Topic 'Re: How to secure VNC and port 5900' in forum 'Security' - dslreports.com

Re: How to secure VNC and port 5900

Mon, 10 Dec 2012 20:20:04 EDT

HELLFIRE posted : AAA and syslog are also options... just depends on how secure the environment and ho much the OP is willing to expend on the effort.

Regards

Re: How to secure VNC and port 5900

Thu, 06 Dec 2012 21:54:00 EDT

anon posted :

said by mmainprize:

Right On.

Every time i think about one of these types of services i think about the same things you just listed.
I do not want to give my login info to any site.
Even the VPN services sites, you never know who might be watching your traffic at the service.
You have better trust any service you deal with. I was given a free one year account at cyberghost, VPN service but have not used it because i don't trust it or the source i got it from.

It is like all the people that do there taxes online at some web site. Now you here that many find that taxes refunds have all ready been sent out to fake fillers before the real person filled there taxes, where do you thing they got all the info to fill a tax return in your name.
I have always used OpenSSH but now just upgraded to Windows 8 and need to find new software that is compatible with windows 8. I don't travel much so the need to connect is less these days so i have some time.

Now you, actually have a good point. You have good cause to be weary of VPN tunneling services. The reason being, ALL traffic pumped through that gateway can be sniffed once it's outside the VPN tunnel (i.e. the traffic is only secured between your PC and the VPN endpoint), once it's after that which is still on the local network of the VPN provider and it must go through their Internet Gateway to get to your requested site all they have to do is just sniff your traffic between the VPN server and their Internet Gateway. Simple, so you have a point for this type of service and I agree with you. I wouldn't trust them either.

Re: How to secure VNC and port 5900

Thu, 06 Dec 2012 18:07:57 EDT

RickNY posted :

said by mackey:

I'm surprised no one's mentioned the obvious: run it on a random, non-standard port instead of 5900.

Security through obscurity... The SSH route is the best way to go. Additionally, SSH will provide the end user with some other valuable perks such as SFTP/SCP for file transfers. Additionally, you can use SSHD as a SOCKS proxy, effectively giving you a VPN for anything else.

You will get a lot of drive-bys on SSH -- probably more than you would with VNC.. But properly secured with public key authentication and password authentication disabled, you'd have a very secure system.

Re: How to secure VNC and port 5900

Thu, 06 Dec 2012 15:30:19 EDT

Derwood posted : Stunnel will allow any non-SSL listening app become SSL.. It's free and works with just about anything

»www.stunnel.org/index.html

Re: How to secure VNC and port 5900

Thu, 06 Dec 2012 13:53:55 EDT

mmainprize posted :

said by Woody79_00:

I am not living in the past, I just am not comfortable trusting "any" outside entity to provide remote access to my LAN from outside of my control. If i were to offer such services, I would want those services (the hardware) to be on site under my control. Any business should want the same.

With services like LogMeIn, its an honor system...Why should i trust them? The way things are in the world today...i have no reason to trust them. I don't "personally know" anyone who works for LogMeIn...how do i know i can trust them? Should i take someone else word for it, who by the way, has never met these people in person face to face either?

have you met anyone from LogMeIn face to face? Are you sure you can trust them? Do you even know what kind of people they are? How about their ethics? Who runs their data centers? where are they located? can i visit the data center i will be using?

these are questions everyone should ask themselves before making such deals, especially when it comes to remote access.

Again...if your willing to pay money for LogMeIn or any other service, why not spend that money on a consultant who is capable of setting up a OpenVPN Server for you securely and be done with it....in the long run this may even be a cheaper option overall.

at least you will have piece of mind that remote access is controlled on premise, by people you know and have seen their faces, and not hosted somewhere else by someone you have never met before in your life.

just my 2 cents.

