Re: Blackberry vnc

[Sean Kamath]

On Jul 14, 2009, at 2:17 AM, jsethi...@gmail.com wrote:

> Where can I get the beta vnc enterprise viewer for blackberyy??

Heh.  I saw the announcement about the iPhone/iPop Touch version, and  
I'd love to give that a go. . .

Sean



___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: VNC keyboard/mouse problem

[Sean Kamath]

On Dec 23, 2008, at 8:26 AM, Levin, Gary Marc wrote:

I have tried to reproduce the problem with Eclipse running with the  
cygwin X
server as my display and the problem does not manifest itself.  This  
suggests
that while Eclipse is tripping the problem, there is some fault in  
Xvnc.


Is there some logging that can be turned on in Xvnc that would  
provide useful
information about what Eclipse is sending to the server that is  
resulting in

the problem?

Gary Levin
RRC 1N345
Telcordia Technologies


It's not eclipse.  It has to do with losing focus on the VNC window  
while a modifier key is pressed.  I.e., hold down 'control' inside the  
VNC window, switch out of that with (with CTRL-Tab, for example) and  
then go back into the session and your CTRL key might be "locked" on.   
You have to tap control or shift or alt to unstick it.


I have no idea what is a reasonable solution to this problem, as  
everything I can think of might not be what you want.


Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Shortcut switch to add listening client?

[Sean Kamath]

On Oct 24, 2008, at 12:55 PM, Cody Bennett wrote:


I work for a campus helpdesk where we use VNC to remotely control user
machines. At the moment, a user must drill into the sub-menu, find the
"run vnc server" shortcut and then add the client (me, running in
listening mode).

Here's the ideal situation:
   Find a shortcut that we could make available on the web - the user
clicks on the appropriate link, and magically a session is activated.
Something that would

Otherwise,
   I'd like to have the user switches needed to allow the client to
have an shortcut on their desktop that magically initiates the  
session.


I have tried using the -connect LISTENING_VIEWER_IP command, but that
doesn't seem to do the trick. It indicates briefly that the VNC server
is not available. If I set the shortcut to run with a -noconsole  
switch

only, the VNC server loads as expected. If I run with a -noconsole
-connect LISTENING_VIEWER_IP, I again get that error that it is unable
to locate an existing VNC Server.

Any thoughts of how to make my dreams into a reality? :)



My recollection was:  I made a PIF with "vncserver.exe -connect "  
and told people to launch it.  I made the PIF available on a web page,  
so people could download it if it wasn't already on their desktop.   
The listening server must already be running for the server to start,  
since with '-connect' you're telling it to connect, and if it can't  
connect, it exits.


But then I decided to try this.

Turns out the -connect option tells a *RUNNING* VNC service to  
connect.  I can't figure out how to start a server *and* connect in  
one step.


So I think the best you can do is have them install and configure the  
service.  Tell it to not listen or accept any connections.  *THEN* you  
can run 'vncserver -connect 

I've actually confirmed this.

You can actually have them start the service (once it's configured)  
with winvnc4.exe -start, then run winvnc4.exe -connect.  But you still  
have to configure it.


Alternatively, you can just run the server with 'winvnc4.exe', but  
that doesn't help much, since I can't figure out the windows  
equivalent of how to 'background' a process, thus allowing you to have  
the -connection option being given right after starting it.  Somehow,  
telling someone to run two commands kinda sucks.


Too bad there isn't a 'start the server and connect' option. :-(

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

The key-repeat problem on xorg VNC-enabled server

[Sean Kamath]

Hi.

We're looking at a site license for Enterprise VNC.  One thing I was  
hoping was fixed was the wacky key-repeat problem, which is only  
present when you add the vnc.so module to the xorg.conf file on Linux.


So, with these combinations:

RHEL WS4 U4, xorg-x11-6.8.2-1.EL.13.36, vnc-E-4.4.2.13160-1
RHEL WS4 U4, xorg-x11-6.8.2-1.EL.13.36, vnc-4.0-11.el4
RHEL5.2, xorg-x11-server-Xorg-1.1.1-48.41.el5, vnc-4.1.2-9.el5

they *ALL* do the same thing:  In a shell, hold the shift key down,  
hold down another key (like 'j'), let go the shift, then let go the  
other key.  Enjoy the string of j's.  If you hold down 'control' while  
the j's are furiously being put forth, it will switch to Control-j's.   
Let up the control key, and you'll be back to 'j's.


So, where, exactly, is this bug?  In Xorg?  Or VNC? Is it fixed  
anywhere?  Can it be fixed?


Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Using VNC (More) Securely...

[Sean Kamath]

On Aug 21, 2008, at 12:12 PM, Peter Bunn wrote:

The previous problem regarding port redirection has been solved and  
I'm

now running VNC over an SSH tunnel.

(Wow, huh?)

For whatever reason, efforts to use a non-standard VNC port in
conjunction with the tunnel failed, and I was advised to revert to  
port

5900... which I did... and all worked as hoped.

Though I did finally check "Only accept connections from the local
machine.", this was only a precaution after changing the port number  
in

RealVNC config back to 5900.

I have since closed the 5900 firewall port, and am running VNC on the
tunneled connection only.

In time, I will try to post a detailed 'how to' for my specific
circumstances, but it may be a while in coming.



I like to give out free SSH advice when I can, because I think  
everyone should use it. :-)


It's good to hear about CopSSH, because I've been looking for a good  
SSH *server* for the PC (now that I don't need it. :-)).


The general rule of tunneling with SSH is to do most of the steps you  
already did (and, yes, I know you have it working now; this is for the  
archives. ;-)):


1) SSH with no tunneling
2) use 'telnet' to see if the port connects, or if you're having a  
client-based issue.
3) Turn on verbosity on the client (-vvv is best, as it shows  
EVERYTHING) to see what SSH is doing.


Some thoughts on what you did:  The port you tunnel *TO* is not tied  
the one you tunnel *FROM*.  I.e., you used 23456 for both.  That's not  
a necessarily good port to use, since it's in a range used by  
processes for random things (called ephemeral ports, these are all  
over the map), depending on the system (but I'm pretty sure PCs use  
that range).  Also note, you don't have to go wild.


My strategy is to use 590N on client machines (just not the default,  
if I can avoid it, and sometimes I can't -- this is in case somehow  
the default port is enabled on routers), and then on my Mac I assign  
remote hosts numbers starting at 50.  Since I have LOTS of machines I  
tunnel to, this allows me to build a static list of hosts as  
localhost:XX for individual hosts.  I also use a config file to make  
the tunneling happen that much easier.  For example, I have this  
section in my config file (~/.ssh/config):


# Friend XYZ
host XYZ
 hostname ABC.dyndns.info
 localforward 5955 localhost:5900
 compression yes
 ForwardX11 no

Then, I just ssh to XYZ (which can *LITERALLY* be XYZ) which will  
connect to host ABC.dyndns.info and forward port 5955 (locally) to his  
machine's 5900 (a Mac running a VNC server).


Some clients (I don't know about the RealVNC viewer on a mac, since I  
don't have the Enterprise version) get confused by port numbers (some  
convert things below 50 or 100 as "displays", and everything else as  
ports, some simply use it as a "display" number (i.e., if you connect  
to localhost:1000, you'll get 5900 (base display) plus 1000 (display)  
or port 6000 (which is X, which won't work. ;-)).


So, if you use 'telnet' to confirm a connection, you'll skip the  
client problem above.  I.e., once you SSH to the remote host, you can  
do this:


{723}([EMAIL PROTECTED]) -> : telnet 127.0.0.1 5955
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
RFB 003.003
^]
telnet> close

Which shows the port being open, and connecting to an RFB server.

If you get this:

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.


It's because you managed to connect to the SSH tunnel (hence the  
"connected to" message, but the SSH tunnel couldn't complete the other  
side.  You'll get this message in the SSH output:


channel 3: open failed: connect failed: Connection refused


With ssh -vvv you'll see this:


debug1: Local connections to LOCALHOST:5955 forwarded to remote  
address localhost:5901

debug3: channel_setup_fwd_listener: type 2 wildcard 0 addr NULL
debug1: Local forwarding listening on ::1 port 5955.
debug2: fd 5 setting O_NONBLOCK
debug3: fd 5 is O_NONBLOCK
debug1: channel 0: new [port listener]
debug1: Local forwarding listening on 127.0.0.1 port 5955.

debug2: fd 10 setting TCP_NODELAY
debug3: fd 10 is O_NONBLOCK
debug3: fd 10 is O_NONBLOCK
debug1: channel 3: new [direct-tcpip]
channel 3: open failed: connect failed: Connection refused
debug1: channel 3: free: direct-tcpip: listening port 5955 for  
localhost port 5901, connect from 127.0.0.1 port 61305, nchannels 4

debug3: channel 3: status: The following connections are open:
  #2 client-session (t4 r0 i0/0 o0/0 fd 7/8 cfd -1)
  #3 direct-tcpip: listening port 5955 for localhost port 5901,  
connect from 127.0.0.1 port 61305 (t3 r-1 i0/0 o0/0 fd 10/10 cfd -1)


debug3: channel 3: close_fds r 10 w 10 e -1 c -1


Which should tell you almost everything you could possibly want to  
know about the connection problem.


Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from

Re: Using VNC (More) Securely...

[Sean Kamath]

On Aug 9, 2008, at 2:00 PM, Peter Bunn wrote:
But at this point, it has become difficult for my father to remember  
to

reliably click an icon to start the VNC server, so...


Hmm.  That does make it hard.  I set up a listening VNC viewer, and  
had my mother start the server and open the connection with a single  
application.  I put it on the quicklaunch bar, and that seemed to go  
well.  But. . .


(By the way, I don't think, at this moment, I have enough skill to  
set up

an SSH tunnel, so I am excluding that from consideration... even if it
might be the most secure option.)


I got so frustrated with my mother's machine because a PC doesn't have  
a native way to accept an SSH session.  She just bought a Mac, and I'm  
in heaven (comparatively, anyway).  The one option you could do is to  
have your Mac listen for an SSH connection and set up the tunnel, but  
that means your father would have to initiate the connection -- with  
the same issues from above. :-(



My questions are these:

- Do open ports - in and of themselves - constitute a security risk  
even
if there is no program listening on them?  Or, stated another way,  
if the

VNC server is *not* running is there a risk in having port 5900 open?
This is pertinent because I could open ports via a web remote access
service to initiate a VNC session, then close the ports at the end  
of the

session - OR - I could start and stop the VNC server via the same web
service.  But I don't know which - if either - would be an effective
means of reducing risk.


Generally speaking, having a port open with no service running on that  
port is not a security hole.  I say "generally", because you never  
know if you can gain exploit by using the replies from the computer  
stating that that port is closed (yeah, I'm generalizing and  
paraphrasing).


In this situation, I'd *both* start ad stop the port forwarding *and*  
stop and start the VNC server.  Both would reduce your exposure (since  
it's very easy to forget to terminate the VNC service, and if you have  
the port open all the time. . .


Of course, this becomes *MUCH* easier if you can script the "open the  
port, start the service" process.


- Would assigning VNC service to another port well outside the range  
of

the normal default (5900) offer any additional protection from an
'obscurity' standpoint?


I put all my VNC servers on something other than the default, since I  
just don't want to deal with all the traffic from probes.  My  
assumption is that there are people out there scanning 5900 on all  
machines.  If someone is trying to get in *YOUR* network, they'll  
portscan, and of course find 5903 or whatever you've chosen to use.



- My father's IP changes with almost every reconnect.  Does this
represent any advantage in terms of obscurity?


Only if there's someone out there trying to compromise your father's  
machine specificaly.  Otherwise, it's just an IP address someone is  
scanning by default.


- My own IP changes at the discretion of my ISP also, but usually  
falls
within a range of xxx.yyy.999.99, where xxx.yyy are pretty  
constant.  Can

I configure Access Control to accept VNC connections only within that
range without specifying the actual originating viewer IP?  The
documentation isn't clear to me on this point.


Depends on what's doing the restriction.  I don't know about VNC's  
access controls, since i don't use it (I always come in from one IP  
address, so I use access controls on the firewall/router.  Having said  
that, most firewalls/routers will allow either a IP range ornetmask.



- Finally, I would be happy to spend the money necessary towards the
RealVNC 'Enterprise' version, but given all of the above, I'm  
uncertain

it affords any more security 'between sessions' - that is, with ports
open and the server running... which is what would be most  
convenient for
me as the 'default' condition.  That when my father is simply using  
the
computer normally, the VNC ports would be open and the server  
running so

I could gain access readily at any time.


Well, if you shut down the VNC server while not in use, then of course  
the Enterprise version won't afford more protection -- it can hardly  
do so when it's not running. ;-)  But if the server is running?  Well,  
I don't know.  Perhaps.



PS - I am on a dialup at a max of 24K yet can still reliably access my
Dad's PC and do 'useful work' there... which I find little short of
amazing.  I'm grateful for the ability to do so.


Indeed, I started using VNC when I had a 24.4K Modem.  I'd used LBX  
(Low Bandwidth X), SerialXpress (A Tektronix X extension for slow  
links) and a few others (Timbuktu, anyone?) and VNC has rocked.


Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: vnc setup like gotomypc.com?

[Sean Kamath]

On Aug 5, 2007, at 7:39 AM, Shobuz99 wrote:


Sean,
What if one of Bruce's family members also has a router?


Doesn't matter.  Think of routers as diodes: They let traffic *out*,  
but not in.  When you *initiate* the connection, that forces the  
direction of the connection.  So if the family member's have a  
router, but they *initiate* the session, no issues.


It's basically easier to set up a receiver if you have control of  
your own router, and ignore other people's routers when you make them  
a sender.



If they do, then their port forwarding needs to be setup
so that Bruce can connect to whichever machine on their router.


See, my point was that Bruce doesn't do the connecting.  He does the  
receiving. :-)


I use a wireless Linksys WRT54GS at home, and I use a wired  
Linksys  BEFSR81 at work.
I had to configure both routers port-forwarding so that I can  
communicate between them,
depending where I am.. in the office or at home. Basically so they  
can both be servers.

when necessary.
Does your solution accommodate that situation?


No.  See above.

A better solution for work is to allow SSH into work, then tunnel the  
VNC connection or initiate the connection back through the work F/W  
to your house.



Have I misunderstood your answer to Bruce?


I think so. :-)

Sean


Rick (Shobuz99)

On Aug 4, 2007, at 7:31 AM, Bruce Pennypacker wrote:


Hi all,

As the techie in my extended family I end up fielding a lot of
support calls
from different family members.  I was thinking it'd be nice to be
able to
remotely access their machines from home if the need arises and in
general
VNC would be perfect for this. My only concern is poking holes
necessary to
enable this since it would involve dealing with different routers &
firewalls, DHCP, etc.  I was thinking that a service similar to
gotomypc.comwould make more sense.  Both they and I would connect to

 a

proxy server of
some sort that would establish the vnc connection from my machine
to their
machine.  I have a linux box with a static IP that I can set up as
a proxy
but I'm not familiar with any tools to do what I envision.  Are
there any
tools available like this?  Some sort of app that I can install on
a linux
server that one person could log in as a "server" and one as a
"client" to
establish a vnc connection between the two?

I know how to set up NAT routes, dynamic hostnames, etc. but I
really don't
want to go that way.  I'm specifically interested in whether or not
such an
application as I described exists.


Open a port on *your* router, then forward that port to your machine
you use VNC to control their machines.  Have them start vnc and
connect to a "listening client" and point to your machine (if
necessary, a dyndns hostname).

Then you never need to configure their routers/nat/firewall, and it
always "just works".

For a while, I dropped shortcuts or whatever they're called on PCs
(pifs?), that did winvnc4.exe -connect "my ipaddr", labeled them "get
help" and would tell my mother "click on get help". :-)

Sean


-
Park yourself in front of a world of choices in alternative vehicles.
Visit the Yahoo! Auto Green Center.
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: vnc setup like gotomypc.com?

[Sean Kamath]

On Aug 4, 2007, at 7:31 AM, Bruce Pennypacker wrote:


Hi all,

As the techie in my extended family I end up fielding a lot of  
support calls
from different family members.  I was thinking it'd be nice to be  
able to
remotely access their machines from home if the need arises and in  
general
VNC would be perfect for this. My only concern is poking holes  
necessary to

enable this since it would involve dealing with different routers &
firewalls, DHCP, etc.  I was thinking that a service similar to
gotomypc.comwould make more sense.  Both they and I would connect to a
proxy server of
some sort that would establish the vnc connection from my machine  
to their
machine.  I have a linux box with a static IP that I can set up as  
a proxy
but I'm not familiar with any tools to do what I envision.  Are  
there any
tools available like this?  Some sort of app that I can install on  
a linux
server that one person could log in as a "server" and one as a  
"client" to

establish a vnc connection between the two?

I know how to set up NAT routes, dynamic hostnames, etc. but I  
really don't
want to go that way.  I'm specifically interested in whether or not  
such an

application as I described exists.


