2 - Raspberry PI Community Projects

Figure 9.3
Forwarding a remote port with SSH
9.2.3. Using Remote Graphical Desktops
VNC (Virtual Network Computing) allows remote access to graphical desktops.
This tool is mostly used for technical assistance; the administrator can see the errors that the
user is facing, and show them the correct course of action without having to stand by them.
First, the user must authorize sharing their session. The GNOME and KDE graphical desktop
environments include, respectively, vino and krfb, which provide a graphical interface
that allows sharing an existing session over VNC (found, respectively, in the menus at System
→ Preferences → Remote Desktop and K → Internet → Desktop Sharing). For other graphical
desktop environments, the x11vnc command (from the Debian package of the same name)
serves the same purpose; you can make it available to the user with an explicit icon.
When the graphical session is made available by VNC, the administrator must connect to it with
a VNC client. GNOME has vinagre and tsclient for that, while KDE includes krdc (in the menu
at K → Internet → Remote Desktop Client). There are other VNC clients that use the command
line, such as xvnc4viewer in the Debian package of the same name. Once connected, the administrator
can see what's going on, work on the machine remotely, and show the user how to
proceed.
SECURITY
VNC over SSH
If you want to connect by VNC, and you don't want your data sent in clear
text on the network, it is possible to encapsulate the data in an SSH tunnel
(see Section 9.2.2.3, “Creating Encrypted Tunnels with Port Forwarding” (page
192)). You simply have to know that VNC uses port 5900 by default for the
first screen (called “localhost:0”), 5901 for the second (called “localhost:1”), etc.
The ssh -L localhost:5901:localhost:5900 -N -T machine command creates
a tunnel between local port 5901 in the localhost interface and port 5900
of the machine host. The first “localhost” restricts SSH to listening to only that
interface on the local machine. The second “localhost” indicates the interface
on the remote machine which will receive the network traffic entering in “localhost:5901”.
Thus vncviewer localhost:1 will connect the VNC client to
the remote screen, even though you indicate the name of the local machine.
194 The Debian Administrator's Handbook