3

I have installed TightVNCServer on RaspBian (the September 2.017 version) for my RaspBerry Pi 2 B+ :

luis@Frambuesio:~$  vncserver -name Frambuesio -geometry 1280x1024 -depth 16

New 'Frambuesio' desktop at :1 on machine Frambuesio

Starting applications specified in /etc/X11/Xvnc-session
Log file is /home/luis/.vnc/Frambuesio:1.log

Use xtigervncviewer -SecurityTypes VncAuth -passwd /home/luis/.vnc/passwd :1 to connect to the VNC server.

luis@Frambuesio:~$ netstat -ano | grep "5901"
tcp        0      0 127.0.0.1:5901          0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 ::1:5901                :::*                    LISTEN      off (0.00/0/0)

But my VNC Viewer (from RealVNC on a remote Windows machine) receives the message "Connection refused" when trying to connect, and the port doesn't seem to be listening:

luis@Hipatio:~$ sudo nmap Frambuesio- -p 5900,5901,5902
[sudo] password for luis:

Starting Nmap 7.01 ( https://nmap.org ) at 2017-10-18 16:58 CEST
Nmap scan report for Frambuesio- (192.168.11.142)
Host is up (0.00050s latency).
PORT     STATE  SERVICE
5900/tcp closed vnc
5901/tcp closed vnc-1
5902/tcp closed vnc-2
MAC Address: B8:27:EB:7D:7C:B0 (Raspberry Pi Foundation)

Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds

If I try from Ubuntu 16.04.3 on another RaspBerry everything goes all right (note the different netstat results) :

luis@Zarzaparrillo:~$ vncserver -name Zarzaparrillo -geometry 1280x1024 -depth 16

New 'Zarzaparrillo' desktop is Zarzaparrillo:1

Starting applications specified in /home/luis/.vnc/xstartup
Log file is /home/luis/.vnc/Zarzaparrillo:1.log

luis@Zarzaparrillo:~$ netstat -ano | grep 5901
tcp6       0      0 :::5901                 :::*                    LISTEN      off (0.00/0/0)

Same results with VNC4Server.

I have read the official RaspBerry papers, consisting on installing the realvnc-vnc-server package. But the RealVNC program installs a ton of extra packages and is not open source, even when it is free for educative purposes. I would prefer some GNU's more open policies for my VNC, as long as it could be used on enterprise production's environment.

My Workaround for now consists on using X11VNC to serve the display on another port:

luis@Frambuesio:~$  vncserver -name Frambuesio -geometry 1280x1024 -depth 16

[... on another terminal: ]
luis@Frambuesio:~$ sudo x11vnc -display :1 -passwd anypassword -auth guess -forever

... and now the X11VNC program makes display :1 available. Note that, as long as the port 5901 TCP is occupied, X11VNC uses the 5900 TCP (aka :0 port):

The VNC desktop is:      Frambuesio:0
PORT=5900

Note the netstat output, now in a working condition:

luis@Frambuesio:~$ netstat -ano | grep 5900
tcp        0      0 0.0.0.0:5900            0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 :::5900                 :::*                    LISTEN      off (0.00/0/0)
luis@Frambuesio:~$ netstat -ano | grep 5901
tcp        0      0 127.0.0.1:5901          0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 ::1:5901                :::*                    LISTEN      off (0.00/0/0)

Why are my VNC servers failing and how could I solve it?

7

The problem seems to be just a default argument on VNCServer with the improper (for your case) option.

From vncserver command line help:

[-localhost yes|no]    Only accept VNC connections from localhost

This should solve your problem:

vncserver -localhost no

Interpreting the same last example in the original question, note the 0.0.0.0:5900 meaning "listening connections from anywhere at 5900 TCP":

luis@Frambuesio:~$ netstat -ano | grep 5900
tcp        0      0 0.0.0.0:5900            0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 :::5900                 :::*                    LISTEN      off (0.00/0/0)

Meanwhile, note the 127.0.0.1:5901 meaning "listening connections from localhost at 5901 TCP"

luis@Frambuesio:~$ netstat -ano | grep 5901
tcp        0      0 127.0.0.1:5901          0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 ::1:5901                :::*                    LISTEN      off (0.00/0/0)
  • 1
    Localhost is a sensible security default, given the extreme insecurity of the VNC protocol and increased attack surface of hanging the VNC daemon port out where attackers can directly get at it. Tunneling over SSH is the only way I recommend using VNC. – thrig Oct 18 '17 at 16:23
  • VPN tunneling could be another tunneling method, instead of (or in addition to) SSH. – Sopalajo de Arrierez Jan 17 at 12:25
2

I ran into the same problem and figured it out. From the command line run:

tigervncserver -localhost no :1

Make it permanent by adding into the file /etc/vnc.conf the option:

$localhost = "no"

Even though the file reads that the default is localhost=no that is not the case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.