[SOLVED] CentOS 4.8 VNC server issue - bug??

tinfoil3d · 04-13-2020, 10:19 PM

Yep, that's right.
I can't find x11vnc in centos tree.
So try building this
https://sourceforge.net/projects/lib.../files/x11vnc/
If the latest one doesn't work just try a bit older ones. It may happen.

L1P0 · 04-13-2020, 10:19 PM

Quote:

Originally Posted by tinfoil3d

The safest setup would be running x11vnc under the user who is logged in to the desktop (if any) and running

Code:

x11vnc -localhost -forever

, then accessing it via ssh session like

Code:

ssh youroptions... youruser@yourserver -L127.0.0.1:5900:127.0.0.1:5900

and then just

Code:

vncviewer 127.0.0.1

The point is if you cannot find x11vnc for 4.8 you'll have to take it from sources and build it yourself.

It says:

Quote:

ksh: x11vnc: not found

I tried switching to bash shell, still:

Quote:

bash: x11vnc: not found

L1P0 · 04-13-2020, 10:22 PM

Quote:

Originally Posted by tinfoil3d

Yep, that's right.
I can't find x11vnc in centos tree.
So try building this
https://sourceforge.net/projects/lib.../files/x11vnc/
If the latest one doesn't work just try a bit older ones. It may happen.

That's why the x11vnc command was not found upon my attempt. I will study how to build things like this.. Thank you so much for sharing your knowledge!

tinfoil3d · 04-13-2020, 10:28 PM

You just download that tar file to a remote box,

Code:

tar xf ..filename...
cd x11vnc-*
./configure
make
# then it would probably produce a x11vnc executable file somewhere, you can find it like this:
find -name x11vnc -type f

Then just run it as find command returns, appending -localhost -forever
It may report errors and exit, but if it doesn't exit, just connect to it through ssh tunnel you have created.

L1P0 · 04-13-2020, 11:56 PM

Quote:

Originally Posted by tinfoil3d

You just download that tar file to a remote box,

Code:

tar xf ..filename...
cd x11vnc-*
./configure
make
# then it would probably produce a x11vnc executable file somewhere, you can find it like this:
find -name x11vnc -type f

Then just run it as find command returns, appending -localhost -forever
It may report errors and exit, but if it doesn't exit, just connect to it through ssh tunnel you have created.

I successfully executed above commands/lines with no issues. Thanks a lot! About the ssh option.. what option should I use?

Code:

ssh [option] user@target -L127.0.0.1:5900:127.0.0.1:5900

Also, is this really

Code:

-L127.0.0.1:5900:127.0.0.1:5900

or just

Code:

-L127.0.0.1:5900

I can see an error:

Quote:

Bad forwarding specification '127.0.0.1:5900'

I really appreciate your time and help!

tinfoil3d · 04-14-2020, 12:00 AM

try

Code:

ssh -L5900:127.0.0.1:5900 user@host

L1P0 · 04-14-2020, 12:18 AM

Quote:

Originally Posted by tinfoil3d

try

Code:

ssh -L5900:127.0.0.1:5900 user@host

after trying that, and vncviewer 127.0.0.1 , I got an error message:

Quote:

vncviewer: unable to make display ""

I looked in /var/log/messages but found no related logs..

##########

BTW, after issuing ./x11vnc -localhost -forever

it stuck at after line:

Quote:

check_xrandr_event: enabling full XANDR trapping anyway.

tinfoil3d · 04-14-2020, 01:11 AM

ok, try running

Code:

DISPLAY=:0 ./x11vnc -localhost -forever

are you sure you have xorg running? can you maybe post your processes list

Code:

ps xuafwww

L1P0 · 04-14-2020, 04:14 AM

Hi @tinfoil3d

Thanks a lot! I tried your most recent suggestion, but it still seems not working.
But hey, I tried this and it worked:

in the server side, i just issued:

Code:

/usr/bin/x11vnc -rfbauth ~/.vnc/passwd

Then, in the client side, I typed

Code:

vncviewer MY_HOSTNAME_HERE:1

And the remote connection successfully established!

Thank you so much for guiding me all throughout! Thanks for sharing your knowledge! I hope there will be more people like you.
Have a good day!

tinfoil3d · 04-14-2020, 04:19 AM

np but there are two things to take care of.
what you did there is you opened an access from remote, even from "secure" lan opening vnc isn't a good idea as passwords are only 8 chars long.
next, there's that bruteforce attack going on in your network. you must take care of that.

L1P0 · 04-14-2020, 04:37 AM

Quote:

Originally Posted by tinfoil3d

np but there are two things to take care of.
what you did there is you opened an access from remote, even from "secure" lan opening vnc isn't a good idea as passwords are only 8 chars long.
next, there's that bruteforce attack going on in your network. you must take care of that.

Thanks for that.. But our network here is secured by VPN.

The unidentified ip address only shows up in the /var/log/messages after boot up. I tried booting up thrice. And the logs with that ip addr are appended right after bootup. I observed that after even few hrs, no logs with that ip address is being appended.

There are many things I should study!

tinfoil3d · 04-14-2020, 05:54 AM

that's serious, you don't wont to shove that under the carpet and then receive request to pay bitcoins to decrypt your files a week later.
find out which computer has that IP, it may even be not explicitly assigned, say, a hacker gains control of 10.11.12.13 host and adds 10.11.12.14 ip by himself that wasn't used and then attacks from it, making all admins to run around trying to figure out who has that ip even though no one was assigned it.