x11vnc error: Only root will have read permission for the file, and so x11vnc must be

yogesh_attarde · 09-18-2014, 08:16 AM

Hi All,

I have centos6.4 installed on my machine which has no monitor attached. I can run x11vnc using putty from another machine as root user though I am not physically login to machine and can access the desktop using vncviewer from another machine. But if I try to run the x11vnc as normal user it gives me below error message.

Quote:

x11vnc -xauth /var/lib/gdb/:0.Xauth -display :0
###############################################################
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#
#@ @#
#@ ** WARNING ** WARNING ** WARNING ** WARNING ** @#
#@ @#
#@ YOU ARE RUNNING X11VNC WITHOUT A PASSWORD!! @#
#@ @#
#@ This means anyone with network access to this computer @#
#@ may be able to view and control your desktop. @#
#@ @#
#@ >>> If you did not mean to do this Press CTRL-C now!! <<< @#
#@ @#
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#
#@ @#
#@ You can create an x11vnc password file by running: @#
#@ @#
#@ x11vnc -storepasswd password /path/to/passfile @#
#@ or x11vnc -storepasswd /path/to/passfile @#
#@ or x11vnc -storepasswd @#
#@ @#
#@ (the last one will use ~/.vnc/passwd) @#
#@ @#
#@ and then starting x11vnc via: @#
#@ @#
#@ x11vnc -rfbauth /path/to/passfile @#
#@ @#
#@ an existing ~/.vnc/passwd file from another VNC @#
#@ application will work fine too. @#
#@ @#
#@ You can also use the -passwdfile or -passwd options. @#
#@ (note -passwd is unsafe if local users are not trusted) @#
#@ @#
#@ Make sure any -rfbauth and -passwdfile password files @#
#@ cannot be read by untrusted users. @#
#@ @#
#@ Use x11vnc -usepw to automatically use your @#
#@ ~/.vnc/passwd or ~/.vnc/passwdfile password files. @#
#@ (and prompt you to create ~/.vnc/passwd if neither @#
#@ file exists.) Under -usepw, x11vnc will exit if it @#
#@ cannot find a password to use. @#
#@ @#
#@ @#
#@ Even with a password, the subsequent VNC traffic is @#
#@ sent in the clear. Consider tunnelling via ssh(1): @#
#@ @#
#@ http://www.karlrunge.com/x11vnc/#tunnelling @#
#@ @#
#@ Or using the x11vnc SSL options: -ssl and -stunnel @#
#@ @#
#@ Please Read the documention for more info about @#
#@ passwords, security, and encryption. @#
#@ @#
#@ http://www.karlrunge.com/x11vnc/faq.html#faq-passwd @#
#@ @#
#@ To disable this warning use the -nopw option, or put @#
#@ 'nopw' on a line in your ~/.x11vncrc file. @#
#@ @#
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@#
###############################################################
18/09/2014 17:26:44 x11vnc version: 0.9.13 lastmod: 2011-08-10 pid: 4078
No protocol specified
18/09/2014 17:26:44 XOpenDisplay(":0") failed.
18/09/2014 17:26:44 Trying again with XAUTHLOCALHOSTNAME=localhost ...
No protocol specified

18/09/2014 17:26:44 ***************************************
18/09/2014 17:26:44 *** XOpenDisplay failed (:0)

*** x11vnc was unable to open the X DISPLAY: ":0", it cannot continue.
*** There may be "Xlib:" error messages above with details about the failure.

Some tips and guidelines:

** An X server (the one you wish to view) must be running before x11vnc is
started: x11vnc does not start the X server. (however, see the -create
option if that is what you really want).

** You must use -display <disp>, -OR- set and export your $DISPLAY
environment variable to refer to the display of the desired X server.
- Usually the display is simply ":0" (in fact x11vnc uses this if you forget
to specify it), but in some multi-user situations it could be ":1", ":2",
or even ":137". Ask your administrator or a guru if you are having
difficulty determining what your X DISPLAY is.

** Next, you need to have sufficient permissions (Xauthority)
to connect to the X DISPLAY. Here are some Tips:

- Often, you just need to run x11vnc as the user logged into the X session.
So make sure to be that user when you type x11vnc.
- Being root is usually not enough because the incorrect MIT-MAGIC-COOKIE
file may be accessed. The cookie file contains the secret key that
allows x11vnc to connect to the desired X DISPLAY.
- You can explicitly indicate which MIT-MAGIC-COOKIE file should be used
by the -auth option, e.g.:
x11vnc -auth /home/someuser/.Xauthority -display :0
x11vnc -auth /tmp/.gdmzndVlR -display :0
you must have read permission for the auth file.
See also '-auth guess' and '-findauth' discussed below.

