Securing TightVNC access?
reddit / selfhosted

----------------------------------------------------------------------
noellarkin · 2023-12-14 06:56

I have a static IP.

I tried out TightVNC to access some computers on my LAN remotely.

I tested port forwarding on my router to access it from outside
(public IP:random port ---> LAN internal IP:TightVNC port). I've added
password authentication, but I doubt this is enough.

I'll be traveling soon and I want to be able to access my main
workstation remotely. How do I make this more secure?

----------------------------------------------------------------------
ElevenNotes · 2023-12-14 07:09

Use a VPN to access your home, and inside that VPN you can use
whatever protocol you need. You can setup a Wireguard server at home
on your router if it supports it.

----------------------------------------------------------------------
thisisnotmyworkphone · 2023-12-14 07:30

VPN is the answer here. But if you don’t want to use a VPN for some
reason, then MeshCentral is a pretty good alternative. Spin it up on a
VPS, set up a good password and 2FA, install the agent on the
computers you want and away you go.

----------------------------------------------------------------------
wtfbreeze · 2023-12-14 08:08

Go with Tailscale VPN without a second thought.

----------------------------------------------------------------------
numblock699 · 2023-12-14 09:12

Zerotier, Twingate, Tailscale, ngrok, NetBird. Don’t port forward.

----------------------------------------------------------------------
iavael · 2023-12-14 13:31

Make sure that you've set up mandatory encryption on your vnc server.
Having password doesn't mean that your transfered data (including
password) is encrypted.

----------------------------------------------------------------------
PhilipLGriffiths88 · 2023-12-14 14:54

[https://github.com/anderspitman/awesome-
tunneling](https://github.com/anderspitman/awesome-tunneling)


Personally, I work on OpenZiti/zrok.io, both on the list above and do
not require port forwarding.

----------------------------------------------------------------------
vermyx · 2023-12-14 15:10

VNC only cares about the first 8 characters of the password. It is not
one you ever want to expose to the internet without a VPN.

----------------------------------------------------------------------
jaredg_dev · 2023-12-14 18:52

I've been working on a zero-trust solution (ControlR) that proxies
VNC, RDP, and terminal over websockets.  If the setting is enabled for
ControlR to manage the VNC server, the ControlR agent does the
following:

* Sets a random TightVNC server password for each session
* Starts the server in loopback-only mode (i.e. only localhost can
connect)
* Connects to a websocket endpoint using TLS encryption
* Begins proxying the connection from websocket to the local TightVNC
server
* Shuts down the TightVNC server when the session ends

Here's a clip:
[https://imgur.com/a/f5oR3wV](https://imgur.com/a/f5oR3wV)

The original prototype used my own remote control agent with WebRTC,
but I decided I didn't want to build all the remote control pieces
again.  I've already done this in previous projects, and it's a lot of
work.  The proxying works well for my needs, so I'm rolling with it.

The repo for the original solution explains how the zero-trust piece
works:  [https://github.com/bitbound/ControlR](https://github.com/bitb
ound/ControlR)

When I'm ready to release this new version, it will replace that repo.
So you can watch it if you want to be notified when my current
solution is ready.  Progress is currently stalled due to a family
health emergency.  But once that's settled, I have a few features to
finish, then I'll release it.  Those features are: Mac agent, wake-on-
LAN, Docker image, and some improvements to agent updating.  I also
want to get the viewer on the Windows Store and Google Play, but I
think that can come afterward.

----------------------------------------------------------------------
Fluffer_Wuffer · 2023-12-14 19:02

OK call me intrigued, I hate Guac, and this is looking 👌

----------------------------------------------------------------------
user01401 · 2023-12-15 01:13

I run VNC over SSH