Re: Too many authentication failures

pshoaf59--- via VNC-Tight-list <[email protected]> Mon, 2 Feb 2026 16:00:28 +0000
Newsgroups gmane.network.tight-vnc.general
Message-ID <DS4PR13MB7630DA3957F437E1A8D47593F29AA@DS4PR13MB7630.namprd13.prod.outlook.com>
--===============3038977588438432108==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_DS4PR13MB7630DA3957F437E1A8D47593F29AADS4PR13MB7630namp_"

--_000_DS4PR13MB7630DA3957F437E1A8D47593F29AADS4PR13MB7630namp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

I would recommend one of the following solutions:

  *
If you only need access via local network(s), change the accept to be only =
those networks you need, deny all others
  *
If you need one or more remote networks
     *
I recommend using a VPN tunnel
     *
If you can't use a VPN tunnel, then restrict the connections only to local =
networks and the few remote IP addresses ex 12.1.2.4

________________________________
From: Anton Luka =8Aijanec <[email protected]>
Sent: Sunday, February 1, 2026 1:52 PM
To: [email protected] <[email protected].=
net>
Subject: Too many authentication failures

Hello!

We are using Xtightvnc to automate keystroke sending to an antique program =
running in DOSBox (btw, if anyone has better solutions for this, please do =
tell). Our VNC server is secured with a strong password, but accepts connec=
tions from 0.0.0.0/0.

We ran into a problem of "Too many authentication failures" because bots an=
d scanners from the internet were trying passwords on our VNC server and af=
ter 5 tried passwords, our automation software couldn't log in anymore to p=
erform it's tasks. We added a firewall as a temporary measure, but today we=
 broke the firewall and bots broke our automation again.

It would be really useful to us if "Too many authentication failures" secur=
ity feature could be disabled (=3D=3D if user could set the value of MAX_AU=
TH_TRIES himself). We don't want auth bruteforcing to cause denial of servi=
ce so easily.

Is this already somehow possible in current Xtightvnc (Debian)? If not, are=
 you accepting contribution in form of patches to your project?

I can't find a way to disable this, even after looking at the source code i=
n vnc_unixsrc/Xvnc/programs/Xserver/hw/vnc/auth.c:

/*********************************************************************
  * Functions to prevent too many successive authentication failures.
  * FIXME: This should be performed separately per each client IP.
  */

/* Maximum authentication failures before blocking connections */
#define MAX_AUTH_TRIES 5

/* Delay in ms, doubles for each failure over MAX_AUTH_TRIES */
#define AUTH_TOO_MANY_BASE_DELAY 10 * 1000

static int rfbAuthTries =3D 0;
static Bool rfbAuthTooManyTries =3D FALSE;
static OsTimerPtr timer =3D NULL;

Regards
Anton


___________________________________________________________
TightVNC mailing list, [email protected]
To change your subscription or to UNSUBSCRIBE, please visit
https://lists.sourceforge.net/lists/listinfo/vnc-tight-list

--_000_DS4PR13MB7630DA3957F437E1A8D47593F29AADS4PR13MB7630namp_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
I would recommend one of the following solutions:</div>
<ul style=3D"margin-top: 0px; margin-bottom: 0px; list-style-type: square;"=
 data-editing-info=3D"{&quot;applyListStyleFromLevel&quot;:false,&quot;unor=
deredStyleType&quot;:3}">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role=3D"presentation" class=3D"elementToProof">If you only need access=
 via local network(s), change the accept to be only those networks you need=
, deny all others</div>
</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontServi=
ce, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role=3D"presentation" class=3D"elementToProof">If you need one or more=
 remote networks</div>
</li><ul style=3D"margin-top: 0px; margin-bottom: 0px; list-style-type: cir=
cle;" data-editing-info=3D"{&quot;applyListStyleFromLevel&quot;:true}">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role=3D"presentation" class=3D"elementToProof">I recommend using a VPN=
 tunnel</div>
</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontServi=
ce, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role=3D"presentation" class=3D"elementToProof">If you can't use a VPN =
tunnel, then restrict the connections only to local networks and the few re=
mote IP addresses ex 12.1.2.4</div>
</li></ul>
</ul>
<div id=3D"appendonsend"></div>
<hr style=3D"display:inline-block;width:98%" tabindex=3D"-1">
<div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st=
yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Anton Luka =8Aijanec =
&lt;[email protected]&gt;<br>
<b>Sent:</b> Sunday, February 1, 2026 1:52 PM<br>
<b>To:</b> [email protected] &lt;[email protected]=
urceforge.net&gt;<br>
<b>Subject:</b> Too many authentication failures</font>
<div>&nbsp;</div>
</div>
<div class=3D"BodyFragment"><font size=3D"2"><span style=3D"font-size:11pt;=
">
<div class=3D"PlainText">Hello!<br>
<br>
We are using Xtightvnc to automate keystroke sending to an antique program =
running in DOSBox (btw, if anyone has better solutions for this, please do =
tell). Our VNC server is secured with a strong password, but accepts connec=
tions from 0.0.0.0/0.<br>
<br>
We ran into a problem of &quot;Too many authentication failures&quot; becau=
se bots and scanners from the internet were trying passwords on our VNC ser=
ver and after 5 tried passwords, our automation software couldn't log in an=
ymore to perform it's tasks. We added a firewall
 as a temporary measure, but today we broke the firewall and bots broke our=
 automation again.<br>
<br>
It would be really useful to us if &quot;Too many authentication failures&q=
uot; security feature could be disabled (=3D=3D if user could set the value=
 of MAX_AUTH_TRIES himself). We don't want auth bruteforcing to cause denia=
l of service so easily.<br>
<br>
Is this already somehow possible in current Xtightvnc (Debian)? If not, are=
 you accepting contribution in form of patches to your project?<br>
<br>
I can't find a way to disable this, even after looking at the source code i=
n vnc_unixsrc/Xvnc/programs/Xserver/hw/vnc/auth.c:<br>
<br>
/*********************************************************************<br>
&nbsp; * Functions to prevent too many successive authentication failures.<=
br>
&nbsp; * FIXME: This should be performed separately per each client IP.<br>
&nbsp; */<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<br>
/* Maximum authentication failures before blocking connections */<br>
#define MAX_AUTH_TRIES 5<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<br>
/* Delay in ms, doubles for each failure over MAX_AUTH_TRIES */<br>
#define AUTH_TOO_MANY_BASE_DELAY 10 * 1000<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<br>
static int rfbAuthTries =3D 0;<br>
static Bool rfbAuthTooManyTries =3D FALSE;<br>
static OsTimerPtr timer =3D NULL;<br>
<br>
Regards<br>
Anton<br>
<br>
<br>
___________________________________________________________<br>
TightVNC mailing list, [email protected]<br>
To change your subscription or to UNSUBSCRIBE, please visit<br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/vnc-tight-list">htt=
ps://lists.sourceforge.net/lists/listinfo/vnc-tight-list</a><br>
</div>
</span></font></div>
</body>
</html>

--_000_DS4PR13MB7630DA3957F437E1A8D47593F29AADS4PR13MB7630namp_--


--===============3038977588438432108==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============3038977588438432108==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

___________________________________________________________
TightVNC mailing list, [email protected]
To change your subscription or to UNSUBSCRIBE, please visit
https://lists.sourceforge.net/lists/listinfo/vnc-tight-list

--===============3038977588438432108==--