vnc_security

This is part of The Pile, a partial archive of some open source mailing lists and newsgroups.



From: kmself@ix.netcom.com
Date: Mon, 23 Oct 2000 12:43:48 -0700
To: svlug@svlug.org
Subject: Re: [svlug] vnc


Greg Herlein (gherlein@herlein.com) wrote:

> I installed vnc this weekend and it's the best few minutes I ever
> spent (well, not counting the first time I downloaded a slackware
> disk a long, long time ago... grin).

> VNC is the slickest hunk of software I've seen in a LONG time.  I
> know Rick raves about it here - it was his praises that enticed
> me to try it - but rarely does software so far outperform
> expectations.  Dang, this thing is sweet.

> I am really impressed.  My KVM switch is very soon going to have
> a port free for another linux box, since I can now relegate my NT
> box to the closet for headless use...  and I don't have to leave
> my X desktop at all.  :)

> 	http://www.uk.research.att.com/vnc/

> Worth it.  Big time.

Incidentally, how are you running VNC?

Under Debian, I've got a couple of viewers, xvncviewer and svncviewer,
which run under X and (AFAICT) console mode, respectively.  I haven't
been able to get the svncviewer to work.

A "naked" VNC session, *not* piped through an SSH tunnel, is
sufficiently responsive that I don't find it annoying.  I tried a
tunneled VNC session through SSH on the (high speed) local network at
work and found that it was distressingly slow, even with blowfish
selected as an encryption algorithm.  Didn't try running lbxproxy,
though I may give that a shot.

I've got concerns running X or a GUI environment over a network w/o
encryption.  When working with GNU/Linux boxen, I'd just as soon run X
forwarding in SSH and export individual clients.  Introducing Legacy MS
Windows somewhat screws this pooch, as clients don't support X and
remote display of X apps to Windows isn't directly supported without
external software, making VNC or something like it a necessity.

How are people addressing the security issue here?

====

Date: Mon, 23 Oct 2000 13:19:07 -0700
To: svlug@svlug.org
Subject: Re: [svlug] vnc
From: Rick Moen <rick@linuxmafia.com>

begin  kmself@ix.netcom.com quotation:

> Introducing Legacy MS Windows somewhat screws this pooch, as clients
> don't support X and remote display of X apps to Windows isn't directly
> supported without external software, making VNC or something like it a
> necessity.

Given a Win32 box on your LAN, remote VNC sessions to it are the least
of your LAN security worries, yes?

===

Date: Mon, 23 Oct 2000 15:48:36 -0700
From: "Jeffrey B. Siegal" <jbs@quiotix.com>
To: kmself@ix.netcom.com
Subject: Re: [svlug] vnc

kmself@ix.netcom.com wrote:

> I tried a tunneled VNC session through SSH on the (high
> speed) local network at work and found that it was
> distressingly slow, even with blowfish selected as an
> encryption algorithm.

Sounds like you need faster CPUs.

>  Didn't try running lbxproxy, though I may give that a shot.

I don't understand what you're trying to do here.

===

Date: Mon, 23 Oct 2000 18:05:34 -0700
From: "Jeffrey B. Siegal" <jbs@quiotix.com>
To: svlug@svlug.org
Subject: Re: [svlug] vnc

kmself@ix.netcom.com wrote:
> lbxproxy is the low-bandwidth X proxy.  It's helpful in runnin X over
> low-bandwidth (or high-latency) connections.

Right.

> May not be applicable to
> VNC as both client and server are local, only the display itself is
> exported.

That's the part I don't understand.  If you are running VNC over the
net, then lbxproxy won't help you at all.  If you are running X over the
net, it might, but I doubt it if your network is local and fast.

===

From: kmself@ix.netcom.com
Date: Mon, 23 Oct 2000 20:56:08 -0700
To: svlug@svlug.org
Subject: Re: [svlug] vnc


Jeffrey B. Siegal (jbs@quiotix.com) wrote:

> kmself@ix.netcom.com wrote:

> > I tried a tunneled VNC session through SSH on the (high
> > speed) local network at work and found that it was
> > distressingly slow, even with blowfish selected as an
> > encryption algorithm.

> Sounds like you need faster CPUs.

This looks indeed like it may be the problem.  Anyone here
got experience with Netwinder RM-1?  VNC's not the only
place it seems to be lagging.  Looking for a good
benchmarking tool (and some comparative stats for different
platforms).

===

Date: Mon, 2 Oct 2000 22:34:33 -0700
To: svlug@svlug.org
Subject: Re: [svlug] so re we getting free vmware licenses on wednesday
From: Rick Moen <rick@linuxmafia.com>

begin Bill Jonas quotation:

> ...RPMs could probably be found, I suppose....

The good news is that essentially every distribution except for the 
miniature ones now includes VNC Viewer as prepackaged software.  Highly
recommended for ongoing access to those nice little Win32 or MacOS
packages that you think will always stand between you and routine Linux
desktop usage (Quicken, Quickbooks...).

By default, VNC connections have negligible security -- but, if you
wanted security, you wouldn't have MS-Windows boxes around.

_However_ (in some situations), you can also redirect a VNC session over
an SSH tunnel, if so desired:

http://www.mindbright.se/english/technology/products/mindvnc.html
http://www.zip.com.au/~cs/answers/vnc-thru-firewall-via-ssh.txt
http://www.uk.research.att.com/vnc/sshwin.html and
http://www.uk.research.att.com/vnc/sshvnc.html

...which also has the benefit of compressing the bitstream.

===


the rest of The Pile (a partial mailing list archive)

doom@kzsu.stanford.edu