VNC -- The Essential Sysadmin Tool

VNC stands for Virtual Network Computing This great tool was developed at AT&T Laboratories in Cambridge, England. This tool should be in every sysadmins arsenal.

For Unix, the traditional VNC implementation includes a "virtual" X11 server Xvnc (usually launched via the vncserver command) that is not associated with a physical display, but provides a "fake" one X11 clients (xterm, mozilla, etc.) can attach to. A remote user then connects to Xvnc via the VNC client vncviewer from anywhere on the network to view and interact with the whole virtual X11 desktop.

The VNC protocol is in most cases better suited for remote connections with low bandwidth and high latency than is the X11 protocol because it involves far fewer "roundtrips" (an exception is the cached pixmap data on the viewing-end provided by X). Also, with no state maintained the viewing-end can crash, be rebooted, or relocated and the applications and desktop continue running. Not so with X11.

However, sometimes one wants to connect to a real X11 display (i.e. one attached to a physical monitor, keyboard, and mouse: a Workstation or a SunRay session) from far away. Maybe you want to close down an application cleanly rather than using kill, or want to work a bit in an already running application, or would like to help a distant colleague solve a problem with their desktop, or would just like to work out on the deck for a while. This is where x11vnc is useful.

VNC is perfect for those who use Windows desktop to manage Unix servers. It not only allows you to view other Unix desktop from PC and other architectures that do not have X it also have several additional benefits. One of the most important is that it preserves state of the session. So if you left your office and reconnect from home the session will be at the state you left it up to the last cursor position. That saves a lot of time if you administer multiple servers.

Being able to access a user’s desktop remotely is also very important for network administrators, as they don’t have to run around all over the place doing troubleshooting. There are various commercial packages that have been providing this capability for a long time (pcAnywhere was available for DOS, Hummingbird is 10 years old, etc). Win XP Professional has Remote Desktop Connection and Remote Assistance that allows you to access the machine remotely, whether over a LAN or even the Internet. And this is a high quality free product that works for Unix.

VNC is very similar to Windows Terminal Services. There are, however, some key differences, such as:

Although VNC is great, it does not make an efficient use of bandwidth. It seems Windows XP Remote Desktop makes significantly better job in comparison. Also, when the VNC server is running on Linux/Unix, I cannot see the current desktop (on the console) remotely. There is a special version of VNC called TightVNC which helps to overcome this problem. Some Linux distributions like Fedora are working on integrating VNC as a core technology. There is also NX, the version of VNC that is leaner and meaner then VNC. NX gives you a free (as in speech and beer) "CITRIX-style" solution. You can download Knoppix 3.6 and give FreeNX a try.

VNC offers a server for Windows as well and it works reasonably well. The best windows implementation is TightVNC VNC-Based Free Remote Control Solution (native port is much weaker). You need to use TightVNC client too (actually this is a better client for any VNC version, not only for TightVNC). VNC ports to Windows have an important limitation: when the VNC server is running on Windows, multiple people cannot have remote independent sessions.

For Solaris vnc package is provided on Software Companion CD and X11vnc prcompiled package from http://sunfreeware.com

The VNC is launched using vncserver Perl script. The script vncserver is a wrapper for Xvnc.

   vncserver

The example of modified 'vncserver' is shown below.

The first time you run vncserver, it will prompt you for a password (it launches vncpasswd), then it terminates without creating your desktop. To create your desktop, you have to run vncserver again. The password file and startup scripts are stored in your ~/.vnc directory. You have several choices of desktop environments and can either make an envelope scripts or to modify vncpasswd to launch CDE, Gnome or KDE. You can create several scripts, one for each desktop that you are using:

vnccde :n  -  CDE on display number 'n'
vnckde :n  - KDE on display number 'n'

Leaving off the ":n" gives you the lowest available number. To connect to your desktop and use it, you'll need a VNC viewer program on your client machine.

vncserver is a perl script that you can (and probably should) customize

You can start a vncserver from RC scripts or manually by logging on to the system you want to administer remotely and launching it with the command:

    # vncserver hostname:session_number

With VNC, you can run multiple sessions and connect to different servers. By default, the session numbers start at 1 and go up from there, but you can specify session 3 (for instance) right from the start by typing vncserver hostname:3. This highlights another benefit of VNC. Until you kill a VNC session, it retains its current state.

That means you can disconnect from a session, reconnect later, and return right where you left off. In fact, you can even share a session so multiple users can access it.

When you start the vncserver for the first time, you will be prompted for a password to access the server. You can always change it later using the vncpasswd command. Once the server is activated, you can connect to it using the vncviewer command. The format is as follows:

   # vncviewer host:session_number

To exit the viewer (or send specific key sequences), use the F8 key. Then click on "Quit Viewer" to close the session. You can also start a shared session so that others may use the same X Window session with this version of the command:

   # vncviewer -shared host:session_number

When you start the vncserver, it creates a .vnc directory under your home directory (/root/.vnc). Several files are kept here. You'll find a log file associated with each server you run and a .pid file to allow for removal of the server. By the way (since I mentioned it earlier), you kill a vncserver process like this:

   # vncserver -kill :1

Remember that the :1 could be a :2 or :3, depending on the session you are trying to kill. That said, the other file I want you to look at is this one: -- xstartup. If you do a cat on the file, you get something that looks like this:

   #!/bin/sh
 
   xrdb $HOME/.Xresources
   xsetroot -solid grey
   xterm -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
   # twm &
   startkde &

Notice the second-to-last line is commented out, and a "startkde" line is added below. This is because VNC uses twm (the Tab Window Manager) as its default desktop. If you prefer another window manager, add the startup here.

Old News ;-)

Vino. The Remote Desktop Project

[Jun 4, 2007] VNC and Similar

[Apr 5, 2007] freshmeat.net Project Reviews - vnc2swf

[Mar 24, 2007] freshmeat.net Project details for Enhanced TightVNC Viewer

Enhanced TightVNC Viewer 1.0.14 released

LinuxPlanet - Tutorials - Using VNC Tunneling over SSH - Temporary Access

"Sharing computers on a Linux (or heterogeneous) network, Part 1" (developerWorks, December 2001)

Logging into NT service from Linux VNC client

TightVNC client has an option sending this key sequence to Windows (left-click mouse of the client and see "send Ctrl-Alt-Del" option.

TightVNC Remote X the secure, fast & easy way (LinuxWorld)

Recommended Links

Clones/Forks

TightVNC: Manual Page for Xvnc(1) Const Kaplinsky const@ce.cctpu.edu.ru has developed TightVNC, a version of VNC providing better compression for use with slow links than the standard VNC 3.3.3 release. Although it includes a number of extensions to the standard VNC distribution, TightVNC remains compatible with existing versions. The TightVNC homepage is at http://www.tightvnc.com/

TightVNC is fully compatible with the standard RFB protocol used in VNC, so you can use TightVNC viewer with the standard VNC server and vice versa. But note that protocol enhancements implemented in TightVNC will work only if these enhancements are supported on both sides of the connection.

TightVNC Features

... please look at the Xvnc -help output and read the Xserver(1) manual page for ... rfbwait
time Maximum time, in milliseconds, to wait for an RFB client (VNC viewer ...
www.tightvnc.com/Xvnc.1.html - 14k - Cached - Similar pages

http://ultravnc.sourceforge.net Want to remote control your computer? If you have Windows XP Professional, you can use Remote Desktop. If you don't use Windows XP Professional, you can still get remote control using UltraVNC. UltraVNC is an excellent fast & free remote control, and file transfer program.

x11vnc: a VNC server for real X displays (to FAQ) (to downloads) (to building)

x11vnc allows one to remotely view and interact with real X displays (i.e. a display corresponding to a physical monitor, keyboard, and mouse) with any VNC viewer. In this way it plays the role for Unix/X11 that WinVNC plays for Windows.

I wrote x11vnc because x0rfbserver was basically impossible to build on Solaris and had poor performance. The primary x0rfbserver build problems centered around esoteric C++ toolkits. x11vnc is written in plain C and uses only standard libraries. I also added a few enhancements to improve the interactive response, add esoteric features, etc. The FAQ contains a lot of information and solutions to problems, but please feel free to contact me if you have problems or questions.

Background:

VNC (Virtual Network Computing) is a very useful network graphics protocol in the spirit of X, however, unlike X, the viewing-end is very simple and maintains no state. It is a remote framebuffer (RFB) protocol

For Unix, the VNC implementation includes a virtual X11 server Xvnc (usually launched via the vncserver command) that is not associated with a real display, but provides a "fake" one X11 clients (xterm, mozilla, etc.) can attach to. A remote user then connects to Xvnc via the VNC client vncviewer from anywhere on the network to view and interact with the whole virtual X11 desktop.

The VNC protocol is in most cases better suited for remote connections with low bandwidth and high latency than is the X11 protocol. Also, with no state maintained the viewing-end can crash, be rebooted, or relocated and the applications and desktop continue running. Not so with X11.

How to use x11vnc:

In this example let's assume the remote machine with the X display you wish to view is "far-away.east:0" and the workstation you are presently working at is "sitting-here.west".

Step 0. Download x11vnc (see below) and have it available to run (e.g. via $PATH) on far-away.east. Similarly, have a VNC viewer (e.g. vncviewer) ready to run on sitting-here.west. We recommend TightVNC Viewers.

Step 1. By some means log in to far-away.east and get a command shell running there. You can use ssh, rlogin, telnet, or any other method to do this. x11vnc needs to be run on the same machine the X server process is running on (because MIT-SHM shared memory is used to poll the X11 framebuffer).

Step 2. In that far-away.east shell (with command prompt "far-away>" in this example) run x11vnc directed at the far-away.east X session display:

You could have also set the environment variable DISPLAY=:0 instead of using -display. This step attaches x11vnc to the far-away.east:0 X display (no viewer clients yet).

To get X11 permissions right, you may also need to set the XAUTHORITY environment variable (or use the -auth option) to point to the correct MIT-MAGIC-COOKIE file (e.g. /home/joe/.Xauthority). More on this below.

There will then be much chatter printed out from x11vnc, until it finally says something like:

Step 3. At the place where you are sitting (sitting-here.west in this example) you now want to run a VNC viewer program. There are VNC viewers for Unix, Windows, MacOS, Java-enabled web browsers, and even for PDA's like the Palm Pilot! You can use any of them to connect to x11vnc (see the above VNC links under "Background:" on how to obtain a viewer for your platform or this FAQ. For Solaris, vncviewer is available in the Companion CD package SFWvnc ).

In this example we'll use the Unix vncviewer program on sitting-here by typing the following command in a second terminal window:

That should pop up a viewer window on sitting-here.west showing and allowing interaction with the far-away.east:0 X11 desktop. Pretty nifty! When finished, exit the viewer: the remote x11vnc process will shutdown automatically (or you can use the -forever option to have it wait for additional viewer connections).

Desktop Sharing: The above more or less assumed nobody was sitting at the workstation display "far-away.east:0". This is often the case: a user wants to access her workstation remotely. Another usage pattern has the user sitting at "far-away.east:0" and invites one or more other people to view and interact with his desktop. Perhaps the user gives a demo or presentation this way (using the telephone for vocal communication). A "Remote Help Desk" mode would be similar: a technician remotely connects to the user's desktop to interactively solve a problem the user is having.

For these cases it should be obvious how it is done. The above steps will work, but more easily the user sitting at far-away.east:0 simply starts up x11vnc from a terminal window, after which the guests would start their VNC viewers. For this usage mode the -accept popup option discussed in the FAQ below may be of use to allow the user at far-away.east:0 to accept or reject incoming connections.

