LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   CentOS 4.8 VNC server issue - bug?? (https://www.linuxquestions.org/questions/linux-software-2/centos-4-8-vnc-server-issue-bug-4175673159/)

L1P0 04-13-2020 08:26 PM

CentOS 4.8 VNC server issue - bug??
 
When I tried to connect to a remote desktop pc (installed with CentOS 4.8) using vncviewer command, I get this error:

Quote:

VNC viewer for X version 4.0 - built Feb 11 2009 13:36:48
Copyright (C) 2002-2004 RealVNC Ltd.
See http://www.realvnc.com for information on VNC.

Fri Apr 10 16:26:51 2020
CConn: connected to host MY_HOSTNAME_HERE port 5900
CConnection: Server supports RFB protocol version 3.7
CConnection: Using RFB protocol version 3.7
main: read: Connection reset by peer (104)

This is only happening when I tried to connect to a PC with CentOS 4.8.
Is this a bug of CentOS 4.8? What alternative remote desktop software can I try?

I tried NoMachine software, but I always got an error:

Quote:

<No available sessions on this server>
and when i click that error, it expans as:

Quote:

The server was unable to make local display available or access to the local display is disabled.
Please advise what to do. Thanks!

tinfoil3d 04-13-2020 08:32 PM

Were you able to connect to it before, ever? Did you try different VNC clients? Check the VNC server side log. What is the software you use on server? x11vnc?
That aside, centos 4.8 is early 2000s...
The possible solution is to try centos 4.8 client in virtual machine with same version.
I think it's still possible to install centos 4.x using vault.centos.org as mirror.

L1P0 04-13-2020 08:48 PM

Quote:

Originally Posted by tinfoil3d (Post 6111286)
Were you able to connect to it before, ever? Did you try different VNC clients? Check the VNC server side log. What is the software you use on server? x11vnc?
That aside, centos 4.8 is early 2000s...
The possible solution is to try centos 4.8 client in virtual machine with same version.
I think it's still possible to install centos 4.x using vault.centos.org as mirror.

I have not tried to connect to it successfully even once. I tried a linux pc with CentOS 4.6 and a windows 10 laptop as VNC clients. But, all of these failed. When I tried to make CentOS 4.6 PC as server, everything is fine.

How do I check VNC server log?

using rpm command, these are the packages related to vnc softwares:

Quote:

vino-2.8.1-1
vnc-4.0-11.el4
vnc-server-4.0-11.el4
Our Linux PCs here are used in production line. They are restricted from outside connections. So yum updates don't work. I will try to manually install from vault.centos.org. Thank you so much for your info :)

L1P0 04-13-2020 08:51 PM

Quote:

Originally Posted by tinfoil3d (Post 6111286)
Were you able to connect to it before, ever? Did you try different VNC clients? Check the VNC server side log. What is the software you use on server? x11vnc?
That aside, centos 4.8 is early 2000s...
The possible solution is to try centos 4.8 client in virtual machine with same version.
I think it's still possible to install centos 4.x using vault.centos.org as mirror.

Btw, How do I navigate through this website? Which directories should I go?


http://vault.centos.org/4.8/

Thanks!

tinfoil3d 04-13-2020 08:56 PM

/var/log/messages probably.
It's great that you have it hidden, and the best would be to not allow it to listen on any external port, only on localhost and you tunnel it over ssh.
Are you trying to look at what's on the running xorg there or make a new session? We need to know what's your VNC server.

tinfoil3d 04-13-2020 08:58 PM

the /os/ directory is the release as it was on ISOs, the /updates/ is whatever updates there were for this release. So that would be http://vault.centos.org/4.8/os/x86_64/CentOS/RPMS/ for example for rpms.

tinfoil3d 04-13-2020 09:01 PM

if your host box you're connecting to has xorg running and you want to see what's on that display right now, x11vnc does the trick but i don't see it in /os/ there.
if you want to start new GUI session there then it's probably vino or vnc-server. vnc-server would require some set-up to be done to start proper session, and you should probably start it from ssh manually each time.
are you sure your task cannot be achieved by means of terminal?

L1P0 04-13-2020 09:07 PM

Quote:

Originally Posted by tinfoil3d (Post 6111295)
/var/log/messages probably.
It's great that you have it hidden, and the best would be to not allow it to listen on any external port, only on localhost and you tunnel it over ssh.
Are you trying to look at what's on the running xorg there or make a new session? We need to know what's your VNC server.

Thanks man! I saw vnc related logs from messages file. I will now redo my attempt before to see the actual logs.

My apology.. I cannot understand what is xorg.. I am actually a newbie in Linux. How do I know which VNC server I have?

tinfoil3d 04-13-2020 09:17 PM

Can you post the related logs? Enclose those in code tags or just paste it at https://paste.ubuntu.com
xorg is X server, if you have any graphical interface on the target computer, it must be running Xorg, so if you want to see that exact display then x11vnc is a solution, if you want to start a new session that would not display on the target monitor, then it's vino or vnc-server.

L1P0 04-13-2020 09:54 PM

Quote:

Originally Posted by tinfoil3d (Post 6111308)
Can you post the related logs? Enclose those in code tags or just paste it at https://paste.ubuntu.com
xorg is X server, if you have any graphical interface on the target computer, it must be running Xorg, so if you want to see that exact display then x11vnc is a solution, if you want to start a new session that would not display on the target monitor, then it's vino or vnc-server.


I installed a newer version of vnc softwares: vnc-4.0-12.el4.1.i386.rpm & vnc-server-4.0-12.el4.1.i386.rpm from http://vault.centos.org/4.8/os/i386/CentOS/RPMS/

I rebooted the PC with CentOS 4.8. Then I tried to issue command vncviewer from a PC client. Then the error return message after the vncviewer command is now like this:

Quote:

VNC viewer for X version 4.0 - built Jan 17 2007 14:43:52
Copyright (C) 2002-2004 RealVNC Ltd.
See http://www.realvnc.com for information on VNC.

Tue Apr 14 10:38:28 2020
main: unable to resolve host by name: Success (0)

Then, I looked at the /var/log/messages of the CentOS 4.8 server, the related logs is this:

Quote:

sshd(pam_unix)[2255]: session opened for user root by (uid=0)
sshd(pam_unix)[2308]: check pass; user unknown
sshd(pam_unix)[2308]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.33.112.223
sshd(pam_unix)[2318]: check pass; user unknown
sshd(pam_unix)[2318]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.33.112.223
telnetd[2326]: ttloop: peer died: EOF
sshd(pam_unix)[2325]: check pass; user unknown
sshd(pam_unix)[2325]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.33.112.223
sshd(pam_unix)[2324]: check pass; user unknown
sshd(pam_unix)[2324]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.33.112.223
sshd(pam_unix)[2337]: check pass; user unknown
sshd(pam_unix)[2337]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.33.112.223
sshd(pam_unix)[2336]: check pass; user unknown
sshd(pam_unix)[2336]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.33.112.223
telnetd[2347]: ttloop: peer died: EOF
sshd(pam_unix)[2342]: check pass; user unknown
sshd(pam_unix)[2342]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.33.112.223
sshd(pam_unix)[2343]: check pass; user unknown
sshd(pam_unix)[2343]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.33.112.223
sshd(pam_unix)[2350]: check pass; user unknown
sshd(pam_unix)[2350]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.33.112.223
sshd(pam_unix)[2357]: check pass; user unknown
sshd(pam_unix)[2357]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.33.112.223
telnetd[2365]: ttloop: peer died: EOF
rlogind[2330]: Connection from 10.33.112.223 on illegal port
telnetd[2381]: ttloop: peer died: EOF
rlogind[2349]: Connection from 10.33.112.223 on illegal port
telnetd[2394]: ttloop: peer died: EOF
rlogind[2367]: Connection from 10.33.112.223 on illegal port

I do not recognize the ip addr 10.33.112.223 . This is neither the address of the PCs I tried.