** If NO ONE is logged into an X session yet, but there is a greeter login
program like "gdm", "kdm", "xdm", or "dtlogin" running, you will need
to find and use the raw display manager MIT-MAGIC-COOKIE file.
Some examples for various display managers:

gdm: -auth /var/gdm/:0.Xauth
-auth /var/lib/gdm/:0.Xauth
kdm: -auth /var/lib/kdm/A:0-crWk72
-auth /var/run/xauth/A:0-crWk72
xdm: -auth /var/lib/xdm/authdir/authfiles/A:0-XQvaJk
dtlogin: -auth /var/dt/A:0-UgaaXa

Sometimes the command "ps wwwwaux | grep auth" can reveal the file location.

Starting with x11vnc 0.9.9 you can have it try to guess by using:

-auth guess

(see also the x11vnc -findauth option.)

Only root will have read permission for the file, and so x11vnc must be run
as root (or copy it). The random characters in the filenames will of course
change and the directory the cookie file resides in is system dependent.

See also: http://www.karlrunge.com/x11vnc/faq.html

I tried the different x11vnc commands as below but all resulted in the same error message.

Code:

x11vnc -xauth /var/lib/gdb/:0.Xauth -display :0
x11vnc -auth /usr/libexec/polkit-gnome-authentication-agent-1
x11vnc -auth /var/run/gdm/auth-for-gdm-6YU6Ku/database -nolisten tcp
x11vnc -auth /home/yogesh/.Xauthority -display :0

Code:

[root@support init.d]# ps -fp `pgrep Xorg`
UID        PID  PPID  C STIME TTY          TIME CMD
root      3779  3777  0 17:10 tty7     00:00:02 /usr/bin/Xorg :0 -br -verbose -audit 4 -auth /var/run/gdm/auth-for-gdm-6YU6Ku/database -nolisten tcp
[root@support init.d]#

My /etc/X11/xorg.conf file is as below:

Code:

Section "Screen"
        Identifier "Screen0"
        Device     "Device0"
        Monitor    "Monitor0"
        DefaultDepth     24
        SubSection "Display"
                Depth     24
        EndSubSection
        Option   "UseDisplayDevice" "none"
EndSection

Could you please let me know do I need to do any other configuration for normal user?

Regards,
Yogesh

Doug G · 09-18-2014, 01:15 PM

I'm not sure if it helps, but here's what I do to offer the console greeter screen over x11vnc. My x11vnc command is as follows with my user name edited out:

Quote:

rfbport="59$display"

/usr/bin/x11vnc -nap -bg -many -repeat -clear_keys -capslock -xkb -users <me> -auth /var/run/lightdm/"$USER"/:0 -rfbport "$rfbport" -no6 -display :0

I connect via ssh, and then run the above command using sudo. This is on Fedora 20 using lightdm.

yogesh_attarde · 09-19-2014, 08:11 AM

Hi Doug G,

Thanks for the reply.

The solution provided by you is not working for me but what I found is that if I copy below file to user's .vnc directory then I can connect using below commands.

Code:

#cp /var/run/gdm/auth-for-gdm-rB4KJf/database /home/user/.vnc

#chown -R user:user /home/user/.vnc

$unsetenv DISPLAY
$x11vnc -auth ~/.vnc/database

And I am successfully in.

Now if I try next time I didn't it is because

Quote:

auth-for-gdm-rB4KJf

changes to some arbitrary character for example

Quote:

auth-for-gdm-u8Abhl

and I have to redo above process and it works again. Any idea why auth-for-gdm-rB4KJf changes to arbitrary character?

Regards,
Yogesh

Doug G · 09-19-2014, 10:42 PM

Just guessing, I think only root has access to the auth key before there is a login, so it changes when the user logs off and the screen goes back to the greeter.

With the method I use I can log on as a user, log off, and see the greeter screen again to log back on without having to restart x11vnc.

Beyond that, I don't know the answer, even after spending hours with the not too clear x11vnc man pages.

yogesh_attarde · 09-22-2014, 12:32 AM

My /var/run doesn't contain lightdm directory.

Regards,
Yogesh

keefaz · 09-22-2014, 09:19 AM

You don't have vncserver wrapper script and vncpasswd for Xvnc ?

Doug G · 09-22-2014, 04:33 PM

Quote:

Originally Posted by yogesh_attarde

My /var/run doesn't contain lightdm directory.

Regards,
Yogesh

I just copied that line off my Fedora machine, which happens to use lightdm. You are probably using a different Display Manager on your machine with different directories.

yogesh_attarde · 09-23-2014, 07:30 AM

I do have xvnc but I am more comfortable with x11vnc also vncserver doesn't provide me graphical view.

I am using gbm display manager.