Tunnelling x11vnc via ssh:

The above example had no security or privacy at all. When logging into remote machines (certainly when going over the internet) it is best to use ssh, or use a VPN. For x11vnc one can tunnel the VNC protocol through the encrypted ssh channel. It would look something like this:

(you will likely have to provide passwords/passphrases for the ssh login) and then in another terminal window on sitting-here run the command:

The -encodings option is very important: vncviewer will default to "raw" encoding if it thinks the connection is to the local machine, and so vncviewer gets tricked this way by the ssh redirection. "raw" encoding will be extremely slow over a networked link, so you need to force the issue with -encodings "copyrect tight ...".

If the machine you SSH into is not the same machine with the X display you wish to view (e.g. your company provides incoming SSH access to a gateway machine), then you need to change the above to, e.g.: -L 5900:otherhost:5900. Once logged in, you'll need to do a second login (ssh, rsh, etc.) to the workstation machine 'otherhost' and then start up x11vnc on it.

Scripts to automate tunneling: As discussed below, there may be some problems with port 5900 being available. If that happens, the above port and display numbers may change a bit (e.g. -> 5901 and :1). However, if you "know" port 5900 will be free on the local and remote machines, you can easily automate the above two steps by using the x11vnc option -bg (forks into background after connection to the display is set up) or using the -f option of ssh. A simple example script, assuming no problems with port 5900 being taken on the local or remote sides, looks like:

Another method is to start the VNC viewer in listen mode "vncviewer -listen" and have x11vnc initiate a reverse connection using the -connect option:

A third way is specific to the TightVNC vncviewer special option -via for gateways. The only tricky part is we need to start up x11vnc and give it some time to start listening for connections (so we cannot use the TightVNC default setting for VNC_VIA_CMD):

Of course if you already have the x11vnc running waiting for connections (or have it started out of inetd(1)), you can simply use the TightVNC vncviewer -via gateway host:port in its default mode to provide secure ssh tunnelling.

VNC password file: Also note in the first example script that the option "-rfbauth .vnc/passwd" provides additional protection by requiring a VNC password for every VNC viewer that connects. The vncpasswd or storepasswd programs, or the x11vnc


-storepasswd

option can be used to create the password file. x11vnc also has the slightly less secure -passwdfile and "-passwd XXXXX" options.

Important: It is up to you to tell x11vnc to use password protection, it will not do it for you automatically. The same goes for encrypting the channel between the viewer and x11vnc: it is up to you to use ssh, stunnel, VPN, etc. Also look into the -allow and -localhost options and building x11vnc with tcp_wrappers support to limit host access.

Downloading x11vnc:

x11vnc is a contributed program to the libvncserver project at SourceForge.net. I use libvncserver for all of the VNC aspects; I couldn't have done without it. The full source code may be found and downloaded (either file-release tarball or CVS tree) from the above link. As of Aug 2004, the x11vnc-0.6.2.tar.gz source package is released (recommended download) . The x11vnc package is the subset of the libvncserver package needed to build the x11vnc program. Please do not use the LibVNCServer-0.6 tarball: it contains an older, more buggy version of x11vnc (Oct 2003) that you likely want to avoid. Also, you can get a copy of my latest, bleeding edge x11vnc.c file to replace the one in the above packages or the one in the CVS tree and then rebuild.

See the FAQ below for information about where you might obtain a precompiled x11vnc binary from 3rd parties.

More tools: Here is a rsh/ssh wrapper script rx11vnc that attempts to automatically do the above Steps 1-3 for you (provided you have rsh/ssh login permission on the machine x11vnc is to be run on). The above example would be: rx11vnc far-away.east:0 typed into a shell on sitting-here.west. Also included is an experimental script rx11vnc.pl that attempts to tunnel the vnc traffic through an ssh port redirection (and does not assume port 5900 is free). Have a look at them to see what they do and customize as needed:

News	Recommended Links	Recommended Articles	Solaris main page	Xwindows	XWindows Managers
Rc scripts	VNC installation & configuration	VNC on Solaris	VNC on Linux	VNC for Windows and TightVNC	Etc