23

I have installed TightVNCServer on Raspbian (the September 2.017 version) for my Raspberry Pi 2 B+ : 

luis@Frambuesio:~$  vncserver -name Frambuesio -geometry 1280x1024 -depth 16

New 'Frambuesio' desktop at :1 on machine Frambuesio

Starting applications specified in /etc/X11/Xvnc-session
Log file is /home/luis/.vnc/Frambuesio:1.log

Use xtigervncviewer -SecurityTypes VncAuth -passwd /home/luis/.vnc/passwd :1 to connect to the VNC server.

luis@Frambuesio:~$ netstat -ano | grep "5901"
tcp        0      0 127.0.0.1:5901          0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 ::1:5901                :::*                    LISTEN      off (0.00/0/0)

But my VNC Viewer (from RealVNC on a remote Windows machine) receives the message "Connection refused" when trying to connect, and the port doesn't seem to be listening:

luis@Hipatio:~$ sudo nmap Frambuesio- -p 5900,5901,5902
[sudo] password for luis:

Starting Nmap 7.01 ( https://nmap.org ) at 2017-10-18 16:58 CEST
Nmap scan report for Frambuesio- (192.168.11.142)
Host is up (0.00050s latency).
PORT     STATE  SERVICE
5900/tcp closed vnc
5901/tcp closed vnc-1
5902/tcp closed vnc-2
MAC Address: B8:27:EB:7D:7C:B0 (Raspberry Pi Foundation)

Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds

If I try from Ubuntu 16.04.3 on another Raspberry Pi everything goes all right (note the different netstat results):

luis@Zarzaparrillo:~$ vncserver -name Zarzaparrillo -geometry 1280x1024 -depth 16

New 'Zarzaparrillo' desktop is Zarzaparrillo:1

Starting applications specified in /home/luis/.vnc/xstartup
Log file is /home/luis/.vnc/Zarzaparrillo:1.log

luis@Zarzaparrillo:~$ netstat -ano | grep 5901
tcp6       0      0 :::5901                 :::*                    LISTEN      off (0.00/0/0)

Same results with VNC4Server.

I have read the official Raspberry papers, consisting on installing the realvnc-vnc-server package. But the RealVNC program installs a ton of extra packages and is not open source, even when it is free for educative purposes. I would prefer some GNU's more open policies for my VNC, as long as it could be used in an enterprise production environment.

My workaround for now consists on using X11vnc to serve the display on another port:

luis@Frambuesio:~$  vncserver -name Frambuesio -geometry 1280x1024 -depth 16

[... on another terminal: ]
luis@Frambuesio:~$ sudo x11vnc -display :1 -passwd anypassword -auth guess -forever

... and now the X11vnc program makes display :1 available. Note that, as long as the port 5901 TCP is occupied, X11VNC uses the 5900 TCP (aka :0 port):

The VNC desktop is:      Frambuesio:0
PORT=5900

Note the netstat output, now in a working condition:

luis@Frambuesio:~$ netstat -ano | grep 5900
tcp        0      0 0.0.0.0:5900            0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 :::5900                 :::*                    LISTEN      off (0.00/0/0)
luis@Frambuesio:~$ netstat -ano | grep 5901
tcp        0      0 127.0.0.1:5901          0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 ::1:5901                :::*                    LISTEN      off (0.00/0/0)

Why are my VNC servers failing and how could I solve this?

Improve this question
2
  • Note that x11vnc always serves on port 5900 as it is designed to share an existing X screen. The use of 5900 is nothing to do with the fact that 5901 is already in use.
    – nickcrabtree
    Dec 28, 2019 at 6:44
  • Safer to keep it listening on local host and use a ssh tunnel
    – dman
    Jan 23, 2020 at 21:40

2 Answers 2

Reset to default
35

The problem seems to be just a default argument on VNCServer with the improper (for your case) option.

From vncserver command line help:

[-localhost yes|no]    Only accept VNC connections from localhost

This should solve your problem:

vncserver -localhost no

Interpreting the same last example in the original question, note the 0.0.0.0:5900 meaning "listening connections from anywhere at 5900 TCP":

luis@Frambuesio:~$ netstat -ano | grep 5900
tcp        0      0 0.0.0.0:5900            0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 :::5900                 :::*                    LISTEN      off (0.00/0/0)

Meanwhile, note the 127.0.0.1:5901 meaning "listening connections from localhost at 5901 TCP"

luis@Frambuesio:~$ netstat -ano | grep 5901
tcp        0      0 127.0.0.1:5901          0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 ::1:5901                :::*                    LISTEN      off (0.00/0/0)
Improve this answer
6
  • 3
    Localhost is a sensible security default, given the extreme insecurity of the VNC protocol and increased attack surface of hanging the VNC daemon port out where attackers can directly get at it. Tunneling over SSH is the only way I recommend using VNC.
    – thrig
    Oct 18, 2017 at 16:23
  • VPN tunneling could be another tunneling method, instead of (or in addition to) SSH.
    – Sopalajo de Arrierez
    Jan 17, 2019 at 12:25
  • 7
    localhost is certainly not a sensible default in the slightest. "Remote network access software" has "remote network access" disabled by default? As if someone installed the software with the intention of not actually using it... no this is an absurd default.
    – kristopolous
    Jan 3, 2021 at 2:22
  • 1
    Fair point but nonetheless localhost-only is a "sensible security default" as @thrig put it: running VNC over the open internet is a no-go. The package/distribution could of course point this out when running or installing.
    – Victor Klos
    Jan 5, 2021 at 17:13
  • 1
    vncserver -localhost no gives me Fatal server error: ... Unrecognized option: no.
    – Friedrich -- Слава Україні
    May 20, 2021 at 10:41
10

I ran into the same problem and figured it out. From the command line run:

tigervncserver -localhost no :1

Make it permanent by adding into the file /etc/vnc.conf the option:

$localhost = "no"

Even though the file reads that the default is localhost=no that is not the case.

Improve this answer
2
  • I am running a nodejs server on localhost :8080. Can I expose this to the internet using vnc?
    – Sayed Uz Zaman
    Sep 9, 2020 at 7:56
  • I don't understand why the need for the $. It's never mentioned anywhere.
    – brainplot
    Nov 28 at 18:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .