Re: Too many authentication failures
pshoaf59--- via VNC-Tight-list <[email protected]> Mon, 2 Feb 2026 16:00:28 +0000
| Newsgroups | gmane.network.tight-vnc.general |
|---|---|
| Message-ID | <DS4PR13MB7630DA3957F437E1A8D47593F29AA@DS4PR13MB7630.namprd13.prod.outlook.com> |
--===============3038977588438432108==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_DS4PR13MB7630DA3957F437E1A8D47593F29AADS4PR13MB7630namp_"
--_000_DS4PR13MB7630DA3957F437E1A8D47593F29AADS4PR13MB7630namp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
I would recommend one of the following solutions:
*
If you only need access via local network(s), change the accept to be only =
those networks you need, deny all others
*
If you need one or more remote networks
*
I recommend using a VPN tunnel
*
If you can't use a VPN tunnel, then restrict the connections only to local =
networks and the few remote IP addresses ex 12.1.2.4
________________________________
From: Anton Luka =8Aijanec <[email protected]>
Sent: Sunday, February 1, 2026 1:52 PM
To: [email protected] <[email protected].=
net>
Subject: Too many authentication failures
Hello!
We are using Xtightvnc to automate keystroke sending to an antique program =
running in DOSBox (btw, if anyone has better solutions for this, please do =
tell). Our VNC server is secured with a strong password, but accepts connec=
tions from 0.0.0.0/0.
We ran into a problem of "Too many authentication failures" because bots an=
d scanners from the internet were trying passwords on our VNC server and af=
ter 5 tried passwords, our automation software couldn't log in anymore to p=
erform it's tasks. We added a firewall as a temporary measure, but today we=
broke the firewall and bots broke our automation again.
It would be really useful to us if "Too many authentication failures" secur=
ity feature could be disabled (=3D=3D if user could set the value of MAX_AU=
TH_TRIES himself). We don't want auth bruteforcing to cause denial of servi=
ce so easily.
Is this already somehow possible in current Xtightvnc (Debian)? If not, are=
you accepting contribution in form of patches to your project?
I can't find a way to disable this, even after looking at the source code i=
n vnc_unixsrc/Xvnc/programs/Xserver/hw/vnc/auth.c:
/*********************************************************************
* Functions to prevent too many successive authentication failures.
* FIXME: This should be performed separately per each client IP.
*/
/* Maximum authentication failures before blocking connections */
#define MAX_AUTH_TRIES 5
/* Delay in ms, doubles for each failure over MAX_AUTH_TRIES */
#define AUTH_TOO_MANY_BASE_DELAY 10 * 1000
static int rfbAuthTries =3D 0;
static Bool rfbAuthTooManyTries =3D FALSE;
static OsTimerPtr timer =3D NULL;
Regards
Anton
___________________________________________________________
TightVNC mailing list, [email protected]
To change your subscription or to UNSUBSCRIBE, please visit
https://lists.sourceforge.net/lists/listinfo/vnc-tight-list
--_000_DS4PR13MB7630DA3957F437E1A8D47593F29AADS4PR13MB7630namp_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
I would recommend one of the following solutions:</div>
<ul style=3D"margin-top: 0px; margin-bottom: 0px; list-style-type: square;"=
data-editing-info=3D"{"applyListStyleFromLevel":false,"unor=
deredStyleType":3}">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role=3D"presentation" class=3D"elementToProof">If you only need access=
via local network(s), change the accept to be only those networks you need=
, deny all others</div>
</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontServi=
ce, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role=3D"presentation" class=3D"elementToProof">If you need one or more=
remote networks</div>
</li><ul style=3D"margin-top: 0px; margin-bottom: 0px; list-style-type: cir=
cle;" data-editing-info=3D"{"applyListStyleFromLevel":true}">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role=3D"presentation" class=3D"elementToProof">I recommend using a VPN=
tunnel</div>
</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontServi=
ce, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div role=3D"presentation" class=3D"elementToProof">If you can't use a VPN =
tunnel, then restrict the connections only to local networks and the few re=
mote IP addresses ex 12.1.2.4</div>
</li></ul>
</ul>
<div id=3D"appendonsend"></div>
<hr style=3D"display:inline-block;width:98%" tabindex=3D"-1">
<div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st=
yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Anton Luka =8Aijanec =
<[email protected]><br>
<b>Sent:</b> Sunday, February 1, 2026 1:52 PM<br>
<b>To:</b> [email protected] <[email protected]=
urceforge.net><br>
<b>Subject:</b> Too many authentication failures</font>
<div> </div>
</div>
<div class=3D"BodyFragment"><font size=3D"2"><span style=3D"font-size:11pt;=
">
<div class=3D"PlainText">Hello!<br>
<br>
We are using Xtightvnc to automate keystroke sending to an antique program =
running in DOSBox (btw, if anyone has better solutions for this, please do =
tell). Our VNC server is secured with a strong password, but accepts connec=
tions from 0.0.0.0/0.<br>
<br>
We ran into a problem of "Too many authentication failures" becau=
se bots and scanners from the internet were trying passwords on our VNC ser=
ver and after 5 tried passwords, our automation software couldn't log in an=
ymore to perform it's tasks. We added a firewall
as a temporary measure, but today we broke the firewall and bots broke our=
automation again.<br>
<br>
It would be really useful to us if "Too many authentication failures&q=
uot; security feature could be disabled (=3D=3D if user could set the value=
of MAX_AUTH_TRIES himself). We don't want auth bruteforcing to cause denia=
l of service so easily.<br>
<br>
Is this already somehow possible in current Xtightvnc (Debian)? If not, are=
you accepting contribution in form of patches to your project?<br>
<br>
I can't find a way to disable this, even after looking at the source code i=
n vnc_unixsrc/Xvnc/programs/Xserver/hw/vnc/auth.c:<br>
<br>
/*********************************************************************<br>
* Functions to prevent too many successive authentication failures.<=
br>
* FIXME: This should be performed separately per each client IP.<br>
*/<br>
&nb=
sp; =
&nb=
sp; =
&nb=
sp; =
<br>
/* Maximum authentication failures before blocking connections */<br>
#define MAX_AUTH_TRIES 5<br>
&nb=
sp; =
&nb=
sp; =
&nb=
sp; =
<br>
/* Delay in ms, doubles for each failure over MAX_AUTH_TRIES */<br>
#define AUTH_TOO_MANY_BASE_DELAY 10 * 1000<br>
&nb=
sp; =
&nb=
sp; =
&nb=
sp; =
<br>
static int rfbAuthTries =3D 0;<br>
static Bool rfbAuthTooManyTries =3D FALSE;<br>
static OsTimerPtr timer =3D NULL;<br>
<br>
Regards<br>
Anton<br>
<br>
<br>
___________________________________________________________<br>
TightVNC mailing list, [email protected]<br>
To change your subscription or to UNSUBSCRIBE, please visit<br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/vnc-tight-list">htt=
ps://lists.sourceforge.net/lists/listinfo/vnc-tight-list</a><br>
</div>
</span></font></div>
</body>
</html>
--_000_DS4PR13MB7630DA3957F437E1A8D47593F29AADS4PR13MB7630namp_--
--===============3038977588438432108==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============3038977588438432108==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
___________________________________________________________
TightVNC mailing list, [email protected]
To change your subscription or to UNSUBSCRIBE, please visit
https://lists.sourceforge.net/lists/listinfo/vnc-tight-list
--===============3038977588438432108==--