I'm setting up a Linux Mint XFCE 16 computer for my grandmother and I need to be able to support her remotely. My original plan was to set up a SSH tunnel and then run VNC through that. However, as I was doing some reading on x11vnc, I see that you can set it to use SSL to encrypt the traffic.

Would I be better off just using x11vnc with the SSL, or should I skip that and rely on my SSH tunnel for securely running VNC? The SSL option is easier, but I want to make sure I'm using the most secure method.

Both are secure, although, when exposing the vnc port, it could be vulnerable for hacking and the vnc service is affected directly.

If ssh is exposed, it should be hacked first before they would have to reach the vnc.. it's like some sort of stepping stone to get to vnc (and any other service needed).

IMHO the ssh+tunnel would be the better choice, but SSL itself is also a good choice (if encrypting in-transit data is your goal).

1 members found this post helpful.

Id' VERY strongly suggest you do neither and use the free client available at nomachine.org. It naturally tunnels over ssh by default, and starts up via ssh on demand, so no extra services need to always run other than ssh itself.

rhoekstra, I want to make sure the in-transit data is encrypted, but I also want to do the best I can to lock down her computer so nobody but me can get into VNC. Maybe I should stick with SSH.

acid_kewpie, are there benefits to using the nomachine.org client besides convenience? I've already got SSH working with private/public keys and VNC is working too. I have to have this done by Saturday, so is it worth throwing all that out and starting over with nomachine?

Toonses82,

I hope you've found a proper solution to this already, as it is Monday now...

In my opinion, SSH + [any protocol] tunneled is a very safe method. If you use Fail2ban to limit the amount of failed logon attempts before an IP gets a temporary ban, you're quite on the safe side, while very flexible. you don't have to open up additional ports besides SSH (single point of entrance) and have a proper way of deterring scriptkiddies.

While nomachines.org seems a very smooth and nice solution, it's not installed that easy once you are familiar with SSH, VNC, and port forwarding, IMHO. It's worth checking out though.

1 members found this post helpful.