A number of ways are described along with some issues you may encounter. You can keep all of the settings in a Putty 'Saved Session'. This can also be automated by Chaining SSH's.
As discussed above another option is to first start the VNC viewer in "listen" mode, and then launch x11vnc with the "-connect localhost" option to establish the reverse connection. In this case a Remote port redirection not Local is needed for port instead of i.
SSL tunnels such as stunnel also stunnel. On the other hand, since SSH is usually installed everywhere and firewalls often let its port through, ssh is frequently the path of least resistance it also nicely manages public keys for you. They are discussed in the Next FAQ you probably want to skip to it now.
We include these non-built-in method descriptions below for historical reference. The above two commands are run on host "far-away. The stunnel. One can also create certificates signed by Certificate Authorities or self-signed if desired using the x11vnc utilities described there.
The nice thing is any SSL tunnel can be used because the protocol is a standard. For this example we'll also use stunnel on the viewer side on Unix. First start up the client-side stunnel version 3, not 4 : stunnel -c -d localhost -r far-away. Then point the viewer to the local tunnel on port vncviewer -encodings "copyrect tight zrle hextile" localhost That's it. Be sure to use a VNC password because unlike ssh by default the encrypted SSL channel provides no authentication only privacy.
With some extra configuration one could also set up certificates to provide authentication of either or both sides as well and hence avoid man-in-the-middle attacks. See the stunnel and openssl documentation and also the key management section for details. Much info for using it on Windows can be found at the stunnel site and in this article The article also shows the detailed steps to set up all the authentication certificates.
The default Windows client setup no certs is simpler and only 4 files are needed in a folder: stunnel. We used an stunnel. Note that this creates a separate x11vnc process for each incoming connection as any inetd x11vnc usage would , but for the case of normally just one viewer at a time it should not be a big problem. Somewhat sadly, the stunnel version 4 syntax is not so amenable to the command line or scripts. You need to create a config file with the parameters.
Where the file x11vnc. One nice thing about version 4 is often the PEM file does not need to be specified because stunnel finds it in its installed area. Commercial versions of VNC seem to have some SSL-like encryption built in, but we haven't tried those either and they probably wouldn't work since their proprietary SSL-like negotiation is likely embedded in the VNC protocol unlike our case where it is external.
But it can be done, and with a wrapper script on the viewer side and the -stunnel or -ssl option on the server side it works well and is convenient. One could probably do a similar thing with a. BAT file on Windows in the stunnel folder.
All binaries stunnel, vncviewer, and some utilities are provided in the package. SSL tunnels provide an encrypted channel without the need for Unix users, passwords, and key passphrases required for ssh and at the other extreme SSL can also provide a complete signed certificate chain of trust.
On the other hand, since SSH is usually installed everywhere and firewalls often let its port through, ssh is frequently the path of least resistance. The -ssl mode uses the www. The mode requires an SSL certificate and key i. These are usually created via the openssl 1 program in fact in for "-ssl" same as "-ssl SAVE" it will run openssl for you automatically.
So the SSL is not completely "built-in" since this external tool needs to be installed, but at least x11vnc runs it for you automatically.
In this case openssl 1 was used to create a PEM automatically. It will prompt you if you want to protect it with with a passphrase. Use "-ssl TMP" to create a temporary self-signed cert that will be discarded when x11vnc exits. This support is on by default when the -ssl option is in use and can be fine-tuned using these options: -vencrypt, -anontls, and -sslonly. A couple broken ciphers have also gone, most importantly though is that clients trying to connect to x11vnc will now have to support TLS if encryption is to be used.
You can of course always cook up your own build and run time OpenSSL 1. Viewer-side will need to use SSL as well. As seen above, the PEM privacy enhanced mail file does not need to be supplied if the openssl 1 command is available in PATH, in that case a self-signed, certificate good the current and subsequent x11vnc sessions is created this may take a while on very slow machines. In general, the PEM file contains both the Certificate i.
Because of the latter, the file should be protected from being read by untrusted users. The best way to do this is to encrypt the key with a passphrase note however this requires supplying the passphrase each time x11vnc is started up.
See the discussion on x11vnc Key Management for some utilities provided for creating and managing certificates and keys and even for creating your own Certificate Authority CA for signing VNC server and client certificates.
