特殊:Badtitle/NS100:VNC

来自Ubuntu中文
Wikibot留言 | 贡献2009年11月17日 (二) 21:07的版本
跳到导航跳到搜索

{{#ifexist: :VNC/zh | | {{#ifexist: VNC/zh | | {{#ifeq: {{#titleparts:VNC|1|-1|}} | zh | | }} }} }} {{#ifeq: {{#titleparts:VNC|1|-1|}} | zh | | }}

VNC is a protocol that allows a desktop to be viewed and controlled remotely over the Internet. To use VNC, you need to run a VNC server on the computer sharing a desktop, and a VNC client on the computer accessing the shared desktop. VNC is a widely useful tool, although you'll need to do some work to set it up for your particular use case. This page will discuss some common uses for VNC, then guide you through some example scenarios. You may want to [[UbuntuHelp:[guide|skip straight to the examples]]].

Common uses

The two most common uses for VNC are to control your own desktop from another computer and to let other people view your desktop while you're sitting at it.

Accessing your desktop over the Internet

Although VNC has some optional security features, you should not run VNC directly over an untrusted network like the Internet. Instead, you should set an SSH server up as discussed in the SSH guide and configure a VNC server that you can start in so-called once mode. When you have set up your SSH and VNC servers, you can use SSH to log in to your computer over the Internet, start your VNC server, and use [[UbuntuHelp:[port-forwarding|port-forwarding]]] to securely access the VNC server. <<Anchor(let-other-people)>>

Let other people view your desktop

At present, there is no easy, secure way of making your desktop available to others over the Internet. However, an application called Remote Help Assistant is being developed to fill this gap, and needs unskilled volunteers to help test new versions. Contributing there might be the best use of your time, especially if you're not technically adept enough to reconfigure your system. If a small group of people regularly want to access your desktop, the best solution might be to set an SSH server up, then add their public keys to your authorized_keys file, with very limited rights. As discussed in the SSH guide, you can limit the SSH features that each public key can use - typically, a user that should only have VNC access would have a line like the following in authorized_keys:

command="/bin/sleep 4294967295":no-agent-forwarding:no-pty:no-user-rc:no-X11-forwarding:permitopen="localhost:5900" <public key>

This will allow the specified person to log in to your computer using your username and their public key instead of your password. The long list of no-xyz statements disallow them from doing just about anything except connect to a VNC server. Because the Internet is a high speed public network, an attacker anywhere in the world could connect to an unsecured VNC server and start guessing passwords at a rate of thousands per minute. Even if they couldn't guess your password, they could snoop on the VNC session much like someone in an Internet cafe might peer over your shoulder. If securing your connection is not an option, it's possible to provide an unsecured VNC connection with a fairly low risk of disaster, so long as you follow three basic safety precautions:

  • only allow the other person to view your desktop, not to control it
  • tell your VNC server to request permission before allowing anyone to see your desktop
  • don't do anything that you wouldn't do in an Internet cafe

If you're not comfortable with the risks, and the secure options discussed above aren't appropriate, you might be able to take screenshots instead, and send them to the other person. Whichever of the above techniques you use, you might find that you can connect to your VNC server from computers on your local network, but that other people can't connect to your server over the Internet. If that happens, you might need to reconfigure your router. <<Anchor(port-forwarding)>>

SSH port-forwarding

SSH has a feature called local port forwarding. Among many other things, this lets you securely connect to a computer over the Internet, then access that computer's VNC server over the secure connection. Using the command-line SSH client that comes with Ubuntu, you would normally do something like the following:

ssh -L 5900:localhost:5900 joe@laptop

This would log in to Joe's laptop and forward his shared desktop to your computer. You could then start your VNC client and connect to port 5,900 on your computer to see his shared desktop. This is covered in more detail on the SSH port forwarding page. <<Anchor(vnc-clients)>>

  1. The above anchor was put here long ago, when this page had separate "VNC Servers" and "VNC Clients" sections. I don't know whether anything links to it any more, but I don't see any benefit in deleting it

VNC Software

To view a desktop remotely, you need a VNC server to share the desktop, and a VNC client to view the shared desktop. There are many VNC Servers and VNC Clientsfor every operating system. <<Anchor(guide)>>

Guide to example scenarios

This section discusses some situations where you would want to use VNC, and how to set a server up for that situation. The first scenario [[UbuntuHelp:[accessing-your-pc| Accessing your desktop over the internet]]] describes how to set VNC up for a computer that logs in automatically as soon as it starts up. As accessing a shared login screen requires more security privileges than accessing your personal desktop, the second scenario [[UbuntuHelp:[accessing-family-pc|Accessing a family PC over the Internet]]] describes the extra steps you need to take in order to access your computer before you've logged in. <<Anchor(accessing-your-pc)>>

Accessing your PC over the Internet

This section describes how to connect to your own desktop computer from somewhere else on the Internet. See below for instructions about logging in to a shared computer. To set your VNC server up, follow these steps. You should only need to do this once:

  1. Install the x11vnc and openssh-server packages on your PC (click here to install x11vnc and openssh-server)
  2. If you have previously reconfigured the firewall on your PC, make sure the firewall allows incoming connections on port `22` from anywhere, and on port `5900` from `localhost` (also known as `127.0.0.1`)
  3. If your PC is behind a home router, or any other device that uses NAT, configure your router to send connection attempts on port `22` (but not port `5900`) to your PC
  4. Choose an SSH client for the computer you'll log in from, and create a public key for that computer
  5. In a text editor on your PC, open the file `<home>``/.ssh/authorized_keys`, then add the public key you just created to the bottom of the file

Each time you want to connect to your PC, follow these steps:

  1. Find your PC's public name or IP address. Unless your PC has been assigned a memorable name, the easiest way to do this is to go to whatismyip.com from your PC. You can assign your PC a name by getting one from a dynamic DNS provider
  2. Start the SSH client on the computer you'll log in from.
  3. Tell the SSH client to use local port-forwarding to connect port 5,900 on your desktop to port 5,900 on localhost.
  4. Via the SSH client, run the command `x11vnc -safer -localhost -nopw -once -display :0` on the computer whose desktop you will view.
  5. Tell the SSH client to connect to your PC (in case it's not already connected).
  6. Start a VNC client on the computer you'll log in from, and tell the VNC client to connect to port 5,900 on `localhost`.

If you have a dial-up Internet connection, your IP address will change every time you connect to the Internet. If you have a broadband Internet connection, your address will probably only change once every few months - usually right around the day you forget to check your address. If the VNC connection is terribly slow, then you may want to try compressing the session using vncviewer -encodings "tight" localhost:0 instead of vncviewer localhost:0. Exactly how to perform the above steps depends on the SSH client you use. Here are some examples.

Logging in from another Ubuntu PC

Rebecca wants to connect to her Ubuntu desktop from her Ubuntu laptop. She is using the standard software that comes with Ubuntu. Before her first connection, she creates a shell script:

  1. She sets up a dynamic DNS address for her desktop computer: rebeccas-pc.dyndns.org
  2. From her laptop, she goes to Applications > Accessories > Text Editor
  3. In Text Editor, she types in the following shell script:
#!sh
#!/bin/sh

ssh -f -L 5900:localhost:5900 [email protected] \
	x11vnc -safer -localhost -nopw -once -display :0 \
	&& sleep 5 \
	&& vncviewer localhost:0
  1. In Text Editor, she saves the script to her Desktop as Connect to rebeccas-pc.sh
  2. From her laptop, she right-clicks on the desktop icon she's created, and clicks Properties
  3. From the Properties window, she clicks Permissions, then Allow executing file as program
  4. From the properties window, she clicks Close

Then each time she connects to her desktop PC, she double-clicks on Connect to rebeccas-pc.sh, and waits about 5 seconds.

Logging in from a Windows PC

Simon wants to connect to his Ubuntu PC from his work computer, running Windows. He has installed PuTTY and TightVNC Viewer on his work computer. Before his first connection, he sets up PuTTY:

  1. From his home computer, he visits www.whatismyip.com, and finds that his computer's IP address is 1.2.3.4
  2. From his work computer, he runs PuTTY.
  3. In the PuTTY configuration window, he goes to Connection > SSH > Tunnels
  4. In the Tunnels section of PuTTY, he types 5900 for Source port, localhost:5900 for Destination, then clicking Add
  5. He goes back to the Session section of the PuTTY configuration window
  6. He types [email protected] for Host Name (or IP address), and clicks SSH
  7. He types Home for Saved Sessions and clicks Save

Then each time he connects to his home PC, he does this:

  1. From his work computer, he runs PuTTY
  2. From PuTTY, he clicks the Home saved session, then clicks Open
  3. In the PuTTY window, he types his password and presses Return
  4. In the PuTTY window, he types `x11vnc -safer -localhost -nopw -once -display :0` and presses Return
  5. From his work computer, he runs TightVNC Viewer
  6. In TightVNC Viewer, he types localhost::5900 for VNC server and presses Connect.

<<Anchor(accessing-family-pc)>>

Accessing a family PC over the Internet

Accessing a family PC is a similar problem to accessing your own PC, except that the VNC server needs more security privileges in order to show your login screen. First, make sure that you can [[UbuntuHelp:[accessing-your-pc|access your own desktop after logging in]]] - once you've logged in, accessing a shared PC is no different to accessing your own PC. Second, follow the instructions to get x11vnc working before you log in. Finally, go through the procedure to [[UbuntuHelp:[accessing-your-pc|access your own desktop after logging in]]], but instead of running the command `x11vnc -safer -localhost -nopw -once -display :0`, use `sudo x11vnc -safer -localhost -nopw -once -auth /var/lib/gdm/:0.Xauth -display :0`. If the computer you'll log in from is an Ubuntu PC, you could do:

ssh -L 5900:localhost:5900 <your-name>@<your-computer> \
	sudo x11vnc -safer -localhost -nopw -once \
	            -auth /var/lib/gdm/:0.Xauth -display :0 \
	; bg \
	&& vncviewer localhost:0

After you log in, you will be asked to type your password. Once you've typed your password in, you should press ctrl-Z to continue.

Further information

Remote desktop solutions are a broad and complex topic. The following links provide more detail about the technologies involved: