sign the server or client certs, keep it secret.
------------------------

Now we are ready to proceed to the next step, namely the creation of Chavi and certificates for the VNC server. So, again from the terminal and simple user, launch the following command:

$ X11vnc server -sslGenCert

You'll find yourself having to answer some questions in a manner very similar to what happened with the previous command. It 'important for you to insert a PEM passphrase for the certificate and that's when you will be asked to insert also the passphrase used previously for the CA certificate Here is a small sample of what you will see where you have to act on the terminal and entering the passphrase:

Do you want to protect the generated private key with a passphrase?
Significantly Doing so will decrease the chances someone could steal
the key and pretend to be your x11vnc server. The downside is it is
inconvenient Because You will have to supply the passphrase every
time you start x11vnc using this key.

Protect key with a passphrase? [Y] / n
writing RSA key
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

------------------------
Now signing the new key with the CA private key. You will need to supply
the CA key passphrase and reply "y" to sign and commit the key.

Using configuration from /home/zeno/.vnc/certs/tmp/cnf.11234
Enter pass phrase for ./CA/private/cakey.pem:
Check That the request matches the signature
Signature ok

Till now we have created the keys and certificates to encrypt the connection and, therefore, there rirtoveremo with the following files in our home directory:

~ / .vnc / Certs / CA / cacert.pem -> public certificate from our CA
~ / .vnc / Certs / CA / private / cakey.pem -> the private key of our CA
~ / .vnc / Certs / server.crt -> the VNC server's public certificate
~ / .vnc / Certs / server.pem -> the private key + certificate of our VNC server

At this point we have to copy the cacert.pem file with a secure method on the pc on which we will use the VNC client. Of course I leave it to you to decide what to do, but it really is essential that this step is done in the safest way possible. Personally, I transfer it via a USB stick or through the use of scp. If you need to use the VNC client on another Linux machine, you can copy the file to the home directory of the user who will launch the client itself (~ / .vnc / certs / CA / cacert.pem). In addition, we must ensure that our CA certificate is then used by the VNC client that we will use in our case and we will see how to proceed with the client SSVNC.

We have not yet finished with the configuration of the server, we are missing the last step which consists in the creation of the password to access the server. In fact, the current state of configuration, the server is running, but is not required to use any password from the client to access and, therefore, is sufficient to obtain the certificate. Obviously this is not very secure and for this reason we insert a password to access the server:

$ X11vnc -storepasswd

The command you typed earlier you return the following prompt:

Enter VNC password:
Verify password:
Write to /home/zeno/.vnc/passwd password? [Y] / ny
Password written to: /home/zeno/.vnc/passwd

Now the server is ready to be started. To do this, we can type the following command:

$ X11vnc -usepw -ssl SAVE -display: 0

You will be prompted to enter the pass phrase chosen during the creation of the certificates of the server (the server does not CA!) And then the VNC server will be started and listening on port 5900 If you want we can choose to start the server on a different port from that standard by adding the command to start the following parameter:

-rfbport <port_number>

We finished with the server. Proceed with the installation of the client.

  1. Installation and use of client SSVNC

In reality the client for our server should not be installed :) E 'can directly download the binaries available for Windows, MAC OS and Unix / Linux. We can grab the file from here . If you want you can get the files containing the binaries of the only operating system of our interest or those containing the source code of the client by going to this page . I decided to use SSVNC also because downloading onto a USB stick all the binaries for various operating systems can access our computer desktop with any available in the world without having to install anything! ... Also for example in an Internet Cafe in London ... Obviously forewarned as stored in the encryption certificates and do not miss the USB stick!

After downloading the file of interest to us, we have to unpack and inside it, having downloaded the file with the tracks that I mentioned in the first link, we will find various folders for different operating systems. We identify what we want and we start "ssvnc." We will be facing this screen (the client was started on Win XP):

ssvnc

First click on the button "Certs ..." that allows us to open the window to enter the SSL certificate for our server to the client. Obviously, this certificate must be previously copied to the computer where you start the client, exactly as explained a moment ago when we talked about the configuration of the server. Here is the shielded region

ssvnc certs

In the row for "ServerCert" we have to load our certificate "cacert.pem". When we did that we can click on the "Done" button and return to the previous screen. Here we must first enter the IP address or hostname of the server into our line. You'll have to find yourself qulcosa like this:

Click if you want (it's not compulsory!) On the file "Fetch Cert"

And the client will connect to the server and acquire the certificate from the server:

When you finish viewing the certificate, click on "Dismiss". This last step is used to maintain control of congruity between the server certificate and the certificate that we have just uploaded manually to ensure that the server's certificate or the manually loaded on the client has been compromised. This manual control can be avoided by leaving unchecked the option to SSVNC "Verify all certs." Now I would say that it is time to start the VNC session itself. So, click on the "Connect" button and it will start trying to connect to the server:

If everything went well, in a few moments you will see the screen that asks for the password:

We enter the password you chose earlier and finally we are ready to use our Remote Desktop protected by an SSL-encrypted connection tunnel! : D

If you have questions, especially on how to access the Internet and how to configure the NAT of your router, ask!

Did you like this article? Subscribe to our newsletter to receive information about updates to the blog:


  1. August 28, 2008 at 11:58 | # 1

    This post comes right on cue!

    I was just doing the first experiments to protect the ssh vnc serverino of my home ...

    Just one question: If you do not want to use an AC adapter (use a vnc client on iphone and pass the certificate I see it hard!) But a "simple" pair of public / private key thing would change in the process?

  2. stefano
    August 28, 2008 at 12:21 | # 2

    @ IPaco:
    All the relevant part of the creation of the CA, of course, you should not follow it more. In fact, the procedure using a "simple" key pair is different and follows a path that is to create a certificate on the fly (or permanent) without signing it with the keys to the AC

    You do not have to issue the command "x11vnc -sslGenCa" and the following commands to create certificates, but you have to boot directly to the vnc server with the command "x11vnc -usepw -ssl SAVE -display: 0". This will create a certificate on the fly (only the first time, then the server will always use the same created the first time ;) ). Of course, before you start the server, create the pwd to access the VNC server!

    Keep in mind one thing ... I advised him to use the client SSVNC also because it has "embeddato" stunnel. In fact, to access the VNC server via SSL you still need to create an SSL tunnel ;)

    If you have further questions do not hesitate to ask :)

  3. stefano
    August 28, 2008 at 24:26 | # 3

    @ IPaco:
    I forgot to tell you. ... eye with the procedure without the CA you are subject to man-in-the-middle ;)

  4. UTL
    August 28, 2008 at 16:09 | # 4

    I know ke you can encrypt the connection also with ssh, k differences (security, and ease of use) are there?

  5. stefano
    August 28, 2008 at 16:35 | # 5

    @ UTL:
    Also the use of an ssh tunnel is an excellent solution. Obviously you have to configure the SSH server and well, for example, prevent access to the USER root directly, install some soft which also bans access attempts to bruteforce (fail2ban is a good software solution), in fact treat some aspects of security ssh server. Also, when you want to start the VNC server will need to tell SSH to create a tunnel with a special command and should be used for some x11vnc options to make it accessible by clients!

    Honestly, I prefer to use the method that I have described in :)

  6. Fabio
    August 29, 2008 at 13:29 | # 6

    Once again it was really enlightening, this time I was really help. Keep it up.

  7. stefano
    August 29, 2008 at 15:07 | # 7

    @ Fabio:
    thanks Fabio :)

  8. Fabio
    September 9th, 2008 at 13:59 | # 8

    I would like to ask why he chose the SSL encryption to make an encrypted tunneling, what criteria did you choose this method of encryption, and instead an ssh tunnel, or an openvpn?

    I'm very curious about the reason, why I have not ever considered the SSL technology, increasingly used openvpn to connect to your home PC from another PC and openssh to make secure connections.

  9. stefano
    September 11, 2008 at 13:53 | # 9

    @ Fabio:
    basically why I chose ssl is configured, in fact, along with x11vnc. Obviously the use of a VPN is a strategically best choice from the point of view of safety, but it means having to configure OpenVPN first and then x11vnc.
    On the choice of Openssh: that's fine if you must maneuver a server, but there are a number of risks inherent to the safety of OpenSSH (as demonstrated by the recent bug on the debian openssh known since 2006 and made public only in 2008) that, I think ssh does not make the best choice for use with VNC

  10. October 10, 2008 at 11:47 | # 10

    Beautiful, sooner or later I'll have to try it ... for now I will stick with the choice vnc + ssh.

  11. francesco
    November 2, 2008 at 17:17 | # 11

    Hello, and thanks for the guide .. really very clear.
    I did everything as written in the guide, but it is a problem arose when starting x11vnc with the following command line: x11vnc -display: 0 -forever -ssl SAVE -rfbauth /home/sercik/.vnc/passwd

    the only difference is that the switch does not use -usepw, but -rfbauth .. message erroe I is from this

    openssl_init: SSL_CTX_use_certificate_chain_file () failed.
    ssl error: error: 0906D06C: PEM routines: PEM_read_bio: no start line

    Thanks again, I hope you can help

  12. stefano
    November 5, 2008 at 16:07 | # 12

    @ Francesco:
    The problem is related to the SSL certificate. Verify that SSL certificates are correctly installed. It 's highly likely that they are not used in the correct manner.
    Unfortunately I can not reproduce your problem :(

  13. Fabio
    November 23, 2008 at 16:03 | # 13

    Hi, as I wrote earlier, his article is like a beacon in the fog for me. I do not know how many configuration problems I have solved. SSvnc the Client transport its a mini MMC card is encrypted. And on every pc I can access my home computer and control it.

    I was lacking a work that I needed, namely the transfer of files with the same program. I was solved by installing another program further OpenSSH Server and Winscp to transfer files. But for obvious safety reasons, I have tried if there was implemented a function of file transfer in ssvnc and x11vnc and I've read that there is something and it is mentioned in Putty.

    You know how you can transfer files (file too big) with this accopiata program she used. It would be a good solution without installing an additional server and open other doors.

    Thank you. And keep writing great guides like this.

  14. stefano
    November 23, 2008 at 16:26 | # 14

    @ Fabio:
    Hello Fabio. First of all, please give me the "you" as I do with you :)

    A memory remember that the latest versions of servers and clients provide the ability to transfer files directly from the client ... try to look for this feature!

  15. Francesco
    March 2, 2009 at 12:36 | # 15

    Hello clarification, following your guide the first time I connect from the client to the server funziona..se I do it the second time I have to restart the server otherwise it will not let me connect in short, as if even if I close the connection on the client side to the server seems to hang, I have done something wrong? can you help me? a greeting and thanks

  16. stefano
    March 7, 2009 at 20:14 | # 16

    @ Francesco:
    I see ... the chiudura connection as the make? Just close the client?

  17. Alessandro
    March 23, 2009 at 21:33 | # 17

    Hello,

    I also followed all the step by step guide on Xubuntu, but at the time the server gives me an error:

    X Error of failed request: BadShmSeg (invalid shared segment parameter)

    Some help?

  18. stefano
    March 24, 2009 at 00:07 | # 18

    @ Alessandro:
    Check if you have the directory "/home/tuo_utente/.x11vncrc" and if so rimovila and restart x11vnc

  19. Alessandro
    March 25, 2009 at 21:33 | # 19

    The directory is not present, but I solved the problem. The error was my typing (display: 0 instead of display: 0).

    I have more questions Perc.
    1) The use of this method in addition to being more secure, it is also slower than the same wine or x11vnc without SSL encryption?
    2) Is there a way to make sure that does not need to login to your server and run the command but to load the server as a service? Loaded before the login. So if I need to remotely reboot the server I can riconettermi.
    3) The use of other systems (Wine, XDMCP) is much less secure than that?

    Meanwhile comlimenti for the excellent guide, well done and very useful.
    At the moment I tried it from Windows clients tomorrow to try the Linux client (the steps are the same?)
    Thanks

  20. Luigi
    September 7th, 2009 at 7:45 | # 20

    Stephen,
    Your post is very nice. Better that than the SSL tunnel SSH. I followed the procedure and everything seems to work. The only problem is that ssvnc (bootable USB key) while you start with Ubuntu 8.10 not manage to do the same thing in Ubuntu 9.04. In Win all OK.

    Can you help me solve this problem?

    Thanks in advance.

  21. stefano
    September 7th, 2009 at 18:32 | # 21

    @ Louis:
    ssvnc try to start from the terminal and see what brings in output ;)

  22. September 7th, 2009 at 22:08 | # 22

    Stephen,

    I solved it. It was necessary only to install (with Synaptic) dependence "tk8.5."
    Anyway, thank you for your kindness.
    A warm greeting.

  23. sercik
    November 12, 2009 at 10:18 | # 23

    Dear Stephen,
    every time I go back to disturb you.
    How are you doing?
    I had a doubt about the use of x11vnc as described in your article,
    if I understand it if the client computer is not present the certificate cacert.pem you can not connect to the server x11vnc, is that right?
    But this is not cacert.pem file that is password protected, in theory, if someone you care about the file cacert.pem x11vnc can connect to your server, then if anceh should know the password.

    But then the real protection is the password? what need is there to do everything I'm working with my certificates?

    If it were possible it would be best to protect the public certificate cacert.pem with a password, type as does my bank gives me a certificate to add to the browser, but that at the time of import and export also asks me the password .

    Then if I wanted to automate the starting of x11vnc? is currently impossible because the password prompt used in the server certificate, so it is very convenient ...

    Hello and thanks again for everything

  24. sercik
    November 12, 2009 at 10:35 | # 24

    I'm sorry,
    a small addition. I raised the command x11vnc -sslGenCert server and this time I entered the password, inter alia reading was well written my own problem: "if you type a password, then you'll have to put it every time you start x11vnc. ... "
    One thing I have therefore resolved: start automatically.
    What do you think of the safety of my solution?

    Then I want to give a little advice to all!

    It 's very easy to make x11vnc server start automatically each time you log in the linux machine if that machine then the server type used, as I do, you can set the automatic login (I use gdm and just give gdmsetup as root) and then x11vnc to run automatically so you do not have to do anything but turn on the linux machine and then you can collegravi to it by ssvnc from where you want.

    Regarding the automatic startup of the X server with x11vnc whichever DE used on the internet you will find information on how to run commands automatically at startup.

    The line to be executed is:
    x11vnc -usepw -ssl SAVE -display: 0 -rfbport 5432 -forever &

    I changed the default port in 5432 and added -forever, so x11vnc does not die when you close the connection from the client side and you can then connect from lo9ntano whenever you want.

    Ciaooooooo

  25. stefano
    November 12, 2009 at 16:19 | # 25

    @ Sercik:
    Great!
    Thanks for the tips!

  26. Mark
    May 26, 2010 at 12:56 | # 26

    Hello, comes to me an error when I try to connect, use ubuntu as a server while another PC in the LAN using xp and I get a window that says exactly that: readexat: soket error while reading you give me a tip Thank you so much for this driving very interesting ..

  27. stefano
    May 26, 2010 at 14:41 | # 27

    Marco
    the error that you have reported could happen when there are multiple instances of VNC that are turning.
    Checking the server do not have other clients connected :)

  28. Mark
    May 26, 2010 at 18:40 | # 28

    @ Stefano:
    I had no active connection to the server will place what happened on the server maybe
    do you have an idea you can do, I have one last thing to ask; from what I could understand
    I can also connect to a PC outside my lan
    with this address or that 192.168.1.25 is the address of the server that created the certificate passes through
    and copied to the client ..