Oww.. I think now I get it what is xorg. I can actually open another session via vncserver command. But, my problem here is that I cannot display the actual desktop on the target PC which is DISPLAY :0


###################################
EDIT

I think I just mistyped the hostname hehe sorry. I'll reply with the corrected logs in a bit.

###################################

Update:

the return error messages after issuing vncviewer command is still like the original one:

Quote:

Fri Apr 10 16:26:51 2020
CConn: connected to host MY_HOSTNAME_HERE port 5900
CConnection: Server supports RFB protocol version 3.7
CConnection: Using RFB protocol version 3.7
main: read: Connection reset by peer (104)

And the new entries of /var/log/messages are still the same with the above messages.

tinfoil3d 04-13-2020 10:05 PM

So your objective is to get access to ALREADY running session :0, like, tty7, the physical display of the machine in question, right?
Then I believe x11vnc is what you need, I never tried solving it with vnc-server and always considered it to be a session-creating solution.
As for 10.33.112.223 it is definitely infected and doing bruteforce attacks on LAN, you should investigate this without delay.

L1P0 04-13-2020 10:10 PM

Quote:

Originally Posted by tinfoil3d (Post 6111308)
Can you post the related logs? Enclose those in code tags or just paste it at https://paste.ubuntu.com
xorg is X server, if you have any graphical interface on the target computer, it must be running Xorg, so if you want to see that exact display then x11vnc is a solution, if you want to start a new session that would not display on the target monitor, then it's vino or vnc-server.


So, I will now narrow down the problem. How should I solve this problem with x11vnc? Appreciate for your help!

tinfoil3d 04-13-2020 10:12 PM

The safest setup would be running x11vnc under the user who is logged in to the desktop (if any) and running
Code:

x11vnc -localhost -forever
, then accessing it via ssh session like
Code:

ssh youroptions... youruser@yourserver -L127.0.0.1:5900:127.0.0.1:5900
and then just
Code:

vncviewer 127.0.0.1
The point is if you cannot find x11vnc for 4.8 you'll have to take it from sources and build it yourself.

L1P0 04-13-2020 10:14 PM

Quote:

Originally Posted by tinfoil3d (Post 6111320)
So your objective is to get access to ALREADY running session :0, like, tty7, the physical display of the machine in question, right?
Then I believe x11vnc is what you need, I never tried solving it with vnc-server and always considered it to be a session-creating solution.
As for 10.33.112.223 it is definitely infected and doing bruteforce attacks on LAN, you should investigate this without delay.

Yes, that's correct. That is my objective. Can you tell me what things I need to do to solve this?

Definitely, I will investigate at once. But, I logged the same time when I issued vncviewer from a PC client.. hmm..

L1P0 04-13-2020 10:17 PM

Quote:

Originally Posted by tinfoil3d (Post 6111325)
The safest setup would be running x11vnc under the user who is logged in to the desktop (if any) and running
Code:

x11vnc -localhost -forever
, then accessing it via ssh session like
Code:

ssh youroptions... youruser@yourserver -L127.0.0.1:5900:127.0.0.1:5900
and then just
Code:

vncviewer 127.0.0.1
The point is if you cannot find x11vnc for 4.8 you'll have to take it from sources and build it yourself.


making sure I get it.. So these are the lines I need to execute on the server side:

Code:

x11vnc -localhost -forever

Then for the client side:

Code:

ssh youroptions... youruser@yourserver -L127.0.0.1:5900:127.0.0.1:5900
Code:

vncviewer 127.0.0.1
Is this correct? Thank you so much!


All times are GMT -5. The time now is 09:40 PM.