We're building up a new and easier to use FAQ here. If you don't find an
answer to your question below, try the following:
Questions
Can I hide the taskbar icon created by the Windows VNC Server?
Why can't my VNC viewer connect to my VNC server?
Can I use VNC to remotely control another computer across the internet?
Ctrl-Alt-Del isn't getting through to the other computer
Is VNC secure?
How do I use VNC through my firewall?
Can I prevent people shutting down the Windows VNC Server?
Can I prevent people changing the Windows VNC Server settings?
Can I prevent people from disconnecting clients to the Windows VNC Server?
Why do I just get a grey desktop in my Unix VNC Server?
Can I remote the normal X:0 display of my Unix workstation?
Is there a version for Mac OS X?
Can I make the VNC server listen on a different port number rather than 5900?
Answers
Can I hide the taskbar icon created by the Windows VNC Server?
No, not without changing and recompiling the source code. We feel that
there would be few legitimate uses of VNC where you would need to
conceal its operation. However, there might be occasions where you
would not want the user of the server machine to be able to adjust the
WinVNC settings, password, etc, so there is 'restricted' mode where
the icon is still visible, but the menu options normally available
from it will be disabled. See the advanced settings in the Windows VNC Server documentation.
Why can't my VNC viewer connect to my VNC server?
VNC requires TCP/IP network connectivity between the viewer and server
computers. A simple test is to use the ping utility. If you can't ping
from your viewer to your server, and vice-versa, than VNC will not
work!
Can I use VNC to remotely control another computer across the internet?
Yes. VNC uses the TCP/IP protocol which is the networking standard of
the Internet. You can use VNC over LANs, WANs, broadband ISP, and
modem dialup ISP. The performance will vary with the amount of
networking bandwidth you have, but there are special encodings and
compression to make the most out of the bandwidth available. There is
also an automatic linespeed detector, which will dynamically switch in
the most suitable compression scheme for the connection you have. You
should read the FAQ on security, and about using VNC through firewalls.
Ctrl-Alt-Del isn't getting through to the other computer
If you're running the VNC viewer under Windows, then the Ctrl-Alt-Del
keypress may be intercepted by the operating system, and so the viewer
program won't be able to detect it and pass it to a VNC Server. Go to
the viewer's system menu, which you can pull down by left-clicking on
the VNC icon at the top left of the viewer window, or by
right-clicking on the viewer entry in the taskbar. In this menu, you
will find a "Send Ctrl-Alt-Del" option. Alternatively, You might find that
Shift-Ctrl-Alt-Del works. AltGr-Del often works as well.
Under Unix, some window managers also intercept the Ctrl-Alt-Del
keypress. The Unix VNC viewer also has a "Send Ctrl-Alt-Del" function
which is accessible via the popup menu which you can pull down by
pressing the "f8" key in the viewer window.
If you're running the VNC server as an application under Windows
NT/2000/XP then it can only provide remote access to the display if a
user is logged in and the workstation is not locked. In order to allow
the Ctrl-Alt-Del keypress to work and be accessed even if no user is
logged in or it is locked, you must run the VNC server as a system
service.
If you're running the VNC server under Windows 95/98/ME then sending a
remote Ctrl-Alt-Del function will not work at all. On these platforms,
Ctrl-Alt-Del causes all programs, including the VNC server, to halt
and bring up a task manager window.
Is VNC secure?
The only really secure computer is one without a network. VNC requires
a password when a viewer tries to connect to a server. This password
is encrypted to deter snooping, but the following graphical data, the
VNC protocol, is not. In many ways, VNC is more secure than remote
login programs such as telnet where the password is and the following
data are sent in the clear as ascii characters. Many people find it
perfectly acceptable to use VNC like this behind a corporate firewall,
across a VPN, or between computers within the home. However, if the
computer or network is connected to the internet, we strongly advise
the use of additional security. See how to make VNC
secure using SSH. You might want to know how to use VNC with a firewall.
How do I use VNC through my firewall?
Many organisations operate firewalls to reduce the risk of intrusion by malicious attackers via the Internet. These firewalls typically operate by only allowing connections in to machines in that organisation on specific ports. Which ports are permitted access depends upon the network protocol that uses the port and the degree of security it provides.
VNC servers can accept incoming connections through firewalls in two main ways. Although the first is usually the simplest to arrange, we recommend using the SSH tunnelling method wherever VNC is to be used over an untrusted network such as the Internet.
- Opening Ports - The simplest way to allow VNC connections in through your firewall is to configure your firewalling software to allow connections to the VNC ports. If N is the display number of a particular VNC server then it will accept connections on port 5900+N. Configuring your firewall to allow connections to this port will allow VNC to work. If you wish to use the in-built web server and Java VNC Viewer then you will also need to allow connections to port 5800+N. Unfortunately, because VNC traffic is not encrypted, this approach weakens the security provided by your firewall, and so is not advisable.
- Secure Tunnelling - Most organisations that operate firewalls allow connections to a number of standard ports, that are in principle used only by secure or harmless protocols. While VNC in its present incarnation is not suitably secure for this to be advisable, it can be "tunnelled" through a secure protocol layer to achieve the same effect. The Secure Shell (SSH) protocol is one example of such a wrapper, and is one which most firewalls allow access through. The Secure Shell client is run on the VNC client computer and is made to forward connections to a particular port on that machine to a port on the VNC server machine. The forwarded connection is encrypted by the SSH software, which can provide both encryption and authentication. For more details on how to do this, see
here.
Can I prevent people shutting down the Windows VNC Server?
Can I prevent people changing the Windows VNC Server settings?
Can I prevent people from disconnecting clients to the Windows VNC Server?
The Windows VNC server supports 3 separate settings, accessible via the
system registry. The "AllowShutdown" setting can be used to allow or prevent the
VNC server from being made to close. The "AllowProperties" setting can
be used to prevent users from changing the password or other
paramenters of the VNC server, and the "AllowEditClients" setting can
be used to disable the "Add New Client" and "Disconnect All Clients" functions
of the server tray icon. For details on using these settings and how to change them, WinVNC - Advanced Settings.
Why do I just get a grey desktop in my Unix VNC Server?
You should run the vncserver script to start a VNC server, rather than
the Xvnc program directly. vncserver runs Xvnc with appropriate
options and starts some X applications to be displayed in the VNC
desktop. The applications it tries to start are specified in
$HOME/.vnc/xstartup, which can be tailored to your requirements. The
default setup is to run the 'twm' window manager and a single 'xterm'
window. If these applications fail to run, then you will see a grey
'rootweave' desktop. The most likely reason applications fail to run
is that they are not in your path. Any error messages from this
startup shoul appear in $HOME/.vnc/host:display#.log. For
further information see the vncserver
manual page.
Can I remote the normal X:0 display of my Unix workstation?
Not with the current standard VNC distribution. Xvnc starts a
completely new X desktop (:n) which is independent of the standard X
display of the workstation (:0). You can often get the effect you are
looking for by starting an Xvnc session and then running a full screen
viewer for it displayed on :0.
We plan to add full support for this in the standard VNC
distribution. In the meantime,
we've been told that Jens Wagner has a version which polls the screen
- see x0rfbserver.
Is there a version for Mac OS X?
Not for the current version 3.3.4. However, since Mac OS X is
Unix, it is much more likely that we will be able to
provide a proper port of the standard VNC codebase in a future
release.
Can I make the VNC server listen on a different port number rather than 5900?
Yes. In Windows, there is a PortNumber setting, which can be changed in the registry. See WinVNC - Advanced Settings. In Unix, you can specify it if you start Xvnc directly. See the manual page.
|