X11vnc - ArchWiki

Jump to content

# X11vnc

From ArchWiki

Related articles

- TigerVNC

x11vnc is a VNC server, it allows remote access, view and control of real X displays (i.e. a display corresponding to a physical monitor, keyboard, and mouse) with any VNC viewer. While it is not developed any longer by its original author Karl Runge, LibVNC and x11vnc's community on GitHub have taken over the development.

x11vnc, unlike xvnc of TigerVNC, by default, connects to an existing X display. However, one can use `-create` option to launch and connect to a new headless (virtual) X server.

Also note that x11vnc is not shipped with a VNC client (VNC viewer). Any VNC viewer should do the job and be compatible with the x11vnc server while not necessarily using all its functionalities. TigerVNC's vncviewer is a recommended client.

## Installation

Install the x11vnc package.

## Usage

First, start an X display, either by startx or through a display manager. You can also use a headless X display too.

Then, run the following command, all available options are explained in x11vnc(1).

    $ x11vnc

Warning This will set up the VNC server with no authentication password. This means that anybody who has access to the computer's network can see and control your X session. You can simply set a password, as described below.

By default, x11vnc tries to connect to the X display provided by `-display` option, or environment's `DISPLAY` variable's value otherwise, or to the :0 display if neither of the earlier are provided.

    $ x11vnc -display :1

Another option is to place the x11vnc command line in a script which is called at login, for example:

    x11vnc -wait 50 -noxdamage -passwd PASSWORD -display :0 -forever -o /var/log/x11vnc.log -bg

`-wait` option sets the time in milliseconds to pause between each poll from the X server's frame buffer.

`-noxdamage` option disables X Damage extension. See #Session closes unexpectedly.

`-forever` option keeps x11vnc server up, listening for further client connection, even after the first client disconnected. See #Persistent x11vnc server.

Note The password "PASSWORD" above is not secured; anyone who can run `ps` on the machine will see it. Also note that `/var/log/x11vnc.log` needs to be created manually and its ownership needs to match that of the user who will run it.

### Setting a password

Note The password will only encrypt the login process itself. The transmission is still unencrypted[1]. You can use x11vnc's internal SSL or use SSH to tunnel your traffic.

x11vnc provides many options to set and manage authentication passwords; a few of them are described in this section. Read x11vnc(1) manpage to find and read about all of them.

`-usepw` option is used as the general purpose password flag:

    $ x11vnc -usepw

It uses the password found in `~/.vnc/passwd`, where the password is obscured with a fixed key in a VNC compatible format, otherwise passwords found in `~/.vnc/passwdfile`. If none of these files can be located, it prompts the user for a password, which is saved in `~/.vnc/passwd` and is used right away.

The VNC viewer should then prompt for a password when connecting.

`-showrfbauth`, `-rfbauth` and `-storepasswd` options allow one to see, use or set the RFB's authentication password, respectively.

`-passwdfile` option can be used to provide a LibVNCServer password file which allows one to set multiple passwords and also passwords for view only connections.

### Port setting

By default, x11vnc searches for the first free port from 5900 and use it for both IPv4 and IPv6 VNC connections, despite what is the X display number it's connected to.

`-N` argument, sets port 5900 plus the number of display. For example:

    $ x11vnc -display :3 -N

That will result to using port number 5903 for this VNC server.

`-autoport n` argument, sets port to the first free port from number n.

`-rfbport n` argument can be used to set the VNC port explicitly to n.

In all three cases above, an additional port with the same number will be used for IPv6 connections; aside a 5900 IPv6 port, which also will be used if free. So you will end up with three open ports for that x11vnc server, one for IPv4 and two for IPv6. For example:

    $ x11vnc -display :2 -rfbport 5905

That will connect to X server of display number 2 and listen to IPv4 port 5905 and IPv6 ports 5905 and 5900 for VNC client connections.

For setting IPv6 port directly, use `-rfbportv6 n` option.

### Passing X authority file

For a x11vnc server to connect to an X display server, it needs to access the display’s X authority file, authorising itself.

To pass on the target display’s X authority file to the x11vnc server, you can set `XAUTHORITY` environment variable to the appropriate file path before calling x11vnc command or through `-env` option:

    $ x11vnc -display :0 -env XAUTHORITY=/home/user/.Xauthority

Where user is the username of the user who is running the X server.

You also can use the `-auth` argument following with X authority file address:

    $ x11vnc -display :0 -auth ~/.Xauthority

Alternatively, you can use `-auth guess` option, which will try to guess the XAUTHORITY filename for the target X display and use it:

    $ x11vnc -display :1 -auth guess

Generally, if the desired X display is not launched by your current user, accessing its X authority file requires running x11vnc as root or as the user who has the permission of reading X authority file of the target X display:

    # x11vnc -display :1 -auth /home/user/.Xauthority

### Running from xinetd

X11vnc can be run using a xinetd service, which only starts X11vnc once a user connects.

Create an xinetd service entry for x11vnc, for example:

    /etc/xinetd/x11vnc

    service x11vncservice
    {
           port            = 5900
           type            = UNLISTED
           socket_type     = stream
           protocol        = tcp
           wait            = no
           user            = root
           server          = /usr/bin/x11vnc
           server_args     = -inetd -o /var/log/x11vnc.log -noxdamage -display :0 -auth guess
           disable         = no
    }

After reloading `xinetd.service`, X11vnc will start once a client connects to port 5900.

### As a systemd service

To run x11vnc when system boots, use a drop-in unit file for `x11vnc.service`. The content should be like the following

    /etc/systemd/system/x11vnc.service.d/override.conf

    [Service]
    ExecStart=
    ExecStart=/usr/bin/x11vnc -many -display :0 -no6 -rfbport 5901 -auth /var/run/lightdm/root/:0

    [Install]
    WantedBy=graphical.target

Replace the second ExecStart with the command you run interactively. Enable `x11vnc.service` if needed.

### Starting with display managers

A typical use case is to start x11vnc server for the login session itself before any user has logged into an X session. Display managers usually put their X authorisation files in directories not accessible by regular users, launching x11vnc with root privileges necessary.

#### Automatic discovery of display manager's X authority file

x11vnc command tries to find the current display manager's X authority file when it's provided with `-auth guess` option and environment's `FD_XDM` variable is bound to `1`:

    $ x11vnc -find -env FD_XDM=1 -auth guess

#### GDM

Note Newer GDM packages ship with Xwayland as the default display server backend. The following instructions, however, only apply when using Xorg (else `.Xauthority` is not created, and x11vnc fails to start). You are therefore advised to uncomment `#WaylandEnable=false` setting in `/etc/gdm/custom.conf` in order to proceed.

    # x11vnc -display :0 -auth /var/lib/gdm/:0.Xauth

Newer versions of GDM uses /run/user. Example for user 120 (gdm), used for login screen.

    # x11vnc -display :0 -auth /run/user/120/gdm/Xauthority

or see Troubleshooting section below

#### LightDM

Running in bash:

    # x11vnc -display :0 -auth /var/run/lightdm/root/\:0

#### LXDM

    # x11vnc -display :0 -auth /var/run/lxdm/lxdm-\:0.auth

#### SDDM

SDDM uses an unpredictable UUID for the auth file [2] therefore one needs to:

    # x11vnc -display :0 -auth $(find /var/run/sddm/ -type f)

Embedding this into a systemd .service file will require a trick to evaluate the find command as shown here [3].

If the above method does not work, an alternative is to start x11vnc when SDDM runs the Xsetup script. To do this, add the following line into `/usr/share/sddm/scripts/Xsetup`:

    /usr/bin/x11vnc -auth /var/run/sddm/* -display :0 >/dev/null 2>&1 &

#### SLIM

    # x11vnc -display :0 -auth /var/run/slim.auth

### Persistent x11vnc server

By default, x11vnc terminates upon client's (VNC viewer's) disconnection and/or X server's termination. However, There are a few ways to keep up x11vnc server in such situations.

`-many` or `-forever` arguments specify that x11vnc do not terminate after viewer's disconnection and wait for further possible connections, with no timeouts. Next connection requests can be from the same or any other client:

    $ x11vnc -many

However, display's termination by any mean still terminates x11vnc.

`-loop` flag, creates a loop that tries to start x11vnc server up again after it terminated for any reason. By default, this will keep trying every two seconds indefinitely.

    $ x11vnc -loop

Retry times and frequency can be adjusted as follows:

    $ x11vnc -loop5000,5

This will effectively make the server to restart after its termination for 5 times, each 5 seconds, until it's established; reconnecting to a display server and VNC client.

One can combine both `-loop` and `-forever` flags; making x11vnc server to do not stop by client's disconnection at all, and also restart if the X display is terminated until an X server with the same display number and X authority file is up again.

    $ x11vnc -display :1 -forever -loop5000

### View-only connection

By default, VNC clients can both view and also control X desktops they are connected to. `-view-only` make current server view-only so that VNC viewers only can watch desktop and not interact with it.

### Multicat DNS broadcasting

Many VNC clients have the ability to discover zeroconf VNC servers advertised on their local networks.

To advertise a VNC server with zeroconf protocol start it with `-avahi` or `-mdns` or `-zeroconf` options. These three options are aliases. For example:

    $ x11vnc -display :0 -mdns

You also need to have your Avahi or mDNS daemon running, and your port 5353 of UDP open which depends on your firewall configuration.

### Sharing standalone X windows

Instead of sharing an entire X display with clients, x11vnc can connect to an X server to only poll a window of that X display. This is specially usefull with `-view-only` option.

To do so start x11vnc with `id id` or `sid id` options; where id denotes the ID of an X window which can be acquired using xwininfo(1). `pick` parameter can be used instead, which will make x11vnc call `xwininfo` directely and then extract the ID of the chosen X window, interactively. For example:

    $ x11vnc -id pick

`-id` option will poll an X window directly, which will omit new windows open by that windows; popups menus and transient toplevels may not be seen. In contrast, `-sid` option will shift a root view to that window, which resolves that problem.

Note, closing the X window that x11vnc server is connected to terminates x11vnc.

### Accessing

Get a VNC client on another computer, and type in the IP address of the computer running x11vnc. Hit connect, and you should be set.

If you are attempting to access a VNC server / computer (running x11vnc) from outside of its network then you will need to ensure that it has port 5900 forwarded.

## SSH tunnel

You need to have SSH installed and configured.

Use the `-localhost` flag with x11vnc for it to bind to the local interface. Once that is done, you can use SSH to tunnel the port; then, connect to VNC through SSH.

Simple example (from http://www.karlrunge.com/x11vnc/index.html#tunnelling):

    $ ssh -t -L 5900:localhost:5900 remote_host 'x11vnc -localhost -display :0'

(You will likely have to provide passwords/passphrases to login from your current location into your remote_host Unix account; we assume you have a login account on remote_host and it is running the SSH server)

And then in another terminal window on your current machine run the command:

    $ vncviewer -PreferredEncoding=ZRLE localhost:0

## Troubleshooting

1. You can check your ip address and make sure port 5900 is forwarded by visiting this[dead link 2020-04-03—HTTP 404] website.

The factual accuracy of this article or section is disputed.

Reason: please use the first argument of the template to provide a brief explanation. (Discuss in Talk:X11vnc)

2. Tested only on GNOME + GDM

If you cannot start the tunnel, and get error like XOpenDisplay(":0") failed, Check if you have a `~/.Xauthority` directory. If that does not exist, You can create one easily (Actually a symlink to actual one) by running command given below as normal user NOT ROOT OR USING Sudo as below:

    $ ln -sv $(dirname $(xauth info | awk '/Authority file/{print $3}')) ~/.Xauthority

then try above tunneling example and it should work fine. Further if you want this to be automatically done each time Xorg is restarted, create the xprofile file & make is executable as below

    $ ln -sf $(dirname $(xauth info | awk '/Authority file/{print $3}')) ~/.Xauthority

3. GNOME 3 and x11vnc

If you are using GNOME 3 and x11vnc and you get the following errors

    *** XOpenDisplay failed (:0)

    *** x11vnc was unable to open the X DISPLAY: ":0", it cannot continue.

Try running x11vnc like

    $ x11vnc -noxdamage -many -display :0 -auth /var/run/gdm/$(sudo ls /var/run/gdm | grep $(whoami))/database -forever -bg

Please update if this works / not works for any other display manager or desktop environment.

### Screensaver problem

If screensaver starts every 1-2 second, start x11vnc with `-nodpms` key.

### IPv6 port different from IPv4 port

The default behavior for the command:

    $ x11vnc -display :0 -rfbport 5908

is for the server to listen to TCP port 5908 and TCP6 port 5900. For the server to listen to the same TCP6 port, also use the `-rfbportv6` option to force the IPv6 listening port. For example:

    $ x11vnc -display :0 -rfbport 5908 -rfbportv6 5908

### Copying and Pasting

If copying and pasting does not work as expected, particularly if pasting to the remote side is not working or clipboard behaviour is not as expected, try adding `-xkb`:

    $ x11vnc -xkb -display :0

Although the documentation does not indicate `-xkb` specifically for clipboard problems, it resolved an issue where vim complained that there was nothing in the `*` register.

### Session closes unexpectedly

x11vnc enables the X Damage extension by default, which significantly reduces the load when the screen is not changing much and detects changed areas more quickly. This extension is known to cause issues[4][5]FS#71685[6], and it may cause the session to close unexpectedly with `caught XIO error` messages appearing at the log. This issue can be circumvented by using the `-noxdamage` option.

## Tips and tricks

### Run x11vnc "system-wide" in (GDM and GNOME Shell)

Note These instructions will only work if you are using GDM and GNOME shell in Xorg.

Perform the following steps to run x11vnc in GDM to log in and then run x11vnc in a GNOME shell user session for a "system-wide" x11vnc:

First we need to create a systemd service to launch an x11vnc server in GDM:

    /etc/systemd/system/x11vnc-gdm.service

    [Unit]
    Description=x11vnc server for GDM
    After=display-manager.service

    [Service]
    ExecStart=
    ExecStart=/usr/bin/x11vnc -many -shared -display :0 -auth /run/user/120/gdm/Xauthority -noxdamage -rfbauth user_home/.vnc/passwd
    Restart=on-failure
    RestartSec=3

    [Install]
    WantedBy=graphical.target

This will start an x11vnc server protected by the password stored at `user_home/.vnc/passwd` that shows GDM to any connected VNC client, however as you may notice, if you click on any of the users, as soon as you log in, all the VNC clients will show a black screen. To fix this, we need to create another systemd service that will start another x11vnc server in the GNOME Shell session as soon as you log in:

    /etc/systemd/system/x11vnc-gnome-shell-YOUR_USER.service

    [Unit]
    Description=x11vnc server for Gnome shell session of your_user

    [Service]
    User=YOUR_USER
    Type=simple
    ExecStartPre=/bin/sh -c 'while ! pgrep -U "your_user" Xorg; do sleep 2; done'
    ExecStart=/bin/sh -c 'sudo systemctl stop x11vnc-gdm.service && /usr/bin/x11vnc -many -shared -display :1 -auth user_home/.Xauthority -rfbauth user_home/.vnc/passwd'
    Restart=on-failure
    RestartSec=3

    [Install]
    WantedBy=graphical.target

Now, you need to keep the following in mind:

1. As you may notice in the `ExecStart` part of the systemd service, the command that executes can be separated in two tasks: first it stops `x11vnc-gdm.service` (killing the GDM x11vnc server) and then it starts the x11vnc server for the user in the GNOME shell session. This is done because if you keep running the GDM x11vnc server in the background, the new x11vnc server for the user will use the next available port, and you would need to change your client connection settings to connect either to the GDM x11vnc server or for your user-specific x11vnc server. A setup like this is useful because the GDM x11vnc server stops as soon as you log in into your account.
2. You need to create a service like this for each user that you want to have this functionality. (Do not forget to replace `your_user` and `user_home` with your actual username.)
3. You may need to change the `-display :X` part of the command to match your system settings. You can view your current display by running `echo $DISPLAY`. Use the resulting output to match the systemd service.

Now, as you might notice, `x11vnc-gnome-shell.service` is executed as your (probably) unprivileged user. This presents a problem if we want to stop the `x11vnc-gdm.service`, so we need to allow the user to stop the GDM service. This can be accomplished using sudo, but we need to allow the execution of only that specific command without a password.

Edit the sudoers file to add:

    YOUR_USER ALL=(root) NOPASSWD: /usr/bin/systemctl stop x11vnc-gdm.service

Now you simply need to enable `x11vnc-gdm.service` and `x11vnc-gnome-shell-your_user.service`. When you restart your computer, both of them will start running and you can connect to your GDM and GNOME Shell using VNC.

### Run x11vnc "system-wide" in (SDDM and Plasma)

To run x11vnc when the system boots into SDDM (if the aforementioned methods do not work for you), just edit `x11vnc.service` as follows:

    /etc/systemd/system/x11vnc.service.d/override.conf

    [Service]
    ExecStart=
    ExecStart=/bin/bash -c "/usr/bin/x11vnc -auth /var/run/sddm/* -display :0 -forever -loop -noxdamage -repeat -rfbauth /home/your_user/.vnc/passwd -shared"
    ExecStartPre=/usr/bin/sleep 1

Remember to change `your_user` in the path, or use the preferred auth method. Disable the old `x11vnc.service` and reload the systemd manager configuration. Reenable the `x11vnc.service` unit afterwards. You may need to put the service to sleep for a while, otherwise it will not start properly.

### Change x11vnc password in each boot

A setup like this could be useful if you need to share your desktop with several people that you do not trust and if you do not want to manually change the password every time. Such a setup would generate boot-unique passwords, so if you share your password with someone, you only need to reboot your computer (or re-run the systemd service) to change the password.

The new generated password will be stored as plain text in `~/.vnc/autovncpass`, so it can be accessed with

    $ cat /home/$USER/.vnc/autovncpass

Warning Storing the password as plain text can pose a security threat, so use this at your own risk.

To accomplish this, perform the following steps:

First install the expect package.

Then, create the following script anywhere in your home directory:

    ~/Automatic-x11vnc-Password-Changer.exp

    #!/usr/bin/expect -f

    set timeout -1

    log_user 0

    #Change your username here
    set USER "your_user"

    #First we need to generate the password, if you want to
    #change the password generation, change the "openssl rand -hex 4" line

    set NewVNCPassword [exec openssl rand -hex 4]

    #Now we invoke x11vnc to change the password

    spawn x11vnc --storepasswd

    match_max 100000

    expect -exact "Enter VNC password: "

    send -- "$NewVNCPassword\r"

    expect -exact "\r
    Verify password:    "

    send -- "$NewVNCPassword\r"

    expect -exact "\r
    Write password to /home/$USER/.vnc/passwd?  \[y\]/n "

    send -- "y\r"

    expect eof

    #Save the Password to the /home/$USER/.vnc/ directory as plaintext,

    exec echo "$NewVNCPassword" > /home/$USER/.vnc/autovncpass

Now we need to create a systemd unit file that will execute the script at boot time:

    /etc/systemd/system/vnc-automatic-password-changer.service

    [Unit]
    Description=x11vnc automatic password changer
    Before=display-manager.service

    [Service]
    User=YOUR_USER
    Type=oneshot
    ExecStart=/path/to/script/Automatic-x11vnc-Password-Changer.exp

    [Install]
    WantedBy=graphical.target

Finally, start/enable the service to change the password. You can access the current password with

    $ cat /home/$USER/.vnc/autovncpass

## See also

- original author site
- https://github.com/LibVNC/x11vnc
- Wikipedia:x11vnc

Categories:

- Security
- Remote desktop

Hidden categories:

- Pages with dead links
- Pages or sections flagged with Template:Accuracy

X11vnc
Add topic