Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to setup a ssh tunneled vnc connection from my centos 5.10 machine and I've been following some online tutorials such as this one: https://wiki.archlinux.org/index.php/Vncserver. I'm running the server like this: $ vncserver -geometry 1024x768 -localhost :1 and connecting with an openssh client like this: ssh -f me@vnc.machine -L 5900:vnc.machine:5901 -N. Then I connect with realvnc viewer to localhost:5900. For some reason this doesn't work if I use the -localhost param, but it works great if I leave it out. All of the guides say that it's more secure to use it. I'm thinking this might be a configuration issue on the server side, but I'm pretty much stumped at this point and I've tried a lot of stuff. Can anybody tell me why this is happening?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The -localhost option is telling the VNC server to bind only to the loopback interface, so that you can only connect to the VNC server from the machine it's running on. This means that anyone trying to break into your VNC session would have to be able to get on that particular machine. Without -localhost, your VNC server would accept non-local connections, so an attacker could use another machine to try to break into your VNC session.

If you're going to use -localhost, then you should be passing -L 5900:localhost:5901, not -L 5900:vnc.machine:5901, since your VNC server is listening only on the loopback (localhost) interface.

share|improve this answer
    
Maybe I'm confused, but wouldn't that just forward port 5900 from the client machine to 5901 on the client machine? –  zallik Feb 12 at 2:59
    
No, it forwards 5900 on the client machine to 5901 on localhost -- from the point of view of the server, not the client. So localhost would refer to the server. –  jjlin Feb 12 at 5:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.