Re: How to secure VNC and port 5900

Thu, 06 Dec 2012 13:51:15 EDT

AVD posted :

said by HELLFIRE:

I don't know if it supports it, but if VNC or the machine itself permits a log of successful
logins, set it up so you can keep track of VNC attempts.

what's the point, it can be easily defeated if the attacker gets some sort of privledged access over VNC (unless you output to a line printer)
--
* seek help if having trouble coping
--Standard disclaimers apply.--

Re: How to secure VNC and port 5900

Thu, 06 Dec 2012 12:58:18 EDT

Da Geek Kid posted : logmein is free service for personal unless you want to go big!

Re: How to secure VNC and port 5900

Thu, 06 Dec 2012 12:53:23 EDT

Woody79_00 posted : I am not living in the past, I just am not comfortable trusting "any" outside entity to provide remote access to my LAN from outside of my control. If i were to offer such services, I would want those services (the hardware) to be on site under my control. Any business should want the same.

With services like LogMeIn, its an honor system...Why should i trust them? The way things are in the world today...i have no reason to trust them. I don't "personally know" anyone who works for LogMeIn...how do i know i can trust them? Should i take someone else word for it, who by the way, has never met these people in person face to face either?

have you met anyone from LogMeIn face to face? Are you sure you can trust them? Do you even know what kind of people they are? How about their ethics? Who runs their data centers? where are they located? can i visit the data center i will be using?

these are questions everyone should ask themselves before making such deals, especially when it comes to remote access.

Again...if your willing to pay money for LogMeIn or any other service, why not spend that money on a consultant who is capable of setting up a OpenVPN Server for you securely and be done with it....in the long run this may even be a cheaper option overall.

at least you will have piece of mind that remote access is controlled on premise, by people you know and have seen their faces, and not hosted somewhere else by someone you have never met before in your life.

just my 2 cents.

Re: How to secure VNC and port 5900

Thu, 06 Dec 2012 12:17:03 EDT

KA0OUV posted :

said by mackey:

I'm surprised no one's mentioned the obvious: run it on a random, non-standard port instead of 5900. While it won't keep out someone who's determined or does a full port scan, it will eliminate 99+% of the "drive-bys" which only look at a handful of common ports. I do that with SSH and have fail2ban set up to take care of the few which get through.

/M

+ 1

Re: How to secure VNC and port 5900

Thu, 06 Dec 2012 12:14:55 EDT

KA0OUV posted : +1

Re: How to secure VNC and port 5900

Wed, 05 Dec 2012 17:40:16 EDT

anon posted :

said by Woody79_00:

I personally would not use LogMeIn for ANYTHING free or not...this is even more true in a business environment.

Security Rule #1: NEVER trust an offsite service to have access or give access to your local LAN period...end of discussion.

Servers that give you and/or workers remote access to the office should be servers hosted and maintained onsite by your IT Department or network administrator.

OpenVPN is not to difficult to set up...LogMeIn is just a lazy insecure way to do something that should be done the right away that is not too hard to set up to begin with. If a person or small business doens't know how to set up a OpenVPN Server, they they have no business operating or offering remote access to begin with. Spend the money and hire someone who knows how to set one up.

Any security conscious IT person would not use LogMeIn under a business environment and would set up his own secure access method with the hardware and software on site under his/her supervision..and just wouldn't take LogMeIn word for it....

OpenVPN is pretty easy to set up, there really is no excuse....

My apologies for the rant, but trusting an offsite company with remote access to any LAN i work on just doesn't sit well with me...

You're living in the past a little bit. The security layer for local password authentication isn't stored on the remote server. The service is trusted and supported by a ton of security conscious people. While I do agree with you to some degree (which is governed by the type of business or security level a client needs), LogMeIn is far more secure and trusted than any other source out there right now. Also, given the fact that this security level comes with a simplistic level of config and operation, makes it even more appealing for the novice user who may need to use something like this for remote access. I've run into a ton of people who end up trying to get RDP or VNC set up and operational and when they do, it's hacked in less than a few days and their systems are used for botnet crap. Fact is this, if you leave a port open on a firewall that responds to an open request and doesn't stealth out the scan, the prober knows what's inside. If they want to really bad, they'll continue to prod and get in one way or another.

Again, there is a time and place for every type of security setup and concern and config, but what applies to the tightest of needs for one scenario doesn't apply to all. And NO, it's not a matter of sacrifice at the expense of comfort. It's a matter of the right solution for the right issue at hand while still maintaining a strong security level.

Re: How to secure VNC and port 5900

Wed, 05 Dec 2012 12:45:16 EDT

Da Geek Kid posted : a better alternative to the logmein is the teamviewer.

Re: How to secure VNC and port 5900

Wed, 05 Dec 2012 12:09:22 EDT

Woody79_00 posted : I personally would not use LogMeIn for ANYTHING free or not...this is even more true in a business environment.

Security Rule #1: NEVER trust an offsite service to have access or give access to your local LAN period...end of discussion.

Servers that give you and/or workers remote access to the office should be servers hosted and maintained onsite by your IT Department or network administrator.

OpenVPN is not to difficult to set up...LogMeIn is just a lazy insecure way to do something that should be done the right away that is not too hard to set up to begin with. If a person or small business doens't know how to set up a OpenVPN Server, they they have no business operating or offering remote access to begin with. Spend the money and hire someone who knows how to set one up.

Any security conscious IT person would not use LogMeIn under a business environment and would set up his own secure access method with the hardware and software on site under his/her supervision..and just wouldn't take LogMeIn word for it....

OpenVPN is pretty easy to set up, there really is no excuse....

My apologies for the rant, but trusting an offsite company with remote access to any LAN i work on just doesn't sit well with me...

Re: How to secure VNC and port 5900

Wed, 05 Dec 2012 11:41:25 EDT

bn1221 posted : VPN on the firewall with a very strong password and certificate. I have my VPN at home set to block an IP after 3 failed attempts. That would keep the script kiddies away.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 23:21:54 EDT

Raphion posted : RealVNC Enterprise edition can also do this "fail2ban" type thing, has 256 bit AES encryption, and, in spite of the expensive sounding name, is only $50.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 22:09:14 EDT

mackey posted : I'm surprised no one's mentioned the obvious: run it on a random, non-standard port instead of 5900. While it won't keep out someone who's determined or does a full port scan, it will eliminate 99+% of the "drive-bys" which only look at a handful of common ports. I do that with SSH and have fail2ban set up to take care of the few which get through.

/M

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 21:42:10 EDT

TheTechGuru posted : Personally I like Remote Desktop over VNC.
--
CompTIA Network+ Certified

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 21:18:22 EDT

anon posted : Or you could just use LogMeIn Free and be done with it, including having to configure any port forwarding, etc. Easy, secure, and you can even use it on mobile devices if need be. Much better solution than VNC in my opinion.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 16:05:27 EDT

jaynick posted :

said by David:

did you go with hamachi?

The free version.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 15:12:44 EDT

stormbow posted :

said by Da Geek Kid:

may I ask why an hour when you are not expecting password attempts with anything other than a cert, why not 600 hours.

Once or twice I have had keyboard issues and have locked myself out (there is a "password" on the cert). I consider one hour enough punishment for myself. ;). If they continue to try to get in they get blocked all over again.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 15:08:16 EDT

Da Geek Kid posted : may I ask why an hour when you are not expecting password attempts with anything other than a cert, why not 600 hours.

Also, has anyone looked @ freeNX/NoMachine... Works great.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 14:55:03 EDT

stormbow posted : I am another that tunnels VNC over SSH. My SSH is configured to use a certificate, so no way to hack the password and I have fail2ban running to block IPs trying to get into my SSH. Three fails and you're blocked for an hour.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 14:24:07 EDT

David posted : did you go with hamachi?

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 12:01:18 EDT

jaynick posted : Thanks much everyone for all the great help here. I am giving logmein a try for now on the windows machines, no need to open any ports and seems secure and simple.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 07:31:37 EDT

angussf posted : @Wildcatboy -- you are right about Ultr@VNC being able to use encryption plugins. Unfortunately Ultr@VNC is Windows-only, so if you want to use VNC to control a Mac or a Linux or a *BSD box, you must use some other flavour of VNC tunnelled over SSH or through a VPN for security.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 02:47:24 EDT

Wildcatboy posted :
You can make it as complicated as you want using SSH tunneling or a VPN, etc... or you can just use the built in features in UltraVNC. That is of course if your computers run on Windows.

UltraVNC already has a feature that allows you to use their DSM plugin (Data Stream Modification) for 128 bit encryption using an RC4 random key. No additional software needed. It will even let you generate a random RC4 key right within the admin properties.

You generate the key and keep one copy on the server and one on the client. If the key is not present on both computers, the connection fails, period.

If the key is present on both, they connect but you still need to login with a password. To bypass the 8 character password limit simply require MS Logon, in which case you can choose one of the users on the server and give it access. The access could even be limited to view only or interact or full access. It could even be a guest account. Your choice. And of course that account could have a very very long password too as opposed to just 8 characters. Not that it's really necessary when you're using the RC4 key.
--
You can catch the Devil, but you can't hold him long.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 00:54:09 EDT

mmainprize posted : One other thing that could be done is.
You have to set an account to be used for the remote control access and that user must be who logs in.

So edit you policy using the windows policy editor to make it hard on a hacker. After he fails to enter the correct password three times the account logon is locked for one hour. Even an eight char password will work for that and since you know the password this should not be a problem for you but a big problem for the hacker.

Re: How to secure VNC and port 5900

Tue, 04 Dec 2012 00:13:55 EDT

TheTechGuru posted : I would setup a PPTP VPN (get a router that has it built it) and just connect to the VPN server (in the router) which then will put you on the LAN remotely then connect to the VNC.
--
CompTIA Network+ Certified

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 23:53:10 EDT

HELLFIRE posted : As others have said, the router log entry was a successful connection on port 5900, but it does NOT mean someone
was able to login via VNC. I don't know if it supports it, but if VNC or the machine itself permits a log of successful
logins, set it up so you can keep track of VNC attempts.

I also like StuartMW's suggestion of limit the source IP addresses able to access VNC to a specific subset.

You've done all you can at the network layer to secure stuff, you also have to keep in mind about application layer
security as well.

Regards

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 21:02:31 EDT

jaynick posted : F1B3 is setup for that(ssh-tunnel). No worries on that machine. :D Thanks to parkut ;)

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:58:49 EDT

jaynick posted : I saw that, that's a shame.

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:44:57 EDT

alphapointe posted : I use Logmein to the windows boxes, and SSH-tunnelled-VNC to the linux boxes when I'm outside the LAN. I get the occasional idiot that wants to try to brute-force my SSHd server, but I just block his IP (or entire netblock...) in the router.

I also drop traffic from quite a few countries that have no business connecting to me, and it's kept my portscan, bogus SIP attempts, and spam (I run my own SMTP server) levels very low...
--
"When the hammer drops, the bullshit stops"

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:39:34 EDT

StuartMW posted : I believe Microsoft does the same thing with Hotmail passwords.

»Hotmail No Longer Accepts Long Passwords, Shortens Them...
--
Don't feed trolls--it only makes them grow!

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:37:02 EDT

jaynick posted : You are correct, it was dropping the remaining characters....it fooled me.

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:30:14 EDT

jaynick posted :

said by dave:

said by jaynick:

I just thought I see the word attempt or blocked or something like that instead of just LAN access. Wasn't sure what to make of it. Any way I'll use one of the other suggested approaches.

You are confusing layers. A TCP connection was successfully established. We presume they were not able to log in, but that's not your router's concern.

Thanks, dave , yes I got it now and headed to different solution for remote access(ssh).

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:28:08 EDT

jaynick posted :

said by RickNY:

Best practice for securing VNC is to tunnel it through SSH...As others have already mentioned here. If your VNC server supports it, allow it to only listen on the localhost interface (127.0.0.1) to further protect it from internal LAN attacks. When setup that way, it will only accept connections on a SSH tunnel. In case it was not obvious, the only port that should be forwarded would be the port you are using for SSHD.

Yes, thanks, that's where I am headed.

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:27:41 EDT

dave posted :

said by jaynick:

I just thought I see the word attempt or blocked or something like that instead of just LAN access. Wasn't sure what to make of it. Any way I'll use one of the other suggested approaches.

You are confusing layers. A TCP connection was successfully established. We presume they were not able to log in, but that's not your router's concern.

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:27:19 EDT

StuartMW posted : Howto use SSH local and remote port forwarding
--
Don't feed trolls--it only makes them grow!

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:23:57 EDT

RickNY posted : Best practice for securing VNC is to tunnel it through SSH...As others have already mentioned here. If your VNC server supports it, allow it to only listen on the localhost interface (127.0.0.1) to further protect it from internal LAN attacks. When setup that way, it will only accept connections on a SSH tunnel. In case it was not obvious, the only port that should be forwarded would be the port you are using for SSHD.

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:19:44 EDT

StuartMW posted :

said by jaynick:

Bottom line is that all those entries were probes and attempts but not actual access. Correct?

Correct.

As for passwords it really depends if all 63 chars are being used as angussf pointed out.
--
Don't feed trolls--it only makes them grow!

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:19:35 EDT

jaynick posted : OMG! :o is that what it's doing? so much for that idea. Let me look into ssh tunnel...Thanks much folks for all the kind help. :)

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:17:41 EDT

jaynick posted : Bottom line is that all those entries were probes and attempts but not actual access. Correct? and a 63 char random password like I use for my wireless key would be as secure as it could get other than using other ways like mentioned above?

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:12:04 EDT

Snowy posted :

said by jaynick:

said by angussf:

said by Snowy:

A strong password generated from something such as
»www.grc.com/passwords.htm
would go a long way.

Unfortunately VNC only supports 8-character passwords.

Not true, I am using a 63 character random password generated at grc.com. Works without fail

Yikes, an 8 character limit, angussf may be correct about that.
What you might be seeing is VNC recognizing the first 8 characters & abandoning the balance of the string.

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:05:37 EDT

StuartMW posted :

said by jaynick:

Yes, that's the problem with that.

Yup. Well port forwarding is just a limited workaround to NAT. The intended purpose is to allow servers to appear as though they're directly on the internet (i.e. open to all comers).

Again if you secure VNC (or whatever) then any bad guys won't be able to get into your LAN box although any and all requests will get to that box (and rejected if you have good authentication).

The choice is up to you.
--
Don't feed trolls--it only makes them grow!

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 20:04:15 EDT

jaynick posted :

said by angussf:

said by Snowy:

A strong password generated from something such as
»www.grc.com/passwords.htm
would go a long way.

Unfortunately VNC only supports 8-character passwords.

Not true, I am using a 63 character random password generated at grc.com. Works without fail

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 19:57:23 EDT

angussf posted :

said by SoonerAl:

I would recommend running VNC through a Secure Shell [SSH] tunnel. ....

Absolutely!

Setup instructions here, including for Windows:

VNC tunneled thru SSH
»www.science.smith.edu/~ejensen/vncssh.html

--
Angus S-F
GeoApps, Tucson, Arizona, USA
»geoapps.com/
»www.linkedin.com/in/angussf
»geoapps.blogspot.com/

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 19:55:12 EDT

angussf posted :

said by Snowy:

A strong password generated from something such as
»www.grc.com/passwords.htm
would go a long way.

Unfortunately VNC only supports 8-character passwords.

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 19:46:15 EDT

jaynick posted :

said by StuartMW:

Of course you'd have to know what internet IP(s) you may have (i.e. what are you). The firewall will prevent any port scanners from even reaching your LAN while you'll get through.

Yes, that's the problem with that.

Re: How to secure VNC and port 5900

Mon, 03 Dec 2012 19:33:44 EDT

David posted : why not install logmein hamachi on the machine... It's free and secured.