2

Recently I started to have some problems with my Linux machine. So I have this Linux VPS machine with VNC server installed and I just connect to it by using VNC viewer.

Recently the VNC server/viewer started to give me some errors such as vnc too many security failures or Authentication failed, etc ...

I used ssh and checked the log on the Linux machine and it shows logs like:

Thu Jun  9 22:35:43 2016
 Connections: accepted: 0.0.0.0::59748
 SConnection: Client needs protocol version 3.3

Thu Jun  9 22:35:44 2016
 SConnection: AuthFailureException: Authentication failure
 Connections: closed: 0.0.0.0::59748 (Authentication failure)

Thu Jun  9 22:41:31 2016
 Connections: accepted: 0.0.0.0::57806
 SConnection: Client needs protocol version 3.3
 SConnection: AuthFailureException: Authentication failure
 Connections: closed: 0.0.0.0::57806 (Authentication failure)

And as a result, VNC server is black listing those connections and to my surprise it is resulting in preventing me from accessing the machine eventually. (I have no idea why I get blacklisted or why I cannot log anymore)

I am just restarting the VNC server which is allowing me to log in again using VNC.

Is this a possible attack? Any thoughts on how to prevent such a scenario?

3

There is nothing wrong with your VNC server.


Why that happened

Welcome to the other side of the internet! The side that is not behind a NAT and a firewall.

vnc too many security failures simply means that someone tried to login into your VNC server and failed, several times. VNC servers have a security feature in which they block connections for a certain amount of time once several connections fail the authentication. Restarting the VNC server (as you're doing) resets the timeout.

Blackhats scan IPs and ports on these IPs all the time. Then connect to open ports, see program banners, and try to authenticate to get into a machine. A server running a small website can get thousands of jolly random connections per day, a server not running anything visible through a DNS but with a public IP can still get hundreds of connections.

Therefore, someone (and by someone i mean a script shooting randomly at IP ranges) found that the public IP of your server has an open port and is trying to login.


What you should do

VNC passwords are notably weak. You shall never run a VNC server directly over the internet. The blacklist timeout (the feature that disallows logging in after a couple of failures) prevent some brute forcing of the passwords but that is not a good enough measure.

Instead you should run VNC server on 127.0.0.1 by adding -localhost to the command line:

vncserver -localhost ...

Then use ssh tunneling to link a port on your machine to the port on the server. For example (i assume your VNC server runs on the default port)

ssh -L 5900:localhost:5900 me@<my_server>

Then, while that ssh connection is alive, you can connect your VNC client to the port 5900 on your own machine.

(That is for *nix machines, if you are on a microsoft machine you can still use putty for ssh tunneling)


What you should NEVER do

VNC servers cannot disable the blacklisting feature but you can change the parameters of the blacklist. For example:

vncserver -set BlacklistTimeout=0 -set BlacklistThreshold=10000 ...

(On some distros, notably CentOS i believe, the command shall be vncconfig not vncserver)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.