Remote Access with VNC: Difference between revisions

   tux > vncviewer thinkserver.freddythechick.uk::5901

'''Note: Display and Port Number'''

The actual display or port number you specify in the VNC client must be the same as the display or port number picked by the '''<code>vncserver</code>''' command on the target machine. See Section 4.4, "Persistent VNC Sessions" for further info.

</div>

==Connecting Using the vncviewer GUI==

By running '''<code>vncviewer</code>''' without specifying '''<code>--listen</code>''' or a host to connect to, it will show a window to ask for connection details. Enter the host into the ''VNC server'' field like in Section 4.1.1, "Connecting Using the vncviewer CLI" and click ''Connect''.

==Notification of Unencrypted Connections==

==Main Window==

Run Remmina by entering the '''<code>remmina</code>''' command.

The main application window shows the list of stored remote sessions. Here you can add and save a new remote session, quick-start a new session without saving it, start a previously saved session, or set Remmina's global preferences.

==Adding Remote Sessions==

Complete the fields that specify your newly added remote session profile. The most important are:

Credentials to use for remote authentication. Leave empty for no authentication.

Select the best options according to you connection speed and quality.

Select the ''Advanced'' tab to enter more specific settings.

'''Tip: Disable Encryption'''

If the communication between the client and remote server is not encrypted, active ''Disable encryption'', otherwise the connection fails.

</div>

Confirm with ''Save''. Your new profile will be listed in the main window.

To start a remote session quickly without proper adding and saving connection details, use the drop-down box and text field at the top of the main window.

===Opening Saved Remote Sessions===

===Remote Sessions Window===

==Editing, Copying and Deleting Saved Sessions==

To ''Delete'' a saved remote session, right-click its name in the Remmina's main window and select ''Delete''. Confirm with ''Yes'' in the next dialog.

If you need to open a remote session from the command line or from a batch file without first opening the main application window, use the following syntax:

   tux > remmina -c profie_name.remmina

Remmina's profile files are stored in the <code>.local/share/remmina/</code> directory in your home directory. To determine which profile file belongs to the session you want to open, run Remmina, click the session name in the main window, and read the path to the profile file in the window's status line at the bottom.

While Remmina is not running, you can rename the profile file to to a more reasonable file name, such as <code>sle15.remmina</code>. You can even copy the profile file to your custom directory and run it using the '''<code>remmina -c</code>''' command from there.

'''Procedure 1: Enabling One-time VNC Sessions'''

# Check ''Allow Remote Administration Without Session Management''.

# Activate ''Enable access using a web browser'' if you plan to access the VNC session in a Web browser window.

# In case not all needed packages are available yet, you need to approve the installation of missing packages.

'''Tip: Restart the Display Manager'''

YaST makes changes to the display manager settings. You need to log out of your current graphical session and restart the display manager for the changes to take effect.

</div>

==Available Configurations==

Other configurations can be made available on different ports, see Section 4.3.3, "Configuring One-time VNC Sessions".

To connect to a one-time VNC session, a VNC viewer must be installed, see also Section 4.1, "The '''<code>vncviewer</code>''' Client".

You can skip this section, if you do not need or want to modify the default configuration.

To activate the VNC server socket at boot time, run the following command:

   sudo systemctl enable xvnc.socket

   sudo systemctl start xvnc.socket

The '''<code>Xvnc</code>''' server can be configured via the <code>server_args</code> option. For a list of options, see '''<code>Xvnc --help</code>'''.

   tux > sudo systemctl reload xvnc.socket

'''Important: Firewall and VNC Ports'''

When activating Remote Administration as described in Procedure 4.1, "Enabling One-time VNC Sessions", the ports <code>5801</code> and <code>5901</code> are opened in the firewall. If the network interface serving the VNC sessions is protected by a firewall, you need to manually open the respective ports when activating additional ports for VNC sessions. See Book ''"Security Guide", Chapter 15 "Masquerading and Firewalls"'' for instructions.

A persistent session can be accessed from multiple clients simultaneously. This is ideal for demonstration purposes where one client has full access and all other clients have view-only access. Another use case are trainings where the trainer might need access to the trainee's desktop.

To connect to a persistent VNC session, a VNC viewer must be installed. Refer to Section 4.1, "The '''<code>vncviewer</code>''' Client" for more details.

</div>

* VNC Session Initiated using <code>vncserver</code>

* VNC Session Initiated using <code>vncmanager</code>

A session can have multiple client connections of both kinds at once.

# Open a shell and make sure you are logged in as the user that should own the VNC session.

# If the network interface serving the VNC sessions is protected by a firewall, you need to manually open the port used by your session in the firewall. If starting multiple sessions you may alternatively open a range of ports. See Book ''"Security Guide", Chapter 15 "Masquerading and Firewalls"'' for details on how to configure the firewall.<br><br>'''<code>vncserver</code>''' uses the ports <code>5901</code> for display <code>:1</code>, <code>5902</code> for display <code>:2</code>, and so on. For persistent sessions, the VNC display and the X display usually have the same number.

# To start a session with a resolution of 1024x768 pixel and with a colour depth of 16-bit, enter the following command:

The '''<code>vncserver</code>''' command picks an unused display number when none is given and prints its choice. See '''<code>man 1 vncserver</code>''' for more options.

The password(s) you are providing here are also used for future sessions started by the same user. They can be changed with the '''<code>vncpasswd</code>''' command.

'''Important: Security Considerations'''

Make sure to use strong passwords of significant length (eight or more characters. Do no share these passwords.

To terminate the session shut down the desktop environment that runs inside the VNC session from the VNC viewer as you would shut it down if it was a regular local X session.

   WINDOWMANAGER=icewm vncserver -geometry 1024x768

'''Note: One Configuration for Each User'''

Persistent VNC sessions are configured in a single per-user configuration. Multiple sessions started by the same user will all use the same start-up and password files.

</div>

# Start ''YaST > Network Services > Remote Administration (VNC)''.

# Activate ''Allow Remote Administration With Session Management''.

# In case not all needed packages are available yet, you need to approve the installation of missing packages.

'''Tip: Restart the Display Manager'''

YaST makes changes to the display manager settings. You need to log out of your current graphical session and restart the display manager for the changes to take effect.

</div>

There are several settings which influence the VNC session behaviour:

Confirm with ''OK''.

After you set up a persistent VNC session as described in Section 4.4.2.1, "Configuring Persistent VNC Sessions", you can join it with your VNC viewer. After the your VNC client connects to the server, you will be prompted to choose whether you want to create a new session, or join the existing one:

After you click the name of the existing session, you may be asked for login credentials, depending on the persistent session settings.

=Encrypted VNC Communication=

Whether for a one-time or a persistent VNC session, security options are configured via the <code>-securitytypes</code> parameter of the '''<code>/usr/bin/Xvnc</code>''' command located on the <code>server_args</code> line. The <code>-securitytypes</code> parameter selects both authentication method and encryption. It has the following options:

TLS encryption with certificate. If you use a self-signed certificate, you will be asked to verify it on the first connection. On subsequent connections you will be warned only if the certificate changed. So you are protected against everything except man-in-the-middle on the first connection (similar to typical SSH usage). If you use a certificate signed by a certificate authority matching the machine name, then you get full security (similar to typical HTTPS usage).

'''Tip: Path to Certificate and Key'''

With X509 based encryption, you need to specify the path to the X509 certificate and the key with <code>-X509Cert</code> and <code>-X509Key</code> options.

</div>