Re: VNC over VPN, security considerations?

John:

	Heya. I help answer many questions like these over on
the VNC mailing lists, so I think I finally have some content to
deliver to this list. :)

	In general, the considerations to securely using VNC
are not that much different in securing anything else: you need
to worry about transport security by utilizing some form of data
encryption, and you need to worry about user-authentication.
With your VPN connection, I presume you have the first part
pretty well covered. As for the second, VNC is limited to an
8-character password, but it is exchanged between the viewer
and server in a challenge-response, so the password itself
never crosses the wires. VNC also supports an AuthHosts setting
that lets you restrict access to a server from a specific range
of IP addresses. Similarly, the LoopbackOnly setting forces the
VNC Server to listen to the loopback interface, requiring the
user to setup a tunnel with something else, presumedly something
secure such as SSH or Zebedee. Lastly, an offshoot of version 3.3
VNC which calls itself UltraVNC can be setup to work with a
traditional NT authentication environment. It also supports the
AuthHosts and LoopbackOnly usage modes.

	As for any "inherent" flaws you'd need to worry about
simple by running a VNC server, I've never heard of any exploits
or any buffer-overflow attacks it is subject to. About 2 years
ago, it's good name was besmirched as an email virus contained
a rogue VNC Server in the payload. It is fairly uncommon, very
easy to remove, and would likely disappear from common knowledge
if not for the reminder in "PC Anywhere"'s installer.

	The biggest liability to running VNC Server on a machine
that's also part of a VPN connection are the usual "split-tunneling"
concerns. Most VPN clients rightly disable incoming connections
from the local, unsecured LAN a VPN client PC is situated on.
VNC doesn't "override" this security precaution in any sense.

	That's all that leaps to mind. Hope this helps!

-Scott

On Mon, 15 Dec 2003, Galeotos, John wrote:

>
> 	Hello,
>
> 	Well again normally I just sit back and read what you all have to
> say, but I've
> 	got another question. For the most part our VPN is up and functional
> without
> 	anything more for me to do except load the cisco client software on
> to the
> 	machines of the converts. Recently however I have been looking at
> uses I could
> 	have for the VPN aside from answering my Emails on my days off.
>
> 	One of the software products I use on occasion is VNC for remote
> control access
> 	and installs of patches, and the like. It looks as if when I do a
> search for ports
> 	and VNC I get as many hits telling me that ports 5800 and
> 5900+display# are the
> 	ones used as I get "VNC port firewall, viren, hackertools, and
> exploits." This does
> 	not give me a warm fuzzy about opening those ports so that I could
> use VNC
> 	over the VPN.
>
> 	So my question is simply: "What are the considerations and
> mitigating steps
> 	that I could take if we decided to open these ports up? Or...is it
> simply a very
> 	bad idea?
>
> 	Thanks for your time. I'll go back to reading for the most part
> again.
>
> 	John Galeotos
>