From 677b9dbd119567dc6f6826b329dc875cfff624b4 Mon Sep 17 00:00:00 2001 From: Vladislav Grigoryev Date: Sat, 1 Jun 2024 23:15:34 +0000 Subject: [PATCH] Update TigerVNC.adoc Follow the upstream documentation to configure the service: https://github.com/TigerVNC/tigervnc/tree/master/unix/vncserver --- .../infrastructure-services/TigerVNC.adoc | 344 +++++------------- 1 file changed, 91 insertions(+), 253 deletions(-) diff --git a/modules/system-administrators-guide/pages/infrastructure-services/TigerVNC.adoc b/modules/system-administrators-guide/pages/infrastructure-services/TigerVNC.adoc index ba8b53f..1e970f5 100644 --- a/modules/system-administrators-guide/pages/infrastructure-services/TigerVNC.adoc +++ b/modules/system-administrators-guide/pages/infrastructure-services/TigerVNC.adoc @@ -5,22 +5,13 @@ include::{partialsdir}/entities.adoc[] [[ch-TigerVNC]] = TigerVNC -`TigerVNC` (Tiger Virtual Network Computing) is a system -for graphical desktop sharing which allows you to remotely control other computers. +TigerVNC is an open source VNC server and client software for remote access. +It starts a graphical desktop session that you can connect to remotely over the VNC protocol. -`TigerVNC` works on the client-server network: a +TigerVNC works on the client-server model: a *server* shares its output (`vncserver`) and a *client* (`vncviewer`) connects to the server. -[NOTE] -==== - -Unlike in Fedora 15 and Red{nbsp}Hat Enterprise{nbsp}Linux{nbsp}6, `TigerVNC` in {MAJOROS} uses the `systemd` system management daemon for its configuration. -The `/etc/sysconfig/vncserver` configuration file has been replaced -by `/etc/systemd/system/vncserver@.service`. - -==== - [[s1-vnc-server]] == VNC Server @@ -35,7 +26,6 @@ from anywhere. To install the [application]*TigerVNC* server, issue the following command as `root`: -[subs="attributes"] ---- # dnf install tigervnc-server ---- @@ -43,286 +33,151 @@ To install the [application]*TigerVNC* server, issue the following command as `r [[s3-configuring-vnc-server]] === Configuring VNC Server -[[configuring-vncserver]] -.Configuring the first VNC connection -. A configuration file named `/etc/systemd/system/vncserver@.service` is required. To create this file, copy the `/lib/systemd/system/vncserver@.service` file as `root`: +. Edit the configuration file `/etc/tigervnc/vncserver.users` to assign specific display numbers to user names. + -[subs="macros, attributes"] ---- - -# cp /lib/systemd/system/vncserver@.service /etc/systemd/system/vncserver@.service - +:display_number=user_name ---- + -There is no need to include the display number in the file name because `systemd` automatically creates the appropriately named instance in memory on demand, replacing `'%i'` in the service file by the display number. For a single user it is not necessary to rename the file. For multiple users, a uniquely named service file for each user is required, for example, by adding the user name to the file name in some way. See xref:TigerVNC.adoc#configuring-vncserver-2users[Configuring VNC Server for Two Users] for details. - -. Edit `/etc/systemd/system/vncserver@.service`, - replacing _USER_ with the actual user name. - Leave the remaining lines of the file unmodified. - The [option]`-geometry` argument specifies the size of the VNC desktop to - be created; by default, it is set to `1024x768`. +Each user should be assigned a unique display number. +The display numbers `:2` and `:3` are the easiest to configure. +It is recommended to reserve `:0` and `:1` for local users to avoid race conditions. + -[subs="quotes, macros"] ----- +If you need to change the default session settings, customize the configuration `/etc/tigervnc/vncserver-config-defaults`. -ExecStart=/sbin/runuser -l _USER_ -c "/usr/bin/vncserver %i -geometry 1280x1024" -PIDFile=/home/pass:attributes[{blank}]_USER_pass:attributes[{blank}]/.vnc/%H%i.pid - ----- - -. Save the changes. - -. To make the changes take effect immediately, issue the following command: +. Configure the VNC password for the user. + -[subs="macros, attributes"] ---- - -# pass:quotes[`systemctl daemon-reload`] - ----- - -. Set the password for the user or users defined in the configuration file. Note - that you need to switch from `root` to _USER_ first. -+ -[subs="macros, attributes"] ----- - -# su - pass:quotes[_USER_] -$ pass:quotes[`vncpasswd`] +# su -c vncpasswd user_name Password: Verify: - ---- + [IMPORTANT] ==== - The stored password is not encrypted; anyone who has access to the password file can find the plain-text password. - ==== -Proceed to xref:TigerVNC.adoc#s4-starting-vncserver[Starting VNC Server]. -[[configuring-vncserver-2users]] -==== Configuring VNC Server for Two Users +[[s4-managing-vncserver]] +=== Managing VNC Server -If you want to configure more than one user on the same machine, -create different template-type service files, one for each user. +The name of the service instance includes the display number that matches the `/etc/tigervnc/vncserver.users` configuration. -. Create two service files, for example `vncserver-_USER_1_pass:attributes[{blank}]@.service` - and `vncserver-_USER_2_pass:attributes[{blank}]@.service`. - In both these files substitute _USER_ with the correct user name. - -. Set passwords for both users: -+ -[subs="macros, attributes"] ----- - -$ su - USER_1 -$ vncpasswd -Password: -Verify: -$ su - USER_2 -$ vncpasswd -Password: -Verify: +Enable and start the VNC service instance for the specified display number: ---- - -[[s4-starting-vncserver]] -=== Starting VNC Server - -To start or enable the service, specify the display number directly in the command. -The file configured above in xref:TigerVNC.adoc#configuring-vncserver[Configuring the first VNC connection] works as a template, in which `%i` is substituted with -the display number by `systemd`. -With a valid display number, execute the following command: - -[subs="attributes"] ----- - -# systemctl start vncserver@:display_number.service - ----- - -You can also enable the service to start automatically at system start. Then, when you log in, `vncserver` is automatically started. As `root`, issue a command as follows: - -[subs="attributes"] ----- - # systemctl enable vncserver@:display_number.service - +# systemctl start vncserver@:display_number.service ---- -At this point, other users are able to use a VNC viewer program to connect to the VNC server using the display number and password defined. Provided a graphical desktop is installed, an instance of that desktop will be displayed. It will not be the same instance as that currently displayed on the target machine. +For more information on managing system services, follow the link:++https://docs.fedoraproject.org/en-US/fedora/latest/system-administrators-guide/infrastructure-services/Services_and_Daemons/++[Services and Daemons] documentation . [[starting-vncserver-2displays]] -==== Configuring VNC Server for Two Users and Two Different Displays +=== Configuring VNC Server for Multiple Users -For the two configured VNC servers, vncserver-USER_1@.service and vncserver-USER_2@.service, -you can enable different display numbers. For example, the following commands will cause a VNC server for USER_1 to -start on display 3, and a VNC server for USER_2 to start on display 5: +Repeat the above steps for each user which you want to provide VNC access. -[subs="attributes"] ----- - -# systemctl start vncserver-USER_1@:3.service -# systemctl start vncserver-USER_2@:5.service - ----- - -[[terminating-vnc-session]] -=== Terminating a VNC Session - -Similarly to enabling the `vncserver` service, you can disable -the automatic start of the service at system start: - -[subs="attributes"] ----- - -# systemctl disable vncserver@:display_number.service - ----- - -Or, when your system is running, you can stop the service by issuing the following -command as `root`: - -[subs="attributes"] ----- - -# systemctl stop vncserver@:display_number.service - ----- - -[[s5-vnc-viewer]] -== VNC Viewer - -`vncviewer` is the program which shows the shared graphical -user interfaces and controls the server. - -For operating the `vncviewer`, there is a pop-up menu -containing entries which perform various actions such as switching in and out of -full-screen mode or quitting the viewer. Alternatively, you can operate `vncviewer` -through the terminal. Enter [command]#vncviewer -h# on the command line to list `vncviewer`pass:attributes[{blank}]'s parameters. - -[[installing-vncviewer]] -=== Installing VNC Viewer - -To install the [application]*TigerVNC* client, [command]#vncviewer#pass:attributes[{blank}]>, issue the following command as `root`: - -[subs="attributes"] ----- -# dnf install tigervnc ----- - -[[s6-connecting-vnc-viewer]] -=== Connecting to VNC Server - -Once the VNC server is configured, you can connect to it from any VNC viewer. -In order to do so, issue the [command]#vncviewer# command in the following format: - -[subs="macros"] ----- -vncviewer pass:quotes[_address_]:pass:quotes[_port_number_] ----- - -Where _address_ is an `IP` or host name. - -[[connecting-to-vncserver]] -.One Client Connecting to VNC Server -==== - -With the `IP` address `192.168.0.4` and display number *3* -the command looks as follows: - -[subs="quotes, macros, attributes"] ----- - -[command]#$ vncviewer 192.168.0.4:3# - ----- - -==== - -[[sec-Configuring_the_Firewall_for_VNC]] -==== Configuring the Firewall for VNC +[[sec-Configuring_Firewall]] +=== Configuring Firewall When using a non-encrypted connection, `firewalld` might block the connection. To allow `firewalld` to pass the VNC packets, you can open specific ports to `TCP` traffic. When using the [option]`-via` option, traffic is redirected over `SSH` which is enabled by default in `firewalld`. [NOTE] ==== - -The default port of VNC server is 5900. To reach the port through which a remote -desktop will be accessible, sum the default port and the user's -assigned display number. For example, for the second port: 2 + 5900 = 5902. - +The default port of VNC server is 5900. +To reach the port through which a remote desktop will be accessible, sum the default port and the user's assigned display number. +For example, for the second port: 2 + 5900 = 5902. ==== -For displays `0` to `3`, make use of `firewalld`pass:attributes[{blank}]'s support for the VNC service by means of the [option]`service` option as described below. Note that for display numbers greater than `3`, the corresponding ports will have to be opened specifically as explained in xref:TigerVNC.adoc#proc-Opening-Ports_in_firewalld[Opening Ports in firewalld]. - -[[proc-Enabling_VNC_Service_in_firewalld]] -.Enabling VNC Service in firewalld -. Run the following command to see the information concerning `firewalld` - settings: +. Allow access to the VNC server in the default firewall zone using the built-in `vnc-server` service definition for display numbers `:0` to `:3`: + -[subs="quotes, macros, attributes"] ---- +# firewall-cmd --permanent --add-service=vnc-server +success -[command]#$ firewall-cmd --list-all# - ----- - -. To allow all VNC connections from a specific address, use a command as follows: -+ -[subs="attributes"] ----- -# firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.122.116" service name=vnc-server accept' +# firewall-cmd --reload success ---- -+ -See the link:++https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/++[Red{nbsp}Hat Enterprise{nbsp}Linux{nbsp}7 Security Guide] for more information on the use of firewall rich language commands. . To verify the above settings, use a command as follows: + -[subs="attributes"] ---- # firewall-cmd --list-all public (default, active) interfaces: bond0 bond0.192 sources: - services: dhcpv6-client ssh + services: dhcpv6-client ssh vnc-server ports: masquerade: no forward-ports: icmp-blocks: rich rules: - rule family="ipv4" source address="192.168.122.116" service name="vnc-server" accept ---- -To open a specific port or range of ports make use of the [option]`--add-port` option to the [command]#firewall-cmd# command Line tool. For example, VNC display `4` requires port `5904` to be opened for `TCP` traffic. - -[[proc-Opening-Ports_in_firewalld]] -.Opening Ports in firewalld -. To open a port for `TCP` traffic in the public zone, issue a command as `root` as follows: +. Ports for display numbers higher than `:3` can be opened by customizing the service definition: + -[subs="attributes"] ---- -# firewall-cmd --zone=public --add-port=5904/tcp +# firewall-cmd --permanent --service=vnc-server --add-port=5904/tcp success + +# firewall-cmd --reload +success + +# firewall-cmd --info-service=vnc-server +vnc-server + ports: 5900-5903/tcp 5904/tcp + protocols: + source-ports: + modules: + destination: + includes: + helpers: ---- -. To view the ports that are currently open for the public zone, issue a command as follows: -+ -[subs="attributes"] +For more information on opening and closing ports in `firewalld` as well as limiting access to specific address scopes, follow the link:++https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/++[Red{nbsp}Hat Enterprise{nbsp}Linux{nbsp}7 Security Guide]. + +At this point, you can use a VNC client to connect to the VNC server using the display number and password defined. +Provided a graphical desktop is installed, an instance of that desktop will be displayed. + +[[s5-vnc-client]] +== VNC Client + +`vncviewer` is a VNC client which shows the shared graphical user interfaces and controls the server. + +For operating the `vncviewer`, there is a pop-up menu +containing entries which perform various actions such as switching in and out of +full-screen mode or quitting the client. Alternatively, you can operate `vncviewer` +through the terminal. Enter `vncviewer -h` on the command line to list the VNC client's parameters. + +[[installing-vnc-client]] +=== Installing VNC Client + +To install the [application]*TigerVNC* client, issue the following command as `root`: + ---- -# firewall-cmd --zone=public --list-ports -5904/tcp +# dnf install tigervnc ---- -A port can be removed using the [command]#firewall-cmd --zone=pass:attributes[{blank}]_zone_ --remove-port=pass:attributes[{blank}]_number/protocol_pass:attributes[{blank}]# command. +[[s6-connecting-vnc-client]] +=== Connecting to VNC Server -For more information on opening and closing ports in `firewalld`, see the link:++https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/++[Red{nbsp}Hat Enterprise{nbsp}Linux{nbsp}7 Security Guide]. +Once the VNC server is configured, you can connect to it with any VNC client. +In order to do so, issue the `vncviewer` command in the following format: + +---- +$ vncviewer host_address:display_number +---- + +Where _address_ is an `IP` or host name. + +With the `IP` address `192.168.0.4` and display number *:3* the command looks as follows: + +---- +$ vncviewer 192.168.0.4:3 +---- [[s1-using_ssh]] === Connecting to VNC Server Using SSH @@ -331,41 +186,26 @@ For more information on opening and closing ports in `firewalld`, see the link:+ The format of the command to encrypt a VNC server-client connection is as follows: -[subs="attributes"] ---- - $ vncviewer -via user@host:display_number - ---- [[using-via]] -.Using the -via Option -==== +==== Using the -via Option -. To connect to a VNC server using `SSH`, enter a command as follows: -+ -[subs="attributes"] ----- - -$ vncviewer -via USER_2@192.168.2.101:3 +To connect to a VNC server using `SSH`, enter a command as follows: +---- +$ vncviewer -via user@192.168.2.101:3 ---- -. When you are prompted to, type the password, and confirm by pressing kbd:[Enter]. +When you are prompted to, type the password, and confirm by pressing kbd:[Enter]. +A window with a remote desktop appears on your screen. -. A window with a remote desktop appears on your screen. - -==== - -.Restricting VNC Access +[[restricting-vnc-access]] +==== Restricting VNC Access If you prefer only encrypted connections, you can prevent unencrypted connections -altogether by using the [option]`-localhost` option in the `systemd.service` -file, the ExecStart line: - -[subs="quotes, macros"] ----- -ExecStart=/sbin/runuser -l _user_ -c "/usr/bin/vncserver -localhost %i" ----- +altogether by uncommenting the `localhost` option in the `/etc/tigervnc/vncserver-config-defaults` configuration. This will stop `vncserver` from accepting connections from anything but the local host and port-forwarded connections sent using `SSH` as a result of the [option]`-via` option. @@ -376,10 +216,8 @@ For more information on using `SSH`, see xref:infrastructure-services/OpenSSH.ad For more information about TigerVNC, see the resources listed below. -.Installed Documentation +Installed Documentation: * `vncserver(1)` — The *VNC* server manual pages. - * `vncviewer(1)` — The *VNC* viewer manual pages. - * `vncpasswd(1)` — The *VNC* password manual pages. -- 2.55.0