Hi all!

I am using Fedora 7 upgraded to Fedora 8 packages via Yum. I have Remote
Desktop (System -> Preferences -> Internet & Network -> Remote Desktop ) in
my packages and using it.

Problem: When I login to my system using 'vncviewer <IP>:0', i can access
everything on the remote pc but the problem is the screen on server system
(system with <IP>) unlocks and everything that I do remotely is replicated
on the actual system.

Somebody will say, wtf? it is designed to be so. But the problem is the
screen unlocks and anybody in my lab can capture my system and do whatever
he/she wants.

Its a big security issue.

And somebody may even get a heart attack when he/she sees that the mouse is
static and no human being is near the pc and still the windows are opening
and closing and some text is being typed in terminal :-O :P

-------------------------------------------------------
Thank you,
Kulbir Saini,
Computer Science and Engineering,
International Institute of Information Technology,
Hyderbad, India - 500032.

My Home-Page: http://saini.co.in/
My Institute: http://www.iiit.ac.in/
My Linux-Blog: http://linux.saini.co.in/
My Web-Blog: http://life.saini.co.in/
-------------------------------------------------------


--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Dec 8, 2007 7:25 AM, Kulbir Saini <kulbirsaini@students.iiit.ac.in> wrote:
>
> Problem: When I login to my system using 'vncviewer <IP>:0', i can access
> everything on the remote pc but the problem is the screen on server system
> (system with <IP>) unlocks and everything that I do remotely is replicated
> on the actual system.
>
> Somebody will say, wtf? it is designed to be so. But the problem is the
> screen unlocks and anybody in my lab can capture my system and do whatever
> he/she wants.
>
> Its a big security issue.
>
> And somebody may even get a heart attack when he/she sees that the mouse is
> static and no human being is near the pc and still the windows are opening
> and closing and some text is being typed in terminal :-O :P

This is working as designed. You can use the vncserver daemon to
create virtual desktops, as many as the system resources of your
system can support, these will not be visible on the desktop. Then
you can connect to any of these virtual desktops from the console or
remotely as you desire.

Brett

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

lø., 08.12.2007 kl. 08.26 -0500, skrev Brett Serkez:
> On Dec 8, 2007 7:25 AM, Kulbir Saini <kulbirsaini@students.iiit.ac.in> wrote:
> >
> > Problem: When I login to my system using 'vncviewer <IP>:0', i can access
> > everything on the remote pc but the problem is the screen on server system
> > (system with <IP>) unlocks and everything that I do remotely is replicated
> > on the actual system.
> >
> > Somebody will say, wtf? it is designed to be so. But the problem is the
> > screen unlocks and anybody in my lab can capture my system and do whatever
> > he/she wants.
> >
> > Its a big security issue.
> >
> > And somebody may even get a heart attack when he/she sees that the mouse is
> > static and no human being is near the pc and still the windows are opening
> > and closing and some text is being typed in terminal :-O :P
>
> This is working as designed. You can use the vncserver daemon to
> create virtual desktops, as many as the system resources of your
> system can support, these will not be visible on the desktop. Then
> you can connect to any of these virtual desktops from the console or
> remotely as you desire.
>
Then shouldn't this be the default for vino when sharing the dekstop?

I guess the case where the screen unlocks and everything is shown on the
screen is great in the case where support staff wants to show users what
to do on screen, but is that really the most relevant case?

Cheers
Kjartan


--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

> On Dec 8, 2007 7:25 AM, Kulbir Saini <kulbirsaini@students.iiit.ac.in> wrote:
>>
>> Problem: When I login to my system using 'vncviewer <IP>:0', i can access
>> everything on the remote pc but the problem is the screen on server system
>> (system with <IP>) unlocks and everything that I do remotely is replicated
>> on the actual system.
>>
>> Somebody will say, wtf? it is designed to be so. But the problem is the
>> screen unlocks and anybody in my lab can capture my system and do whatever
>> he/she wants.
>>
>> Its a big security issue.
>>
>> And somebody may even get a heart attack when he/she sees that the mouse
>> is
>> static and no human being is near the pc and still the windows are opening
>> and closing and some text is being typed in terminal :-O :P
>
> This is working as designed. You can use the vncserver daemon to
> create virtual desktops, as many as the system resources of your
> system can support, these will not be visible on the desktop. Then
> you can connect to any of these virtual desktops from the console or
> remotely as you desire.
>
> Brett
>

But the with vncviewer doesn't give you the desktop you have on the server.
It creates/initializes another desktop env and give access to it. And Remote
Desktop gives access to the exact desktop you have opened on the server. So,
when I connect to the Remote Desktop, it unlocks the screen on the server
and anybody who is nearby can capture the machine.



-------------------------------------------------------
Thank you,
Kulbir Saini,
Computer Science and Engineering,
International Institute of Information Technology,
Hyderbad, India - 500032.

My Home-Page: http://saini.co.in/
My Institute: http://www.iiit.ac.in/
My Linux-Blog: http://linux.saini.co.in/
My Web-Blog: http://life.saini.co.in/

IRC nick : generalBordeaux
Channels : #fedora, #fedora-devel
-------------------------------------------------------


--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Dec 8, 2007 8:45 AM, Kulbir Saini <kulbirsaini@students.iiit.ac.in> wrote:
>
> But the with vncviewer doesn't give you the desktop you have on the server.
> It creates/initializes another desktop env and give access to it. And Remote
> Desktop gives access to the exact desktop you have opened on the server. So,
> when I connect to the Remote Desktop, it unlocks the screen on the server
> and anybody who is nearby can capture the machine.

This is what you said the first time and I gave you a work around.
Perhaps implementing an option to keep the desktop blank would be
useful, in the WinDoze world LogMeIn gives you this option, which is
what you may be looking for long-term.

In the mean time, if you want privacy, create a virtual, hidden
desktop and then connect to it from were ever you want, from the
server's desktop or a remote system. This would be more secure in a
number of ways including being about to logout, not just lock the
server's desktop at the end of the day without losing your work.

Good luck,

Brett

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

> On Dec 8, 2007 8:45 AM, Kulbir Saini <kulbirsaini@students.iiit.ac.in> wrote:
>>
>> But the with vncviewer doesn't give you the desktop you have on the
>> server.
>> It creates/initializes another desktop env and give access to it. And Remote
>> Desktop gives access to the exact desktop you have opened on the server. So,
>> when I connect to the Remote Desktop, it unlocks the screen on the server
>> and anybody who is nearby can capture the machine.
>
> This is what you said the first time and I gave you a work around.
> Perhaps implementing an option to keep the desktop blank would be
> useful, in the WinDoze world LogMeIn gives you this option, which is
> what you may be looking for long-term.

Exactly!

> In the mean time, if you want privacy, create a virtual, hidden
> desktop and then connect to it from were ever you want, from the
> server's desktop or a remote system. This would be more secure in a
> number of ways including being about to logout, not just lock the
> server's desktop at the end of the day without losing your work.

I am already using vncviewer this way. But this way, I don't get access to
my kopete message queue which is logged in on the original desktop and not
in the virtual desktop.

> Good luck,
>
> Brett
>

-------------------------------------------------------
Thank you,
Kulbir Saini,
Computer Science and Engineering,
International Institute of Information Technology,
Hyderbad, India - 500032.

My Home-Page: http://saini.co.in/
My Institute: http://www.iiit.ac.in/
My Linux-Blog: http://linux.saini.co.in/
My Web-Blog: http://life.saini.co.in/

IRC nick : generalBordeaux
Channels : #fedora, #fedora-devel on freenode
-------------------------------------------------------


--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Kulbir Saini wrote:


I am already using vncviewer this way. But this way, I don't get access to
my kopete message queue which is logged in on the original desktop and not
in the virtual desktop.


Then login to your virtual desktop using vncviewer from the real desktop
when you are using this machine locally.


You are off-topic. This is a development discussion list. You should
have brought this to a user support forum like fedoraforum.org. They
would have told you exactly the same things.


Warren Togami
wtogami@redhat.com

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Sat, 2007-12-08 at 08:26 -0500, Brett Serkez wrote:
> On Dec 8, 2007 7:25 AM, Kulbir Saini <kulbirsaini@students.iiit.ac.in> wrote:
> >
> > Problem: When I login to my system using 'vncviewer <IP>:0', i can access
> > everything on the remote pc but the problem is the screen on server system
> > (system with <IP>) unlocks and everything that I do remotely is replicated
> > on the actual system.
> >
> > Somebody will say, wtf? it is designed to be so. But the problem is the
> > screen unlocks and anybody in my lab can capture my system and do whatever
> > he/she wants.
> >
> > Its a big security issue.
> >
> > And somebody may even get a heart attack when he/she sees that the mouse is
> > static and no human being is near the pc and still the windows are opening
> > and closing and some text is being typed in terminal :-O :P
>
> This is working as designed. You can use the vncserver daemon to
> create virtual desktops, as many as the system resources of your
> system can support, these will not be visible on the desktop. Then
> you can connect to any of these virtual desktops from the console or
> remotely as you desire.

Actually, there are cases when a user or an administrator might need to
remotely access the current running desktop session. Kulbir already
mentioned one (something I myself have often wished ... access to my IM
client from whatever workstation I'm on without interrupting
connection). In such cases, I like the idea that the screensaver stops
and allows the activity on the desktop to show (if I were the user, I
wouldn't want anyone accessing my machine without my knowing it if I was
sitting in front of it with the screen locked). However, I wouldn't want
the keyboard or mouse to be active, either (still requiring an unlock).

If that were to be a feature request (or even a security review),
against what component should it be reported to? Does screensaver even
support just input-locking?
--

Richi Plana

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Kulbir Saini wrote:


But the with vncviewer doesn't give you the desktop you have on the server.
It creates/initializes another desktop env and give access to it. And Remote
Desktop gives access to the exact desktop you have opened on the server. So,
when I connect to the Remote Desktop, it unlocks the screen on the server
and anybody who is nearby can capture the machine.


The approach I use is to always use the freenx server and the free NX
client from www.nomachine.com instead of the console even for access in
the same office. It is fast enough that you barely notice the
difference if at all - and you can connect from windows or a Mac as well
as Linux. Then when you leave you can suspend the session and there is
nothing visible until you reconnect although everything keeps running.
One thing that makes this practical for me is that I have a dual-monitor
windows box on my desk and I park the NX client so it fills one of the
monitors, giving the effect of a separate machine except it doesn't have
to be nearby and I can cut and paste between programs on both systems,
but it works so well that I'd consider it even if I only had a single
machine. You could log in as a dummy user that couldn't directly access
anything important, then run everything in an NX session connected back
to the same machine as your real user and when you connect remotely
you'd get the session no one can see.


--
Les Mikesell
lesmikesell@gmail.com

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

> Kulbir Saini wrote:
>>
>> I am already using vncviewer this way. But this way, I don't get access to
>> my kopete message queue which is logged in on the original desktop and not
>> in the virtual desktop.
>
> Then login to your virtual desktop using vncviewer from the real desktop
> when you are using this machine locally.

How impractical ? I mean its possible, but how would it feel to work on a
virtual desktop using vncviewer while you have the complete access to the
desktop.

> You are off-topic. This is a development discussion list. You should
> have brought this to a user support forum like fedoraforum.org. They
> would have told you exactly the same things.

Well, I apologize if I am off-topic. But FYI, I am not seeking any support
on the issue. I know that currently there is not practical solution. All
solutions available are ad-hoc which can't be used in the long run. As its
the development list, I was trying to bring the issue to the developers of
vncviewer/vncserver for Fedora.

My apologies if I was wrong in my assumptions.

Peace !!!

> Warren Togami
> wtogami@redhat.com


-------------------------------------------------------
Thank you,
Kulbir Saini,
Computer Science and Engineering,
International Institute of Information Technology,
Hyderbad, India - 500032.

My Home-Page: http://saini.co.in/
My Institute: http://www.iiit.ac.in/
My Linux-Blog: http://linux.saini.co.in/
My Web-Blog: http://life.saini.co.in/

IRC nick : generalBordeaux
Channels : #fedora, #fedora-devel on freenode
-------------------------------------------------------


--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list