This may be done by importing the certificate into Web Browser or Java plugin keystores, or pointing stunnel to it. Here are some notes on the simpler default non-CA operation. This opens up the possibility of copying the server.
When authentication takes place this way or via the more sophisticated CA signing described here , then Man-In-The-Middle-Attacks are prevented. Otherwise, the SSL encryption only provides protection against passive network traffic "sniffing" i. Nowadays, most people seem mostly concerned mainly about passive sniffing and the default x11vnc SSL mode protects against it. They rely on the client not bothering to check the cert. One can test to some degree that SSL is working after starting x11vnc with the -stunnel or -ssl option.
After all of the debugging output and informational messages you'll see the string "RFB The older -stunnel option: Before the -ssl option there was a convenience option -stunnel that would start an external SSL tunnel for you using stunnel. The -ssl method is the preferred way, but for historical reference we keep the -stunnel info here. The -stunnel mode requires the stunnel.
For -stunnel to work the stunnel command must be installed on the machine and available in PATH note stunnel is often installed in sbin directories rather than bin. Note that the default "-stunnel" by itself creates a temporary cert as in "-ssl TMP". So a tunnel must be setup that you point the VNC Viewer to. As mentioned above the -httpdir can be used to specify the path to Or -http can be used to try to have it find the directory automatically.
We tested it this way: "java -cp. The Java viewer uses SSL to communicate securely with x11vnc. For this case the output will be something like this: x11vnc -ssl SAVE -http Indicating the two URLs the first one encrypted, the second not one could point the web browser at to get the VNC viewer applet. The https service provided thru the actual VNC port in the above example can occasionally be slow or unreliable it has to read some input and try to guess if the connection is VNC or HTTP.
If it is unreliable for you and you still want to serve the Java applet via https, use the -https option to get an additional port dedicated to https its URL will also be printed in the output.
Otherwise it must wait for a timeout to expire before it assumes a VNC connection. Perhaps you are using a web server proxy scheme to enter a firewall or otherwise have rules applied to the URL. You apply multiple applet parameters in the regular URL way, e. Here are some tips to getting working the first time afterwards you can incrementally customize with more complex settings. Just try a direct connection over your LAN first if you only have 1 machine and no LAN, just do a direct connection to the same machine: localhost.
If the LAN machine you run x11vnc on has its own host-level firewall most linux machine come with that on by default , disable it or at least let tcp ports through. But it can lead to timing and other problems. Otherwise as you are changing things the browser may "remember" failed applet downloads, etc. If you see it trying to download VncViewer. Get it working first before taking your time to read the details in the dialogs, etc. Just get the simplest connection working first and then incrementally add what you need.
Following the above guidelines, did it work? If so, Congratulations!! If you are having trouble even with the above baseline test case feel free to contact me please send the Full x11vnc output, not just part of it; the complete x11vnc command line; the URL s entered in the browser; the full Java Console output; and anything else you can think of.
Next, you can add the features you want one by one testing it still works each time. Next, turn on inetd if you intend to use that this can be tricky too, be sure to use -oa logfile and inspect it carefully if there are problems. If you are going to use non-standard ports e. Then enable the firewall, router port redirection channel you will somehow need to be outside to do that, maybe test that through another VNC session.
Then, if you plan to use them, enable "fancy stuff" like "-svc" or "-unixpw", etc, etc. Be sure to add a password either "-rfbauth" or "-unixpw" or both.
If you need to have the web browser use a corporate Web Proxy i. Ditto for the Apache portal. So in this example the user configures his router to redirect connections to port on his Internet side to, say, port on the internal machine running x11vnc. See also the -httpsredir option that will try to automate this for you. To configure your router to do port redirection, see its instructions.
Typically, from the inside you point a web browser to a special URL e. Look for something like "Port Redirection" or "Port Forwarding", probably under "Advanced" or something like that. Tedious Dialogs: If you do serve the SSL enabled Java viewer via https be prepared for quite a number of "are you sure you trust this site? Note that sometimes if you pause too long at one of the above dialogs then x11vnc may exceed a timeout and assume the current socket connection is VNC instead of the HTTPS it actually is but since you have paused too long at the dialog the GET request comes too late.
Often hitting Reload and going through the dialogs more quickly will let you connect. If you see in the x11vnc output a request for VncViewer. And here is a newer example including the Java Console output. The basic ideas of doing this were discussed for external tunnel utilities here. Note that on a Debian based system you will need to install the package stunnel4 not stunnel.
The first one is the default mode and accepts the x11vnc certificate without question. The second one is as the first, but adds the -encodings options to the vncviewer command line. The third one requires that the x11vnc server authenticate itself to the client against the certificate in the file. The fourth one is for VNC Viewer authentication, it uses.
One can supply both -verify and -mycert simultaneously. The fifth one shows that Web proxies can be used if that is the only way to get out of the firewall. If the "double proxy" situation arises separate the two by commas. See this page for more information on how Web proxies come into play. The applet is downloaded successfully through the browser using HTTP and the proxy, but when the applet tries to reconnect to the originating host the only one allowed by security it does not use the proxy channel.
So it cannot reconnect to the server the applet came from! We have found a convenient workaround: in the directory where VncViewer. Since the applet is digitally signed, there will be an additional dialog from the Java VM plugin asking you if you want to trust the applet fully. You should say "Yes". If you do, the applet will be run in a mode where it can try to determine the firewall proxy host name and port it will ask you for them if it cannot find them.
SSL is then layered over this socket. To do this you should use the proxy. For security, some most? In this case, the only thing to do is run x11vnc on that low port, e. If you do such a redirection to an internal machine and x11vnc is not listening on port , you will probably need to edit proxy. Suppose the SSL x11vnc server was listening on port You should change the line in proxy.
See also the -httpsredir x11vnc option that will try to automate this for you. You will need to configure apache to forward these connections.
It is discussed here. This SSL VNC portal provides a clean alternative to the traditional method where the user uses SSH to log in through the gateway to create the encrypted port redirection to x11vnc running on her desktop. Also see the desktop. Yes, see this page for how to do this and the utility commands x11vnc provides to create and manage many types of certificates and private keys. There are a number of ways to do this. The primary thing you need to decide is whether you want x11vnc to connect to the X session on the machine 1 regardless of who or if anyone has the X session, or 2 only if a certain user has the X session.
Xauthority the automatically started x11vnc will of course need to have sufficient permissions to connect to the X display.
The display manager scheme will not be specific to which user has the X session unless a test is specifically put into the display startup script often named Xsetup.
The command to be run in the. One user recommends the description under 'Running Scripts Automatically' at this link. Firewalls: note all methods will require the host-level firewall to be configured to allow connections in on a port. We describe two scenarios here.
The first is called 'One time only' meaning you just need to do it quickly once and don't want to repeat; and the second is called 'Continuously' meaning you want the access to be available after every reboot and after every desktop logout. One time only: If the X login screen is running and you just want to connect to it once i. Xauth -display Of course, the random characters in the file basename will vary and you will need to use the actual filename on your system.
Read your system docs to find out where the display manager cookie files are kept. Trick: sometimes ps 1 can reveal the X server process -auth argument e. If you do not want to run x11vnc as root, you can copy as root or sudo the auth file to some location and make it readable by your userid. Then run x11vnc as your userid with -auth pointed to the copied file. You next connect to x11vnc with a VNC viewer, give your username and password to the X login prompt to start your session.
Note: GDM: gdm seems to have an annoying setting that causes x11vnc and any other X clients to be killed after the user logs in. Otherwise, just restart x11vnc and then reconnect your viewer. Other display managers kdm, etc may also have a similar problem.
One user reports having to alter "gdm. Then restart dtlogin, e. The former is what GDM uses to kill the initial clients, use of the latter can cause a different problem: an Xorg server crash.
So with 0. Continuously: Have x11vnc reattach each time the X server is restarted i. To make x11vnc always attached to the X server including the login screen you will need to add a command to a display manager startup script. Please consider the security implications of this! The VNC display for the X session always accessible but hopefully password protected. Add -localhost if you only plan to access via a SSH tunnel. See the documentation for your display manager: gdm 1 , kdm 1 , xdm 1 , dtlogin 1 for additional details.
There may also be display number specific scripts: e. Xsetup, you need to watch out for. Note: You should read and understand all of the Note's and Update's in the 'One time only' section above. All of the GDM topics apply here as well:. Other display managers KDM, etc may also have a similar problem.
You may also want to force the VNC port with something like "-rfbport " or -N to avoid autoselecting one if is already taken. After rebooting the system it all seemed to work fine. If you do not want to deal with any display manager startup scripts, here is a kludgey script that can be run manually or out of a boot file like rc.
There is also the -loop option that does something similar. Important: Note that you must redirect the standard error output to a log file e. When you supply both -q and -inet and no "-o logfile" then stderr will automatically be closed to prevent, e.
Using inetd for this prevents there being a tiny window of opportunity between x11vnc starting up and your vncviewer connecting to it. Always use a VNC password to further protect against unwanted access. The above works nicely for GDM because the -auth file is a fixed name. Starting with x11vnc 0. Use the option -avahi same as -mdns or -zeroconf to enable it.
If the Avahi client library or build environment is not available at build-time, then at run-time x11vnc will try to look for external helper programs, avahi-browse 1 or dns-sd 1 , to do the work. The service was tested with Chicken of the VNC "Use Bonjour" selected on a Mac on the same network and the service was noted and listed in the servers list. It appears SuSE The easiest way to do this is via inetd 8 using the -unixpw and -display WAIT options.
The reason inetd 8 makes this easier is that it starts a new x11vnc process for each new user connection. Otherwise a wrapper would have to listen for connections and spawn new x11vnc's see this example and also the -loopbg option. Also with inetd 8 users always connect to a fixed VNC display, say hostname:0, and do not need to memorize a special VNC display number just for their personal use, etc. If applicable -unixpw mode , the program is run as the Unix user name who logged in.
Use it! The -unixpw option allows UNIX password logins. It conveniently knows the Unix username whose X display should be found. Note we have used the -find alias and the very long lines have been split. An alternative is to use a wrapper script, e.
In the first inetd line x11vnc is run as user "nobody" and stays user nobody during the whole session. The permissions of the log files and certs directory will need to be set up to allow "nobody" to use them. Note that SSL is required for this mode because otherwise the Unix password would be passed in clear text over the network.
In general -unixpw is not required for this sort of scheme, but it is convenient because it determines exactly who the Unix user is whose display should be sought. If you really want to disable the SSL or SSH -localhost constraints this is not recommended unless you really know what you are doing: Unix passwords sent in clear text is a very bad idea Similar looking commands to the above examples can be run directly and do not use inetd just remove the -inetd option and run from the cmdline, etc.
This is the only time x11vnc actually tries to start up an X server normally it just attaches to an existing one. For virtual sessions you will need to install the Xvfb program e.
By default it will only try to start up virtual non-hardware X servers: first Xvfb and if that is not available then Xdummy included in the x11vnc source code. Note that Xdummy only works on Linux whereas Xvfb works just about everywhere and in some situations Xdummy must be run as root.
An advantage of Xdummy over Xvfb is that Xdummy supports RANDR dynamic screen resizing, which can be handy if the user accesses the desktop from different sized screens e.
Where the very long lines have been split. See below where that long and cumbersome last line is replaced by the -svc alias. The above mode will allow direct SSL e. Unlike -create, this alias also sets up SSL encryption and Unix password login. Also if the env. You can set the env. If you do not plan on using the Java Web browser applet you can remove the -http and -prog option since this will speed up logging-in by a few seconds x11vnc will not have to wait to see if a connection is HTTPS or VNC.
To change the preference of Xservers and which to try list them, e. The "X" one means to try to start up a real, hardware X server, e. The user will have to supply his username and password one more time but he gets to select his desktop type so that can be useful. This seems to be:. Unless you are also providing XDMCP service to xterminals or other machines, make sure that the host access list only allows local connections the name of this file is often Xaccess and it is usually setup by default to do just that.
You may not need the -passwd. Recent RealVNC viewers might be this:! This way a bare X server is run with no window manager or desktop; it simply runs only the VNC Viewer on the real X server. The Viewer then draws the virtual X session on to the real one. Xclients, or something else. You will need to figure out what it is for your system and configuration. There may be a problem if the resolution WxH of the virtual X display does not match that of the physical X display.
If you do not want to or cannot figure out the X startup script name. Then in the lone xterm that comes up type "vnclocal" to connect to your virtual X display via x11vnc and vncviewer.
So it provides simple "terminal services" based on Unix username and password. The created X server sessions virtual or real hardware will remain running after you disconnect the VNC viewer and will be found again on reconnecting via VNC and logging in. The user does not have to memorize which VNC display number is his. They all go the same one e. One could do this in a shell script, but now there is an option -loop that makes it easier.
Of course when x11vnc restarts it needs to have permissions to connect to the potentially new X display. This mode could be useful if the X server restarts often. Use e. Also "-loop,5" to sleep ms and only restart 5 times.
One can also use the -loopbg to emulate inetd 8 to some degree, where each connected process runs in the background. It could be combined, say, with the -svc option to provide simple terminal services without using inetd 8.
Feel free to customize the default index. Also note that if you wanted to, you could also start the Java viewer entirely from the viewer-side by having the jar file there and using either the java or appletviewer commands to run the program. Proxies: See the discussion here if the web browser must use a web proxy to connect to the internet. It is tricky to get Java applets to work in this case: a signed applet must be used so it can connect to the proxy and ask for the redirection to the VNC server.
On Unix one starts the VNC viewer in listen mode: "vncviewer -listen" see your documentation for Windows, etc , and then starts up x11vnc with the -connect option. To connect immediately at x11vnc startup time use the "-connect host:port" option use commas for a list of hosts to connect to. The ":port" is optional default is VNC listening port is The -remote control option aka -R can also be used to do this during an active x11vnc session, e.
Also, note the "-rfbport 0" option disables TCP listening for connections potentially useful for reverse connection mode, assuming you do not want any "forward" connections. Many VNC servers do not require any password for reverse connections. Vncconnect command: To use the vncconnect 1 program from the core VNC package at www. If you do not have or do not want to get the vncconnect 1 program, the following script named "Vncconnect" may work if your xprop 1 supports the -set option:!
The default is to assume the proxy is a Web proxy. See the API documentation for a programming reference, the build howto for info on how to compile the libraries on your platform and the project news for a list of recent changes. This sample creates a x frame buffer in true colour.
There are 4 bytes per pixel, because 3 which are only used instead of all 4 is such an odd number. Then the server is initialized and a blocking event loop is started. If it is still running, go to the system tray, right-click the x11vnc icon, and choose Stop or use any other means you choose to kill the process.
Then while still in the Settings — Startup Applications screen, highlight the app and click the gear symbol at the bottom to test the launch. It should start in a few seconds. Then test connecting from a viewer to verify all is good. Not sure about other desktops. Works great when connecting from another Linux pc running Remmina. To tell the truth, I have switched over to AnyDesk for most of my remote access needs, but still have vnc running as a backup.
Good luck. Hi, Just installed Ubuntu Hello, I am trying to turn an old desktop into a server, I installed Ubuntu and now I want to have a vnc installed. The installation worked fine but I am stuck at the password, every time I try to create the password file it says it did so and it appears in the files but when I try to connect from a different device it always says that the password that I filled in is wrong.
I tried 4 different passwords removing things like. Works still great… Set it up in 5 minutes. I should add that I was working on as mentioned updating all systems and had installed Linux Mint It was working on my earlier systems.
I think it would be nice if you dedicated a liitle space to explaining your choice of options, what they all mean and do and why you choose them. It is by no means clear fro example why you elect to us -noxdamage and -repeat.
I was able to find a solution to why I was not getting x11vnc server to work. You may need to have the All users may connect to this network checked in the general tab of the Network Connections manager. This enabled the IP to be loaded before the x11vnc service. Thanks for your help.
I am able to use vncviewer with your setup. It still will not load at the login prompt. Any ideas on what I need to do to get the boot up functionality working? I am using LM Hi I am running into something strange that I could not work out: I have followed the installation in Lubuntu But I am not able to get it auto start. I have the same problem, very annoying. On one fresh linux box it works flawless, on the other fresh linux box i have this very same issue.
I had the same issue with running x11vnc when I tried the conf file. I setup the service file and could not get it to load. The issue I found was that I logged into my unbuntu desktop as user recorder but root was trying to run the service and attach to the desktop. This is what my service file looks like. The service then started at the user logged into the GUI and it worked! I am relatively new to linux and have just succeed get the VNC connection working.
Nevertheless, I am also interested in having the autostart working. Would you be so kind to help me find where and how to check for the autostart? I tried following all your steps still its not working. Sign in. Forgot your password? Get help. Password recovery. Training and Tutorials. Login to the other account without closing the terminal or logging off that account.