In RHEL/Centos 7, TigerVNC-Server only needs 5901/tcp for desktop:1, then 5902/tcp for desktop:2, and so on. I think any VNC-server would operate the same way.
- If no one has typed
vncerverfor themself, I would like the firewall to block all ports >= 5901
- as more users do
vncserverI want those tcp ports 5901..? to be allowed based on desktop:1 to desktop:?
- when a user does
vncserver -kill :?I then want that tcp port to be removed from the run time firewall and that port then blocked.
Is something like this possible to do, if so, how?
Could a wrapper script named
vncserver be written to preempt the running of the real
/usr/bin/vncserver, and in doing do issue the proper
firewall-cmd to make such a thing happen and then perform the real