Hello!

I noticed that my system has port 5800 and 5900 open for the remote desktop service.

I know I can set up a firewall, but it there a way to shut it down completely?

(using Slackware 10.1)

Thanks,
Murdock

If you don't use vnc you can uninstall it and check for open ports again. Also check for tightvnc, krbc and krbf.

(Edit: Sorry, I wrote this part remembering Debian and VectorLinux. Slackware may not use chkconfig.)
Another option is to use chkconfig. chkconfig --edit vnc. Change the word on to off in the editor that comes up. Another option is to delete the service in chkconfig.
chkconfig -d vnc.

You may have a graphical configuration tool where you can shut off or remove the service.

Your system might have vnc set up being controlled by xinetd. In that case check the xinetd config file. Perhaps /etc/xinetd/vnc.

If your system has a firewall GUI administrative program, using it may be a painless way of closing these ports.

In any case, because vnc is installed, and enabled you might try a graphical administration option first. It might do something else I haven't thought of, such as modifying PAM configuration and SELinux access control. Also, the uninstall process may remove a line that explicitly opens up the port in the firewall script. And when you finish, scan this host again.

I also may have referred to an option you don't have, because I use SuSE and not Debian. Such as whether you use inetd or xinetd. I don't know if Debian uses the same system for startup scripts as SuSE and Mandrake, etal. You may not have chkconfig in that case. Please refer to you Administrators Manual for the last word on the matter.

I'm not certain how using KDE or Gnome will effect matters. If you remove krdc and krfb, do all the remote desktop related menu options go away from the KDE system menus, and does it matter in this case anyway. Some experimentation may be in order.

odd, vnc should not be started automatically.
I'd check which user is running vnc because if you didn't start it then why is it running.
Do
ps -A |grep Xvnc
and look at which user is running it.
Log in as that user and type
vncserver -kill :1
Make the :1 whatever was displayed when you did ps.
I'd find out which startup script (.bashrc maybe) is starting vnc and nuke it.

Edit: I just remembered, I believe port 5900 being open means that the :0 display is being exported. This is done with the vnc kernel module. If you have a line in your xorg.conf that looks like this, nuke it...

Thanks!

However, I do not see any nvc module, but I still can connect to my computer through remote desktop. It seems there is some KDE configuration that is activating it.

Thanks,
Murdock