So where do we go from here? I can recreate this on 3 Guacamole servers, all connecting to at least 2 TigerVNC servers running version 1.15 (one with RHEL 9.8 and one with RHEL 8.10).
The RHEL 9.8 Guacamole servers, and the RHEL 9.8 VNC server, are both FIPS enabled. Could that be an issue? I tried disabling FIPS on both in my environment, but I got the same issue/failure irregardless. Thanks, Harry [Image] Harry Devine Secure-OSE System Administrator U.S. Department of Transportation FAA/AJM-2432 (609) 485-4218 (Office) (609) 612-7274 (FAA Cell) [email protected]<mailto:[email protected]> William J Hughes Technical Center Building 300 3rd Floor Column L20 Atlantic City NJ 08405 From: Nick Couchman <[email protected]> Sent: Sunday, May 24, 2026 10:45 AM To: Devine, Harry (FAA) <[email protected]> Cc: [email protected] Subject: Re: Issue with VNC in 1.6.0 CAUTION: This email originated from outside of the Federal Aviation Administration (FAA). Do not click on links or open attachments unless you recognize the sender and know the content is safe. On Sat, May 23, 2026 at 7:09 PM Devine, Harry (FAA) <[email protected]<mailto:[email protected]>> wrote: When I run the TigerVNC client viewer from one of our VMs to my VNC server, I get prompted for the password. My connection DOES have the password in it (see attached screenshot, with the password hidden and the hostname blanked out for redaction), so that’s probably why. But that password in the Guac connection is the exact same password that is configured for the user at port 5902, and the one that I enter when the viewer prompts me. It seems that, for some reason, Guacamole just isn’t sending the password. And based on the tcpdump that my network admin looked over, with the Guac connection attempt, the VNC server sends back a hex value to, I believe, encrypt the connection password and send back to the server, but Guac seems to just send back that same hex value. Yeah, this is really puzzling - I've tried my best to replicate the environment that you have, and, if I put the password in the connection settings, it works fine and connects immediately, and if I leave the password blank, it prompts for it and works fine. I did a pcap on my side, as well, and get the following: == Frame 8: Packet, 68 bytes on wire (544 bits), 68 bytes captured (544 bits) Ethernet II, Src: ProxmoxServe_8f:6f:0d (bc:24:11:8f:6f:0d), Dst: ProxmoxServe_a2:87:83 (bc:24:11:a2:87:83) Internet Protocol Version 4, Src: 192.168.51.136, Dst: 192.168.50.1 Transmission Control Protocol, Src Port: 5901, Dst Port: 54024, Seq: 13, Ack: 13, Len: 2 Virtual Network Computing Number of security types: 1 Security type: VNC (2) == Frame 9: Packet, 67 bytes on wire (536 bits), 67 bytes captured (536 bits) Ethernet II, Src: ProxmoxServe_a2:87:83 (bc:24:11:a2:87:83), Dst: ProxmoxServe_8f:6f:0d (bc:24:11:8f:6f:0d) Internet Protocol Version 4, Src: 192.168.50.1, Dst: 192.168.51.136 Transmission Control Protocol, Src Port: 54024, Dst Port: 5901, