TurboVNC 2.1.90 is 2.2 beta1.  Beta versions are instantly obsolete as
soon as the corresponding final version (2.2, in this case) is released,
and stable versions are instantly obsolete as soon as the next stable
version in the same series is released.  Please upgrade to the latest
stable 2.2.x version (2.2.5.)  That's what stable branches are for.

As far as the open connections, all VNC implementations behave that way,
and it's a feature rather than a bug.  If a VNC server, when started
with -nevershared (or the equivalent), automatically rejected new
connections without authentication, then a malicious client might be
able to overwhelm the server by repeatedly attempting to connect
(assuming an existing connection was already successfully established.) 
Also, if the server was started with -disconnect (or the equivalent),
then for obvious reasons, it is necessary to authenticate the new
connection before automatically closing the old connection.

'-maxconnections' operates at the socket level rather than the RFB
protocol level, so '-maxconnections 1' should achieve what you want. 
However, note that it will introduce the same potential for attack
described above (which is why the default value of -maxconnections is
quite high.)

On 6/22/20 6:01 AM, Andrew wrote:
> Hello. I am using TurboVNC 2.1.90 in a RHEL 7.7 environment. When I have 
> user/password authentication enabled to access the Xvnc session and leave the 
> login prompt open without entering any credentials, an lsof command shows an 
> established connection to the VNC port on the remote system. If I then open a 
> viewer on a different system and Authenticate into the same Xvnc session lsof 
> now shows two established connections. I have -NeverShared set on the Xvnc 
> session. These two connections (one “real”, one not) are throwing off some 
> custom software. Is there a recommended way to either prevent more than one 
> connection or distinguish between multiple? Looking through docs for newer 
> versions I do see that 2.2.2 added a “-maxconnections” parameter. Would that 
> solve the issue? I ask here because In my environment I am unable to change 
> versions at will. Thank you for any input and also for a great product. 
>

-- 
You received this message because you are subscribed to the Google Groups 
"TurboVNC User Discussion/Support" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/d/msgid/turbovnc-users/eec7d00a-2236-0699-1d51-abb95e51b37b%40virtualgl.org.

Reply via email to