    SSL handshake with helper process succeeded.
    26/05/2010 13:14:34 other clients:
    26/05/2010 13:14:34 Disabled X server autorepeat key.
    26/05/2010 13:14:34 to force back on run: 'xset r on' (3 times)
    26/05/2010 13:14:34 xdamage created object: 0x3e00035
    26/05/2010 13:14:34 rfbProcessClientProtocolVersion: client gone
    26/05/2010 13:14:34 client_count: 0
    26/05/2010 13:14:34 Restored X server autorepeat key to: 1
    26/05/2010 13:14:34 sending SIGTERM to ssl_helper_pid: 2218
    26/05/2010 13:14:35 connect_once: invalid password or early disconnect.
    26/05/2010 13:14:35 connect_once: waiting for next connection.
    26/05/2010 13:14:35 Client 192.168.1.27 gone
    26/05/2010 13:14:35 Statistics events Transmit / RawEquiv (saved)
    26/05/2010 13:14:35 TOTALS: 0 | 0/0 (0.0%)
    26/05/2010 13:14:35 Statistics Received events / RawEquiv (saved)
    26/05/2010 13:14:35 TOTALS: 0 | 0/0 (0.0%)
    26/05/2010 13:14:39 SSL: accept_openssl (OPENSSL_VNC)
    26/05/2010 13:14:39 SSL: spawning helper process to handle: 192.168.1.27:1549
    26/05/2010 13:14:39 SSL: ssl_helper [2219]: SSL_accept () failed for: 192.168.1.27:1549
    26/05/2010 13:14:39 SSL: accept_openssl: cookie from ssl_helper FAILED. 0
    26/05/2010 13:14:39 xdamage destroyed object: 0x3e00035

  29. Mark
    May 27, 2010 at 7:10 | # 29

    @ Marco: Then I saw that on the client side, vnc uses port 5930, you can change it?
    Thanks

  30. Linen
    September 2, 2010 at 15:14 | # 30

    First of all congratulations for the very nice guide that makes us appreciate more and more Linux.
    Minding talk, after you create the ssl certificate on the Server PC I can not copy it on a USB drive
    to bring it into the Notebook, whereas my USB drive is / dev / SCB1 / media / 7578-3CAE thought
    to make $ scp ~ / .vnc / certs / CA / cacert.pem / / media / 7578-3CAR / (but it gives me error).

    Could you give me a practical example of how to blend the public key ssl PC Server USB stick and
    there in the other pc to share the VNC protected. Greetings to all and see you soon.

  31. stefano
    September 2, 2010 at 15:52 | # 31

    Lino:

    $ Cp ~ / .vnc / certs / CA / cacert.pem / media / 7578-3CAR /

  32. Linen
    September 3, 2010 at 23:08 | # 32

    and copy it to the client?
    is right: $ /media/7578-3CAR/cacert.pem scp ~ / .vnc / certs // CA /

    ......... Nice is that taking the first steps have fun! Hello and Thank you for your patience soon.

  33. Linen
    September 5th, 2010 at 24:44 | # 33

    How do I end by the client to figure out if I put in the right way the CA server?

    While entering into the folder and giving .vnc $ -al I can not understand

  34. maximum
    September 9th, 2010 at 4:20 | # 34

    Meanwhile, I make my compliments to the driving ... then I wanted to ask if I can use a single psw (robusta) for everything ... there are problems?

  35. stefano
    September 9th, 2010 at 13:42 | # 35

    Thanks,

    You can also use a single passw, but it is not recommended if you want to maintain high levels of safety ;)

  36. Linen
    September 13, 2010 at 22:31 | # 36

    Stephen,
    There I did it! Soon I want to try with a Windows client using the 'emulator Cygwin.

    Greetings and see you soon.

  37. Andrea
    March 4, 2011 at 9:24 | # 37

    @ Stephen:
    Good day, I would be very interested in a way to access the internet via my home server, I am a neophyte to ubuntu and I'm not able to configure openvpn in a correct way, there would be a way to access remotely via VNC (not in the same network) , in a manner perhaps analogous to that of logmein on windows ???

    Many thanks in advance for the help

    Andrea

  1. May 7th, 2009 at 13:16 | # 1