Recently I started to have some problems with my Linux machine. So I have this Linux VPS machine with VNC server installed and I just connect to it by using VNC viewer.
Recently the VNC server/viewer started to give me some errors such as
vnc too many security failures or
Authentication failed, etc ...
ssh and checked the log on the Linux machine and it shows logs like:
Thu Jun 9 22:35:43 2016 Connections: accepted: 0.0.0.0::59748 SConnection: Client needs protocol version 3.3 Thu Jun 9 22:35:44 2016 SConnection: AuthFailureException: Authentication failure Connections: closed: 0.0.0.0::59748 (Authentication failure) Thu Jun 9 22:41:31 2016 Connections: accepted: 0.0.0.0::57806 SConnection: Client needs protocol version 3.3 SConnection: AuthFailureException: Authentication failure Connections: closed: 0.0.0.0::57806 (Authentication failure)
And as a result, VNC server is black listing those connections and to my surprise it is resulting in preventing me from accessing the machine eventually. (I have no idea why I get blacklisted or why I cannot log anymore)
I am just restarting the VNC server which is allowing me to log in again using VNC.
Is this a possible attack? Any thoughts on how to prevent such a scenario?