Open a port on *your* router, then forward that port to your machine  
you use VNC to control their machines.  Have them start vnc and  
connect to a "listening client" and point to your machine (if  
necessary, a dyndns hostname).


Then you never need to configure their routers/nat/firewall, and it  
always "just works".


For a while, I dropped shortcuts or whatever they're called on PCs  
(pifs?), that did winvnc4.exe -connect "my ipaddr", labeled them "get  
help" and would tell my mother "click on get help". :-)


Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: VNC on Solaris - connection refused

[Sean Kamath]

On Mar 21, 2007, at 11:37 AM, Glenn wrote:

/home/glenn/.vnc/xstartup: xsetroot: not found
/home/glenn/.vnc/xstartup: xterm: not found
/home/glenn/.vnc/xstartup: twm: not found


So your VNC server fired up, tried to run the above, and instead of  
twm not exiting, xstartup exited, and your session died.


You need to make sure that /usr/X/bin is in the path ('PATH=$PATH:/ 
usr/X/bin' in xstartup), and that you've actually loaded the packages  
that have the X binaries.


Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Multi-user sessions using VNC on Mac

[Sean Kamath]

On Jan 24, 2007, at 8:43 AM, Jesse Heady wrote:


Is it possible to set up VNC on Mac and allow simultaneous private
sessions for users?  Is this only possible if each VNC user has their
own system login and VNC is run as a system service?  Ultimately we
would like to have our Mac available as a server for developers and
designers to login and test their work remotely as we have a
Windows/Linux development environment but need to test our work under
Mac.


What I do is have multiple users on my mac.  I have a Vine server  
running on the mac that is at :0 that is started at boot.  That  
service controls the screen.  Then, when the mac boots, I use that  
connection to log in as me, and start the vine server as me, but on a  
different port.  I then use fast user switching to switch to another  
user, and start a vnc server for that user on yet another port.


So :0 is the master
:1 is me
:2 is my grandmother

Yeah, it's not perfect, but it works.

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: VNC Server - MacOS 9

[Sean Kamath]

On Oct 28, 2006, at 1:08 AM, Sean Kamath wrote:

Anyway, here's some links:

http://www.redstonesoftware.com/products/vine/vineos9/index.html
http://www.chromatix.uklinux.net/vnc/download.html


Googling the filename, I found this:

http://www.mirrors.ausmac.net/AusMac/auslist.cgi? 
location=Communication-SW/MacVNC


Looks pretty complete. :-)

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: VNC Server - MacOS 9

[Sean Kamath]

On Oct 27, 2006, at 7:08 AM, Steve Quarrella wrote:


To remote into those as well.  I have googled VNC server for
OS 9 but the links seem to be coming up empty.


Dan...which files are you trying to find?  I played around with a VNC
server or two under MacOS 9 this last summer, and probably still have
all of the stuff I found (and you're right, in that I recall a lot of
broken links).  I'd be happy to cough up what I've got, and if someone
would like to host the files in a more permanent place, holler.


Nothing like supporting them old-time Operating Systems!  Try and  
find a good web browser or OS9 sometime. . .


Anyway, here's some links:

http://www.redstonesoftware.com/products/vine/vineos9/index.html
http://www.chromatix.uklinux.net/vnc/download.html

Somewhere, on some machine, I know I have the Mac OS 9 AT&T bits.  If  
you REALLY need it, contact me off list and I'll see if I can find  
some baby free time to send it out. . .


Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: excessive memory use in VNC server on Solaris

[Sean Kamath]

On Oct 6, 2006, at 12:15 PM, 77 D'~x 77 wrote:


Steve Waltner wrote:
PS: Is there any way to configure the vnc-list mailing list server  
to add [vnc-list] to the subject of e-mails? That would make  
sorting e-mails a lot easier.


Not that I know of -- it's bugged me too. However, if you can  
filter/sort by e-mail headers, the list server adds "vnc-list- 
[EMAIL PROTECTED]" as "Sender".


You should filter on the header List-Id, in this case "vnc- 
list.realvnc.com".


Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Linux -> Mac OS X connection problems

[Sean Kamath]

[In a message on Sun, 07 May 2006 19:48:13 EDT,
  Andrew Zirkel wrote:]
>OSX has a vnc server built in.  Go into your sharing prefs and turn  
>Apple Remote Desktop on.  It'll pop up a dialog asking for which  
>permissions to give local users.  Populate the VNC password field and  
>then a vnc client will be able to connect.  And yes you must be  
>running a server to connect, the client is just the viewer.

Only-kinda-sorta.

Pre-tiger, you didn't get ARD1.2, which was what you need for VNC
"compatibility".  And now that you've mentioned it, I fear poor Wez
will have to chime in an extole the evils of Apple's RFB
"compatibility".

In anycase, the issue still stands: Which server(s) are running on
which machines?

Sean

>On May 7, 2006, at 3:15 PM, Sean Kamath wrote:
>
>> [In a message on Sun, 07 May 2006 17:15:22 BST,
>>   Phil Dobbin wrote:]
>>> Hi, all.
>>>
>>> I'm trying to set up a Debian box running RealVNC (as server) to a  
>>> Mac OS X (1
>>> 0.4.6) box running Chicken of the VNC.
>>>
>>> Everytime I run:
>>>
>>> foobar #vncviewer
>>>
>>> from the Linux box and enter an IP address, vncviewer aborts. The  
>>> IP address i
>>> s assigned from a ADSL Router/Modem (i.e. Linux has 10.0.0.7, Mac  
>>> 10.0.0.6 and
>>> the router 10.0.0.138).
>>>
>>> If I try to connect Mac -> Linux I get a connection refused on  
>>> port 5900. I'm
>>> using the password set up in vncpasswd.
>>>
>>> A search of the mailing list archives turned up nothing, so any  
>>> help appreciat
>>> ed.
>>
>> I'm a little confused.  So the Mac is runnig CotVNC (which is a VIEWER
>> only), and the Linux box is running vncviewer as well.  Where's the
>> server?  You have to be running a server like OSXvnc on the Mac, and
>> you have to run vncserver on the linux box. . .
>>
>> Sean
>> ___
>> VNC-List mailing list
>> VNC-List@realvnc.com
>> To remove yourself from the list visit:
>> http://www.realvnc.com/mailman/listinfo/vnc-list
>___
>VNC-List mailing list
>VNC-List@realvnc.com
>To remove yourself from the list visit:
>http://www.realvnc.com/mailman/listinfo/vnc-list
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Linux -> Mac OS X connection problems

[Sean Kamath]

[In a message on Sun, 07 May 2006 17:15:22 BST,
  Phil Dobbin wrote:]
>Hi, all.
>
>I'm trying to set up a Debian box running RealVNC (as server) to a Mac OS X (1
>0.4.6) box running Chicken of the VNC.
>
>Everytime I run:
>
>foobar #vncviewer
>
>from the Linux box and enter an IP address, vncviewer aborts. The IP address i
>s assigned from a ADSL Router/Modem (i.e. Linux has 10.0.0.7, Mac 10.0.0.6 and
> the router 10.0.0.138).
>
>If I try to connect Mac -> Linux I get a connection refused on port 5900. I'm 
>using the password set up in vncpasswd.
>
>A search of the mailing list archives turned up nothing, so any help appreciat
>ed.

I'm a little confused.  So the Mac is runnig CotVNC (which is a VIEWER
only), and the Linux box is running vncviewer as well.  Where's the
server?  You have to be running a server like OSXvnc on the Mac, and
you have to run vncserver on the linux box. . .

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Re[2]: vncviewer Win - vncserver Mac

[Sean Kamath]

[In a message on Wed, 01 Mar 2006 12:23:01 GMT,
  "James Weatherall" wrote:]
>Zuzka,
>
>I'm afraid that there is no VNC server supplied with Mac OS X, so I'm not
>sure what it is that you're using, but it definitely isn't a standard VNC
>Server.  The closest thing I can think of is Apple Remote Desktop, which is
>based on VNC but isn't compatible with it.

Just for the mail archives:

If you use ARD2.2 or higher, you can check a box in the Access
Priviledges to allow VNC to connect.  I'm not sure what version of ARD
comes with Tiger, but my 10.4.5 allows this option.  So, yeah, it's
conceivable that "with the operating system" you can get a
VNC-compatible server.

>We have a VNC Server for Mac OS X in development, which we hope to make a
>beta-release available for shortly.

Ooooh.

>Cheers,
>
>Wez @ RealVNC Ltd.
>
>
>> -Original Message-
>> From: Zuzka Oplatkova [mailto:[EMAIL PROTECTED] 
>> Sent: 01 March 2006 12:16
>> To: James Weatherall
>> Subject: Re[2]: vncviewer Win - vncserver Mac
>> 
>> Ehm, strange, I followed the link on your pages.
>> http://www.realvnc.com/resources.html#osxviewer
>> but as I see the folloowing link is not on realvnc
>> 
>> http://sourceforge.net/projects/osxvnc/
>> 
>> So I used this one...
>> and also it was VNCServer directly in the OS which I get on my new Mac
>> computer. I just ticked taht I wanted VNC. So I dont know exactly what
>> is inside the OS.
>> 
>> Thank you
>> 
>> Zuzka
>> 
>> 01.03.2006, 12:55:18, you wrote:
>> 
>> JW> Zutka,
>> 
>> JW> We don't currently provide a VNC Server for Mac 
>> platforms.  Which VNC-based
>> JW> server software are you using on your Mac?
>> 
>> JW> Regards,
>> 
>> JW> Wez @ RealVNC Ltd.
>> 
>> 
>> >> -Original Message-
>> >> From: [EMAIL PROTECTED] 
>> >> [mailto:[EMAIL PROTECTED] On Behalf Of Zuzka Oplatkova
>> >> Sent: 01 March 2006 10:58
>> >> To: vnc-list@realvnc.com
>> >> Subject: vncviewer Win - vncserver Mac
>> >> 
>> >> Hello,
>> >> 
>> >> does anybody know what can cause unknown message type 255??
>> >> It appears when I try to connect from windows viewer to mac server.
>> >> The strange is taht the communication is normal when the 
>> server sends
>> >> request for password. After that the window with remote 
>> desktop of Mac
>> >> computer is rendered,I see also the name of the window.but 
>> in one or
>> >> two seccond it is closed with unknown message type 255
>> >> I cant find where is the problem :-(
>> >> Does anybody know
>> >> 
>> >> Thank you.
>> >> 
>> >> Zuzka
>> >> 
>> >> 
>> >> 
>> >> 
>> >>  Information from NOD32 
>> >> This message was checked by NOD32 Antivirus System for Linux 
>> >> Mail Server.
>> >> http://www.nod32.com
>> >> ___
>> >> VNC-List mailing list
>> >> VNC-List@realvnc.com
>> >> To remove yourself from the list visit:
>> >> http://www.realvnc.com/mailman/listinfo/vnc-list
>> >> 
>> 
>> 
>> 
>> ---
>> Zuzana Oplatkova
>> Lecturer
>> 
>> email: [EMAIL PROTECTED]
>> GSM: +420 604 741 178
>> ICQ#: 69798822
>>  
>> Faculty of Applied Informatics
>> Tomas Bata University in Zlin
>> Nad Stranemi 4511
>> 762 72  ZLIN
>> Czech Republic
>> 
>> tel: +420 57 603 5190
>> 
>> 
>> 
>>  Information from NOD32 
>> This message was checked by NOD32 Antivirus System for Linux 
>> Mail Server.
>> http://www.nod32.com
>___
>VNC-List mailing list
>VNC-List@realvnc.com
>To remove yourself from the list visit:
>http://www.realvnc.com/mailman/listinfo/vnc-list
>

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: vnc over ssh with non conventional ports

[Sean Kamath]

[In a message on Fri, 28 Oct 2005 23:47:51 +0200,
  Jerry Westrick wrote:]
>On Saturday 29 October 2005 00:04, Sean Kamath wrote:
>> >>Add following lines:
>> >>
>> >>Host Some.Where.In.Internet
>> >>   Port 9
>>
>Sorry to disagree sean but:
>
>adding the above 2 lines will cahnge ssh for everyone, yes,
>but only for host: Some.Where.In.Internet
>
>And I disagree about the user settings, as the host only accepts ssh 
>on that port (no matter who connects), I think that is the right place.

Gack.

I'm an idiot.  I missed the Host line in the global file.  Someone
take me out and shoot me -- I'm done.

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: vnc over ssh with non conventional ports

[Sean Kamath]

[In a message on Wed, 26 Oct 2005 21:05:35 -0300,
  Fernando Sfeir wrote:]
>Jerry Westrick wrote:
>
>>The way I do it is a little diferent, but IMHO better.
>>as root Edit /etc/ssh/ssh_config
>>
>>Add following lines:
>>
>>Host Some.Where.In.Internet
>>   Port 9
>>  
>>
>
>This is exactly that i need. Thank you so much, and, obiusly, to any 
>that take care (and time) to reply this question.
>Work perfectly!!!

Uh,

No, don't tell people to do this.  I realize that everyone thinks
linux is a single-user environment, but it's not, and the last thing
the world needs is someone to read this and think this is the right
way to do it.  You'll change it for everyone, for every host.  bad bad
bad.

That's what ~/.ssh/config is for. Even the manual page for ssh_config
says that this is the per user configuration file.  

And, with the config file, you can specify settings for just a single
host (or, you can have multiple settings for the same host).

Example:

-cut-here-
# everything up to the first 'host' line is
# global
Protocol 2

#cmd "ssh foo" goes to bar
host foo
 hostname bar.domain.name

#cmd "ssh bar" turns on compression
host bar
 compression yes

# Use non-startardport name
host funky-host-non-standardport
 hostname ip_or_FQDN
 compression yes
 port 9

# Just do everything
host host-vnc
 hostname host
 user my-remote-username
 compression yes
 port 9
 localforward 5900 otherhost:5900

-cut-here-

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Optimization recommendations under Mac OS X

[Sean Kamath]

[In a message on Wed, 12 Oct 2005 08:22:07 EDT,
  "Michael T. Davis" wrote:]
>   I'm using VNC Viewer v4.1.1 under WinXP Pro to talk to a Mac OS X
>v10.3.9 system via the Apple Remote Desktop v2.2 "client" (server, really).
>What tweaks can I make to the Mac OS X system to minimize the lag caused
>by the Mac OS X GUI when viewed over the VNC connection?  Are there any
>settings (public [in the Viewer] or private [in the registry]) that could
>be applied to help matters, here?  FWIW, my VNC connections are typically
>carried via IPSEC VPN or SSH.

In rough order of "speed" improvement

*) Remove all backgrounds/wallpapers on the Mac (my wife has her's
   change every *minute*, with a huge photo fading in all the time --
   it's enough to drive me batty).  I don't know if ARD has an option
   to remove the desktop picture, but that's a HUGE help.

*) Drop your color to the lowest you can live with.  I often times
   will drop to 256 colors, as that's often about 300% faster than 24
   bit color. ;-)  You can do this in the viewer or the server, but
   you'll annoy the user at the remote mac less if you do it in the
   viewer.

*) Change the encoding.  You'll have to fiddle with this a little bit,
   since a lot depends on the system (a 233MHz iMac is going to have
   some trouble doing tight encoding as opposed to that shiney new
   G5).  I played around a lot with different encodings to see what
   was "optimal" (in terms of response time) for my systems (I
   ran Hextile over a WAN link to an Ultra 1 for a long time, as that
   was pretty much the best setting).

*) Compress your SSH stream.  Dunno about IPSEC VPN settings (I just
   set up IPSec on my OpenBSD machines, so I haven't had time to play
   with it).

In summary:

Reduce what you need to send, and find the best way to encode what you
do send. :-)

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: TightVNC, XVnc & Solaris 9

[Sean Kamath]

[In a message on Thu, 30 Jun 2005 11:38:23 EDT,
  DL Hanna wrote:]
>Greetings,
>
>I have searched the list/web and have found some posts regarding the same
>problem (on Solaris 8) but found no solution. Has anyone figured out how to
>solve the following error in Solaris 9?
>
>ld.so.1: Xvnc: fatal: libjpeg.so.62: open failed: No such file or directory
>
>I've installed jpeg-6b-sol9-sparc-local.gz from
>sunfreeware.comand the source (d/l from
>tightvnc website) compiled and installed okay, but
>when I try to run vncserver the aforementioned error is displayed. This file
>exists on my system (in more than one location) but obviously not where
>vncserver (Xvnc) is expecting it to be.

1) LD_LIBRARY_PATH=/path/to/dir/with/library
   export LD_LIBRARY_PATH
   vncserver

2) crle -u -l /path/to/dir/with/library

3) cd /usr/lib
   ln -s /path/to/dir/with/library/libjpeg.so.62

The latter two you only need do once.  Most of these things can be
found in /usr/sfw/lib (if you loaded the optional extra stuff there),
and 2) can be handy for that.

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: VNCThing - Mac OS 9

[Sean Kamath]

[In a message on Wed, 22 Jun 2005 07:56:54 PDT,
  [EMAIL PROTECTED] wrote:]
>Greetings...
>
>I have a need for a VNC viewer for Mac OS 9.  Browsing the various FAQs,
>I see that VNCThing would fit the bill, but 1) www.webthing.net appears
>to be up for sale, and doing a STFW turns up plenty of hits on the
>name, but no actual files (any download sites I've encountered simply
>point back to www.webthing.net).  Is there anywhere I can dig up a copy
>of this software, or is there a little story here? :-)  Thanks in
>advance!

Here you go.

ftp://ftp.volftp.mondadori.com/pub/mac/comm/network/vncthing_2.2.sit.bin

Here's how I found it:

google for "vncthing"
take any page that pointed to purple shark software's web pages, and
get the actual download file
google or 'vncthing_2.2.sit.bin'
Wade through italian web pages hoping I'm click on the right links
(they were all buttons, so the babelfish was no help there. . .)

I downloaded a copy as well, and will likely put it up on my .mac
homepage if I see any more requests for this. . .

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: vnc on solaris 8, can't get rid of grey x session

[Sean Kamath]

[In a message on Mon, 13 Jun 2005 18:40:52 CDT,
  pheonix1t wrote:]
>I had another box where i left the twm and ran vncserver sessions.
>
>Then I tried changing the vncserver script to be like above, but it 
>still gives me the old grey X session.
>...
>I think I'm pretty close to getting dtsession to come up instead of grey 
>X session but I'm at a dead end.
>HELP!!

What did the log file say (should be in the .vnc directory named
:.log)?

I use the following in my xstartup (well, this is the cde startup):

DTXSERVERLOCATION=local
export DTXSERVERLOCATION
OPENWINHOME=/usr/openwin
export OPENWINHOME
LANG=C
export LANG

xrdb $HOME/.Xresources
xsetroot -solid grey
/usr/dt/bin/dtsession

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: MAC OS 9.x VNC and WinXP.....

[Sean Kamath]

[In a message on Thu, 02 Jun 2005 15:53:46 EDT,
  "Edwards, Tom M" wrote:]
>Anyone tried using a VNC app on a MAC OS9.x machine talking to a WinXP
>machine? We have a pretty good interface between our G4 single CPU 733MHz
>OS9.2.2 machines and a Dell PIII 400 Win2K system using RealVNC on the PC
>side and XXX on the MAC side.
>Yesterday we tried connecting to a single CPU P4 2.4GHz WinXP Pro SP2
>machine and it was too slow for any reasonable use. I decreased desktop to
>800x600 and 16bit color depth on the PC and on the MAC set the video to
>thousands of colors rather than millions - still too slow in updating the
>screen for practical use.
>
>Any other suggested settings or apps that have better performance?

What VNC app are you using on the Mac?  VNCThing is pretty good for 9.X.

You'll likely find that changing from zlib to hextile or other
encoding will greatly help.

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Vnc server on SunRay system

[Sean Kamath]

[In a message on Wed, 01 Jun 2005 13:57:41 BST,
  "James Weatherall" wrote:]
>Better still, you could get vnc.so loaded into the SunRay's X servers if
>they support loadable modules?

They do, but it's undocumented, and no one seems to know what the
trick is.  I had Solaris 8 source (well, still have it), but haven't
had time to muck with it.  I'm hoping the source release of Solaris 10
will make this pretty easy to do. . .

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Arbitrary Port use - simi solved.

[Sean Kamath]

[In a message on Fri, 06 May 2005 10:50:36 CDT,
  Tony wrote:]
>Now, my problem comes in that I want to use STRCM to manage the 
>install/uninstall and it still only
>supports port offsets.

I used to run into this all the time forwarding X sessions.  Some apps
unknowingly support negative offsets.  I.e., to get port 2000 from
something expecting 6000 + Offset, use an offset of -4000.

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: VNC connection lost when initiating telnet session quits- solution!

[Sean Kamath]

The Borne shell doesn't do job control.  No "nohup" command will
insulate against SIGTERM, it only protects against SIGHUP (hence the
name).  I'm completely confused why the sh would send a TERM to the
processess.

It could be that the processes are sending a request to go in the
background (SIGSTOP) and the sh is terminating them instead.  I'll see
if I can duplicate the behaviour and see what's causing this problem,
but it sounds like you have a workaround.

Sean


[In a message on Fri, 29 Apr 2005 18:29:03 EDT,
  Dr Robert Young wrote:]
>Launching the vncserver from the csh seems to work, and the apps appear 
>to remain alive after the telnet session is exited.
>
># csh
>ultra10# /usr/local/bin/vncserver
>
>New 'ultra10:1 (root)' desktop is ultra10:1
>
>Starting applications specified in //.vnc/xstartup
>Log file is //.vnc/ultra10:1.log
>
>ultra10#
>
>When the telnet connection is now broken, the vncserver and its apps 
>continue to operate normally.  Apparently the 'C' shell is insulating 
>the programs, while the /sbin/sh does not.
>
>We live...we learn
>
>
>
>
>
>On Apr 29, 2005, at 4:59 PM, B. Scott Smith wrote:
>
>> Try preceding the command with "nohup". For example, "nohup vncserver 
>> :1"
>> Then it should be unaffected when you log out.
>>
>> Audsin dev wrote:
>>
>>> Hi
>>>
>>> Same thing happens when i start the vncserver from the
>>> ssh terminal and then log off. I find that Xvnc is
>>> running and able to log in but the windows manager
>>> some how is unable to start
>>>
>>> Any suggestion
>>>
>>> Regards
>>> Dev
>>>
>>>
>>> --- Dr Robert Young <[EMAIL PROTECTED]>
>>> wrote:
>>>
>>>
>>>
 Same thing happens when I start vncserver from the
 system console, and
 then "exit" the terminal session in which I started
 it.
 ___
 VNC-List mailing list
 VNC-List@realvnc.com
 To remove yourself from the list visit:
 http://www.realvnc.com/mailman/listinfo/vnc-list



>>>
>>>
>>> __
>>> Do You Yahoo!?
>>> Tired of spam?  Yahoo! Mail has the best spam protection around
>>> http://mail.yahoo.com
>>> ___
>>> VNC-List mailing list
>>> VNC-List@realvnc.com
>>> To remove yourself from the list visit:
>>> http://www.realvnc.com/mailman/listinfo/vnc-list
>> ___
>> VNC-List mailing list
>> VNC-List@realvnc.com
>> To remove yourself from the list visit:
>> http://www.realvnc.com/mailman/listinfo/vnc-list
>>
>>
>
>
>
>
>Dr. Robert Young
>ALI Database Consultants
>1151 Williams Dr
>Aiken SC 29803
>USA
>
>WWW: http://www.aliconsultants.com
>Tele: 1-803-648-5931
>Toll free in US: 1-866-257-8970 Fax:1-803-641-0345
>Email: [EMAIL PROTECTED]
>"Source of Rdb Controller, software for database analysis &  
>performance tuning"
>___
>VNC-List mailing list
>VNC-List@realvnc.com
>To remove yourself from the list visit:
>http://www.realvnc.com/mailman/listinfo/vnc-list
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: VNC connection lost when initiating telnet session quits

[Sean Kamath]

I have a vague recollection of process leader problems with telnet (I
too use SSH, as it is the only reasonable way to go these days. ;-)).

Try this:

 $SHELL
 vncserver 
 exit
 ps -ef | grep Xvnc
 ptree 

Make sure that Xvnc has all the appropriate processes running. ;-)

Sean

[In a message on Fri, 29 Apr 2005 08:54:54 EDT,
  John Aldrich wrote:]
>That's strange... On my linux box, I can log out of all SSH sessions (I
>don't "do" telnet for security reasons!) and my server stays up and running.
>It almost sounds like the X session is checking to make sure the user who
>started the session is still logged in and is using their defaults, but when
>the user logs out, it doesn't know what window manager to use.
>   John
>
>-Original Message-
>From: Dr Robert Young [mailto:[EMAIL PROTECTED]
>Sent: Friday, April 29, 2005 8:24 AM
>To: vnc-list@realvnc.com
>Subject: VNC connection lost when initiating telnet session quits
>
>
>Let's say I start the vncserver from an initial telnet session.
>
>Using the  VNC server for Solaris 7, the same session "stays" open when 
>I start/stop the VNC client.  So far it behaves as expected.
>
>However, if I exit the telnet session which started the server,  all 
>the desktop apps "disappear" and I have a grey backdrop. If I then 
>"kill" the server, the client says the server connection has been 
>terminated.
>
>I have tried "nohup vncserver &" with the same results, and started the 
>window manager /xterm in xstartup using nohup ---& as well with the 
>same results. .
>
>Any ideas? I have a nagging feeling I have seen something like this 
>before 10-15 yrs ago, but memory fails.
>___
>VNC-List mailing list
>VNC-List@realvnc.com
>To remove yourself from the list visit:
>http://www.realvnc.com/mailman/listinfo/vnc-list
>___
>VNC-List mailing list
>VNC-List@realvnc.com
>To remove yourself from the list visit:
>http://www.realvnc.com/mailman/listinfo/vnc-list
>

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: VNC Security

[Sean Kamath]

[In a message on Tue, 19 Apr 2005 21:14:50 EDT,
  "Steve Bostedor" wrote:]
>I am wondering why expose VNC over the internet in the first place, really.

Exactly what I said.  VNC should *NOT* be exposed to the internet.

>It's my opinion that VNC is really only good for LAN's.  Why not use VPN to sec
>ure your connection to the remote network before starting VNC sessions?  It's 
>much easier to set up on a LAN where you need VNC access to 200 computers than
> setting up SSH over the Internet!

Uh. . . OK, the REALLY nice thing about VNC is that it beats LBX (Low
Bandwidth X) as a means of displaying applications remotely.  In fact,
having tried raw X, LBX, Serial Xpress, Timbuktu and VNC, I can safely
say it is the BEST to use over 28K dialup lines. ;-)

When you tunnel with SSH, you in effect are creating a VPN to your
remote network, only without all the hassled of setting up VPNs.  At
OsCon this year, they apparently (accidently?) blocked GRE traffic off
the wireless network -- of the three people from my (ex) company, I
was the only one who could still connect back to the office and fix
things. :-)

If you REALLY think it's easier to set up VNC to access 200 computers
(insane, if you ask me.  By the time you get to the high 10s of
computers, you had really better have set up alternative
administration mechanisms -- which is not to say that using VNC as a
diagnostic tool on those same 200 machines isn't a good idea) than
setting up an SSH tunnel, well, then, either you just have no
experience with SSH or you didn't read the docs well enough. This too
can be automated. :-)

Of course, if you're implying I set up a VNC connection over SSH for
each of 200 computers, yeah, you're right, that's insane.  But VNC is
MOSTLY good for spot-maintenance.  If you want to graphically control
200 machines simultaneously, no, SSH isn't a good fit.

>I can concede that VNC data should be encrypted in some way when traveling the
> Internet but why do people set up VNC over SSH on local networks?  That reall
>y makes very little sense to me.  If your network is so insecure that you're w
>orried about your VNC traffic being hacked, you've got some pretty big problem
>s!

OK, let's look at this statement.  You work for a large multinational
organization, with REAL privacy concerns (HIPPA anyone?  Banking?
Sarbanes-Oxley?).  You have people VNC'ing all over the place.  And
you have PC's indiscriminately running services on PC's acting as
servers that really shouldn't be.  Now you have PC's on server
networks that can be hacked.  You have people running sniffers on
their desktops.  You have basically *who knows what* between you and
the VNC desktop you're controlling.

Now, do you NEED encryption?  No.  Do you REALLY trust the routers and
switches to not have their buffers fill up and start broadcasting all
packets to every interface?  If so, you drank Cisco's Kool-Aid(tm).

Just like we completely phased out telnet and rsh (in favor of SSH),
why not phase out non-encrypted VNC connections?  Frankly, I have to
admit, I REALLY don't understand why RealVNC hasn't added either a
STARTTLS option to VNC, or otherwise added TLS a an option (OK, yeah,
it's a certificate problem, but still, you could incorporate your own
CA in your viewer).

Basically, if 80% of intrusions come from inside your network (and
they do, from your so-called "trusted" employees) why not do what you
can to prevent over-the-wire attacks?  It's cheap and easy.

>I connect to a network via VPN and others I connect using encrypted RDP sessio
>ns.  Once I've made those connections, I can safely use VNC on the remote netw
>orks.  Why waste all of this time with SSH on Windows computers all over the n
>etwork when VPN and RDP is so easy to set up?

Because some of us avoid Windows with a ferver you can only imagine.
I don't (I have a mild aversion to Microsoft, thought I abhore all
forms of Windows).  But I *DO* have to support Suns and Macs and a
bunch of other things.  And screwing around with a VPN connection from
my friends Mac when I'm playing with my band on Tuesday night just
doesn't cut it ("Hay, dude, can I load this stupid Cisco VNC client on
your Mac?  Don't worry, it will only take 5 minutes to download, about
10 to set up, about 2 to do what I need, and another 10 or so to
remove it").  Typing "ssh remotehost" in the terminal cuts it.

And, keep in mind, you can SSH to one host and forward to another.
So, you don't need to set up SSH on a Windows computer (Putty on the
client is all your need, if you're running Windows -- or, if you don't
want that, try MindTerm -- works great from internet cafes ;-)).  One
unix box on the remote end, and you can connect to anything on the
other side. :-)

Note, I'm not trying to be snippy here.  I know I might sound like
it. It's just that I fought (and lost, which is why it's my *ex*
company) for allowing SSH in remotely to my company.  They idiotically
expected every person to have a PC running Windows to connect
r

Re: VNC Security

[Sean Kamath]

[In a message on Tue, 19 Apr 2005 10:53:09 EDT,
  "William Hooper" wrote:]
>Steve Bostedor wrote:
>[snip]
>> I've scoured the web out of this curiosity, looking for a tool to
>> put VNC packets together into something useful for a hacker. There's
>> nothing.  Nada.
>
>Fifth hit on Google for: vnc capture playback
>
>http://users.tpg.com.au/bdgcvb/chaosreader.html

Google is your friend.  Of course, knowing the right phrase or
keywords makes it nice. ;-)  That's a very interesting tool, which
should put the fear of the Internet in everyone. . .

Another reason for tunneling VNC over SSH is this: My firewall only
exposes a select few protocols to the outside world.  If it weren't
for the fact I have to support other people, I'd likely ONLY have SSH
exposed to the world.  Instead I have to have POP/IMAP, SMTP,
etc. . .

The fewer things you expose to the outside Big Bad World, the better.

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: What good is VNC's GPL?

[Sean Kamath]

[In a message on Thu, 07 Apr 2005 22:05:40 +0200,
  Yann Renard wrote:]
>Grant McDorman wrote:
>> Actually,  they could claim that that's for "compatibility. Look at what 
>> was done for PearPC/CherryOS to see a more reliable method: search the 
>> binary for strings (messages, diagnostics, function names [where 
>> supported by the platform], etc.) If those are all identical, then 
>> you've pretty much got a case.
>
>How could someone claim bug-compatibility ?! This sounds crazy, isn't it 
>? ;)

Most (almost all) VT100 and VT220 emulators had a "enable bugs"
version.  Sometimes it's necessary.  Look at how web designers have
come to rely on a set of IE bugs to get IE do the right thing
(and, humorously enough, in IE6, they fixed the bug used for
detection, but not the bugs that the detection avoided -- see 
http://www.meyerweb.com/eric/css/edge/complexspiral/demo2.html.  They
have an option to emulate easlier versions, but it doesn't emulate the
bugs.).


Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Anyone read docs?

[Sean Kamath]

[In a message on Mon, 04 Apr 2005 08:13:02 PDT,
  "Collins, Kevin (MindWorks) [Contractor]" wrote:]
>I have been on this list for a couple months now and I am amazed at the
>number of people who do not read the documentation but have the nerve to
>come here and ask everyone else to do it for them. I mean, it takes more
>work to subscribe and post to the list than it does to read the
>instructions on using VNC.
>
>Sorry for the rant, but I needed to blow off some steam... Is it just
>me?  :)

No, it's not just you.  I, too, have been on this list for a couple of
months, and, while it's been very helpful to me, the amount of newbie
questions is huge, along with the off-topic emails.

Perhaps a FAQ, gleaned from the repeated questions, could be set up,
and emailed to the list.

Also, this list is archived.  We should be pointing people to that, as
well as the FAQ.

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: What good is VNC's GPL?

[Sean Kamath]

[In a message on Sun, 03 Apr 2005 20:15:08 CDT,
  Tim Meador wrote:]
>Actually, I'd like to see an anwer to this myself.  There was no
>attempt to clarify the use of GPL code, just a friggin' "It ain't none
>of your business, so shut up!"  Well, it IS our business.  The GPL
>license and enforcement of it affects all of us, not just programmers.

Sigh.  This list already has a pretty bad S/N ration, what with all
the Windows "I can't see my home box from grandma's" (because they
don't understand NAT/Firewalls).  Let's not go there with the GPL,
please.

For those of you Google-y challanged, here are some sites:

>From the horse's mouth:
http://www.gnu.org/licenses/gpl-faq.html

If you think there's been a violation:
http://gpl-violations.org/

If you want to read more about it:
http://www.groklaw.net/staticpages/index.php?page=20050131065655645

If you demand having this sort of discussion, first read this:
http://developers.slashdot.org/article.pl?sid=05/03/18/0315241&tid=117&tid=156&tid=17

Then go here:
http://slashdot.org/

Can we move on to VNC issues, please?  Thanks.

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Root GUI access?

[Sean Kamath]

I gotta say, after 20 years of supporting X-based environments, that
putting *ANYTHING* into shell startup files that diddles X settings is
a mistake.  You'll regret it.  And someday, when you forget, and have
a friend logged into your box, they'll tweak you by inverting your
screen (yeah, I've done it -- a LOT. :-)).

The absolute correct thing to do is figure out why you're not getting
correct information installed in the .Xauthority file to connect to
the X server.  Either something's wrong in the PATH, there's something
not being called, or there's a permissions issue (my Xvnc runs with
-auth /home/kamath/.Xauthority).

If you MUST diddle X settings, then either do it from the X
initialization files (like .xinit, xstartup, or the .dtprofile (for
Sun CDE sessions)).  Then they only happen once per login (which is
what you want).

If you can't figure those out, then at least *wrap* the settings in
.login/.profile/.bashrc so you a) only do it once, and b) don't do it
unless you have an X session of some sort running.

Yeah, I know, not really important if you have one lonely PC doing
nothing but being your only machine.  But if you're running VNC, then
you have at least two computers (:-)).  And it's a REALLY bad habit
to get into, and hard to break.  And some someday it will burn you.

It's frustrating as an SysAdmin for large heterogeneous environments
to deal with OSes, Users and Applications that assume
user=machine=session.  Linux is only slowly getting out of this mode.
And the X stuff, whilst moving forward in features and usability, has
*REALLY* slid backward in the last 5-10 years in terms of multiple
users/desktops/machines.

Just my $0.02.

Sean

[In a message on Thu, 31 Mar 2005 08:10:28 PST,
  "Collins, Kevin (MindWorks) [Contractor]" wrote:]
>Good to know. Keep in mind that in a multi-user environment, putting
>that xhost command in /etc/bashrc has far reaching implications as it
>allows anyone on the machine to send an X app to your (or any other
>user's) desktop.
>
>Kevin
>
>-Original Message-
>From: Stephen Hinton [mailto:[EMAIL PROTECTED] 
>Sent: Wednesday, March 30, 2005 5:44 PM
>To: Collins, Kevin (MindWorks) [Contractor]; p putkowski
>Cc: vnc-list@realvnc.com
>Subject: Re: Root GUI access?
>
>
>Got It!
>
>Many Thanks to Kevin C and P Putkowski!
>
>Symptoms:  You can log in remotely as any user.  If you log in as root
>you can run all commands and gui utilities.  If you log in as non-root
>gui utilities requiring administrator privleges will not display.  The
>GUI dialog box promopts you for the root password and accepts it, but
>the utility window doesn't load.  You can su as root in a terminal
>window and run text-based privleged commands.
>
>Problem had to do with the localhost net being authorized to connect
>to the X-Server
>
>Key error message was:
>Xlib: Client is not authorized to connect to Server
>
>Putkowski: Can you tell me where you found that error message (maybe
>i'll learn to troubleshoot my own problems)?
>
>Solution: put command 'xhost +localhost' in the /etc/bashrc file
>
>You could just run this command once each session, or put it in the
>.bashrc of only users you want to be able to run these tools, but for
>my case its easier to go ahead and do it for every user on every
>login.
>
>Thanks to Kevin for putting the right command in front of me.
>
>On Wed, 30 Mar 2005 12:37:54 -0800, Collins, Kevin (MindWorks)
>[Contractor] <[EMAIL PROTECTED]> wrote:
>> Take a look at /etc/X11/gdm/gdm.conf for these parameters:
>> 
>> AllowRoot=true
>> AllowRemoteRoot=true
>> 
>> One or both need to be true... You'll have to test it out.
>> 
>> Kevin
>> 
>> -Original Message-
>> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
>On
>> Behalf Of Stephen Hinton
>> Sent: Wednesday, March 30, 2005 12:09 PM
>> To: vnc-list@realvnc.com
>> Subject: Root GUI access?
>> 
>> I have got VNC running as an on-demand service.  I can log in
>> successfully and get a desktop.  However,  When I try to open any
>> screen that requires root authority I get teh prompt for the root
>> password, put that password in, and then the screen never loads.
>> 
>> Again,  This it probably more of a linux problem than a VNC problem.
>> I can't figure it out however, and I'd guess someone else has had this
>> issue.
>> 
>> Using Fedora, with a KDE desktop, but a GDM login manager.  XDMCP is
>> enabled (otherwise i couldnt get the login screen) and root remote
>> login is enabled in GDM
>> 
>> The end game is to be able to administer entirely by remote, but still
>> have the nice GUI tools to work with.
>> 
>> Just a note for those who are hemoraghing over my desire to log in as
>> root via an 'unprotected' VNC session, I am running it through an SSH
>> tunnel.
>> ___
>> VNC-List mailing list
>> VNC-List@realvnc.com
>> To remove yourself from the list visit:
>> http://www.realvnc.com/mailman/listinfo/vnc-list
>___

Re: terminal access only (gray window)

[Sean Kamath]

[In a message on Tue, 29 Mar 2005 16:47:23 +0100,
  "James Weatherall" wrote:]
>Damjam,
>
>As previously stated, this is a bug in Gnome that prevents multiple Gnome
>sessions to co-exist on the same machine for the same user.

If I recall correctly, it's a little worse than that.  The Gnome
people are convinced no one has an NFS-shared home directory, so
corporate users can't run multiple gnome sessions on multiple machines
if they share their home directory.  Actually, I shouldn't say that
they don't expect one to have an NFS-mounted home directory, as that's
been discussed in their forums.  Rather, they don't expect one to log
in (graphically) to more than one machine at a time.  So the lock in
~/.gconfd/lock isn't tied to a particular host.

This is probably more of an architectural decision, since I'm sure
that there is a LOT of writing done to the gconfd files, and you
wouldn't want to sessions stomping on each other.  So it's just bad
design.

You *COULD* change $HOME and then run gnome-session, and it would
probably work, but break almost everything else (you could reset $HOME
to the right place in all your subshells).

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Can 'I Disconnect Monitor?

[Sean Kamath]

[In a message on Mon, 21 Mar 2005 11:32:40 EST,
  "Erik Soderquist" wrote:]
>I can't say for certain, but I think that may be the mac "intelligently"
>turning off the display functions when it detects the monitor
>disconnected. I've had almost no experience with macs though, this is
>just a guess on my part.

Indeed, most mac's do look at the output of the monitor.  For example,
my powerbook only offers the difference NTSC resolutions when it's
connected with the SVideo cable or adapter.  Aren't they nice?

The easy solution is to get a dongle.  Depending on the mac, you can
get one of the old-style Mac video to VGA adapaters, and that will let
you run without a monitor.  You could also use a KVM switch (my
personal favorite, since sooner or later you *WILL* need to be on the
monitor of the machine).

Oooh, hay, a quick google of "headless mac video" turned up this:

http://www.welovemacs.com/0101ghed.html

Looks promising.

There almost certainly is some insane terminal command you can use to
force video output, but I'm too lazy to go google it myself. :-)

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: Xmodmap keyboard remapping in VNC 4.1

[Sean Kamath]

[In a message on Sat, 12 Mar 2005 01:50:57 PST,
  Boris Andreev wrote:]
>Then looking up on the Internet, I found this 
>http://mercea.net/~exmh/html/exmh-users/2001-02/msg00016.html
>where the use of "xev" and "xkeycaps" is prescribed in order to see the corres
>pondence between
>keysyms and keycodes. Unfortunately I don't have any idea how to run these uti
>lities - neither the
>Sun machine, nor the Linux recognizes such commands?!

Sun puts xev in /usr/X/demo (/usr/openwin/demo; /usr/X is a symlink).

At least on Solaris 8 & 9.  Haven't installed 10 yet, and don't have a
7 or prior box to check. . .

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: VNC 4.0 on Soalris 8 with inetd

[Sean Kamath]

[In a message on Fri, 11 Mar 2005 15:25:05 GMT,
  Alasdair Ferro wrote:]
>John,
>
>I've tried CDE, Openwindows and Failsafe logins, and they all do the 
>same! Bear in mind that I'm using XDMP to do the login, so my 
>~/.vnc/xstartup script never gets read.

Oh.  So you're running Xvnc, and telling it to use XDMCP to talk to
another machine? I'm confused.

>Also I'm on Solaris 8, so CDE or OpenWindows are my only options (I 
>don't really want to download & install GNOME!)

Download Gnome.  It's worth it, and works fine on Solaris 8.  I used
it to about 4 years (1.4).  I admit, I still prefer 1.4 over 2.0.
Sigh.  Gnome people seem to be of the opinion you shouldn't customize
things, so they remove that option. Just try mapping a mouseclick to a
window action! :-)


Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: VNC 4.0 on Soalris 8 with inetd

[Sean Kamath]

[In a message on Thu, 10 Mar 2005 10:37:25 GMT,
  Alasdair Ferro wrote:]
>Since this appears to be a font problem, please can you let me know 
>which fonts VNC needs access to on Solaris, and I'll try only specifying 
>them.
>
>Cheers,

I never saw a response to this.  So I thought I'd kick in my $0.02.

>> I am running VNC4.0 on Solaris 8 (2/04), via inetd. My inetd.conf 
>> line is thus:
>> vnc-1152x864x24 stream tcp nowait root  /space/tools/bin/Xvnc Xvnc 
>> -inetd -query localhost -once -geometry 1152x864 -depth 24 
>> -SecurityTypes=None -desktop="baltar-Sol8" -fp tcp/baltar:7100
...
>>> This all starts with a fontpatherror. IF it is just one of the 
>>> fontsdirectories
>>> in your fontpath, it should not be a problem. However, if this leaves 
>>> no fonts
>>> left (all fontdirectories are wrong) then I can imagine there are 
>>> problems.

Indeed.  CDE will puke if it doesn't have it's system interface fonts.

>>> Since your Xvnc call does not specify any fontpath, the windowmanager 
>>> has to
>>> come with one. If they don't, there are no fonts and the 
>>> windowmanager might
>>> have a problem here...

The -fp option is the font path.  In fact, since it's called with -fp,
it won't use any compiled in fonts, which I've found will usually at
least get you going.  So my first suggestion is to remove the
'-fp tcp/baltar:7100' from the command inetd.conf line.

>> Sorry, my previous reply lacked information that occurred to me after 
>> I hit send. What I have tried so far is:
>> I've set a fontpath using:
>> -fp tcp/baltar:7100 - I believe there is a font server running on port 
>> 7100 - it's listed in /etc/services and /etc/inetd.conf

That doesn't tell you it's running, just that it might run.  If it's
properly configured and all that.  If you want to test it, use
fslsfonts -server balter:7100.  I don't use the x font server here at
home, so I can't test it.  But it's probably your best bet at testing
a fontserver.

>> and:
>> -fp 
>> I've checked the dirs listed by xset and I believe all of them to have 
>> suitable permissions (ie 755 at minimum) and to contain a fonts.dir file.

Now that's an interesting comment.  If you're getting a list of font
paths with 'xset -q' then the X server was able to add those paths to
the server list, which means they're OK (depending on which server
you're using).  Are you using xset -q on the native X11 server, and
trying to add them to the Xvnc server?  My guess is that something
is adding font elements to your path, and you're seeing the error
message when it tries to add a path that doesn't have the right stuff
in it.  I had this problem (I believe it was trying to add
/usr/openwin/lib/fonts/F3 or /usr/openwin/lib/fonts/Type3; several of
the paths in /usr/openwin/lib/fonts won't work with a generic X
server, but do with Sun's implementation).

In my set up (using Solaris 9 and Gnome 2), I have the following:

Font Path:
  
/home/kamath/.gnome2/share/cursor-fonts,/usr/openwin/lib/X11/fonts/misc/,/usr/openwin/lib/X11/fonts/Speedo/,/usr/openwin/lib/X11/fonts/Type1/,/usr/openwin/lib/X11/fonts/75dpi/,/usr/openwin/lib/X11/fonts/100dpi/,/home/kamath/.gnome2/share/fonts,/usr/openwin/lib/X11/fonts/F3bitmaps

In my xstartup file, I used to loop through all the font directories
and make sure they were added.  I found it a little easier to just do
this in my xstartup file (I can just do "vncserver -name ", as
 will be passed as "VNCDESKTOP"):

# XStartup for VNC
# Start from the home directory no matter where you were invoked.

cd

# Gotta love SUN
DTXSERVERLOCATION=local
export DTXSERVERLOCATION
OPENWINHOME=/usr/openwin
export OPENWINHOME
LANG=C
export LANG

case "$VNCDESKTOP" in 
failsafe)
xterm -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
twm &
;;
cde)
xrdb $HOME/.Xresources
xsetroot -solid grey
/usr/dt/bin/dtsession
;;
gnome-1.4)
/etc/dt/config/Xsession.gnome-1.4
;;
*)
/usr/dt/config/Xstartup
/usr/dt/config/Xsession.Sun-gnome-2.0-s9u4s-2_0_2-08
;;
esac


Hope this helps.

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

Re: META keypress wrapped by SHIFT keypress/release on Solaris

[Sean Kamath]

[In a message on Mon, 07 Feb 2005 10:12:00 GMT,
  Tristan Richardson wrote:]
>The keyboard layout used by Xvnc 4 is taken from a fairly standard Linux 
>keyboard layout, in which "meta" is the shifted version of "alt".  Hence 
>Xvnc is generating a shifted "alt" when it gets sent a "meta".

Aiehgh.  I've been Linuxed again.

>If you want "meta" to be a separate key you can change the keyboard 
>layout using xmodmap or edit the source code appropriately.  Xvnc should 
>then generate whatever key you've set up to be "meta".
>
>Hope this helps!

Yeah, kinda.  xmodmap -e 'keycode 64 = Meta_L' allows me to use one
key as the Meta key -- only, it's the wrong key.  I unassigned both
Alt_L and Meta_L, and running xev the X server will reassign keys 252
and 253 to Meta_L and Alt_L.  Oddly, even if I switch them, well, I
can NEVER make the Meta key be the Meta key (the keycap on the key the
X server wants to call the meta key has the word 'alt' on
it. . . Sigh.

Anyway, yes, un-assigning Alt_L from the key resolves the issue.

Thanks for the help!

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list

META keypress wrapped by SHIFT keypress/release on Solaris

[Sean Kamath]

Hi.

On my Solaris 9 box, running the 4.0 server, my META keypress seems to
be wrapped by a weird keypress/keyrelease.  Here's the xev output from
JUST a META keypress:

KeyPress event, serial 25, synthetic NO, window 0x1e1,
root 0x26, subw 0x0, time 3778192747, (64,97), root:(730,536),
state 0x0, keycode 50 (keysym 0xffe1, Shift_L), same_screen YES,
XLookupString gives 0 characters:  ""

KeyPress event, serial 25, synthetic NO, window 0x1e1,
root 0x26, subw 0x0, time 3778192747, (64,97), root:(730,536),
state 0x1, keycode 64 (keysym 0xffe7, Meta_L), same_screen YES,
XLookupString gives 0 characters:  ""

KeyRelease event, serial 25, synthetic NO, window 0x1e1,
root 0x26, subw 0x0, time 3778192748, (64,97), root:(730,536),
state 0x9, keycode 50 (keysym 0xffe1, Shift_L), same_screen YES,
XLookupString gives 0 characters:  ""

I've looked on the wire (using snoop), and there is no shift event
being sent.

I've tested with Chicken of the VNC, VNC viewer (solaris) 3.3.7 and
4.0, and they all do exactly the same thing.

So then I thought it might be my window manager/setup (Gnome 2), so I
fired up VNCServer 3.3.7 -- no problems, same machine, same xstartup
script.

Even more oddly, here's the event on key release (again, this is a
release of the META key):

KeyRelease event, serial 25, synthetic NO, window 0x1e1,
root 0x26, subw 0x0, time 3778194158, (64,97), root:(730,536),
state 0x8, keycode 64 (keysym 0xffe9, Alt_L), same_screen YES,
XLookupString gives 0 characters:  ""

Something is SERIOUSLY funky here.  All the other modifier keys work
just fine (including ALT).

I checked my keymappings, and indeed Meta_[LR] is NOT set for Mod1.
And, Meta_[LR] *share* their setting with Alt_[LR].  But that doesn't
explain the spurious Shift_L keypress/keyrelease.

Any thoughts?

Sean
___
VNC-List mailing list
VNC-List@realvnc.com
To remove yourself from the list visit:
http://www.realvnc.com/mailman/listinfo/vnc-list