Tunnel vinagre-vino (VNC) through SSH
Remote desktop connections with VNC is very useful when you need to help regular users stuck on their desktop environment. Gnome provides vino-server and its client side vinagre as VNC implementations. But vino is not fully secured. The password check between client and server looks OK but once the connection is made, the stream between the two is not encrypted. Using it through internet may be risky so why not tunnel it all through SSH?
Pros and cons
- Harden vino authentication
- Encrypt stream between client and server
- A little bit geeky I agree but hey you are still reading!
How to procede
First of all we need to install vino an openssh on the server and vinagre and openssh on the client (Debian/Ubuntu users must be careful there: we need OpenSSH server part on the server and on the client side we need both the client and the server part). Archers can run:
On the server side:
On the client side:
We are then going to setup the server side: vino. This can be done with
vino-preferences: allow connections, and specify a password (this is optional as we will tunnel everything).
On the ‘client’ side, we need to forward some SSH to our host (here specified as the variable
-L: parameter for port forwarding from port
localhostand forward it to port
5900is the vino default port. Port
9999can be changed to any port you are allowed to use
-Ndo not execute a remote command (ie “you do not get a prompt on the remote machine”)
-C: compress data (optional)
On the client side we can now launch any VNC client and connect to
localhost:9999. With vinagre this would be:
You now should be prompted for your password if you set one up on the previous step. The client side may also be prompted for a connection authorization depending on what you configured. Click OK and you should see your remote desktop on a window.
Last but not least, let’s prevent connections to vino-server on the remote side from other places than localhost. It seems this option used to be available in vino-preferences but it disappeared in the latest versions. We are thus goinf to use dconf-editor to setup this:
Navigate the tree to the leaf
desktop/gnome/remote-access and set value
lo. This network interface is of course the localhost you can see when issuing
There. You might need to re-login or at least restart
/usr/lib/vino/vino-server for these last options to take effects. Once done you should get your fully secured VNC connection tunneled to SSH.
Note: Do not forget to kill the port forwarding after you are done using vinagre.
For automation, here is a script summarizing the client side: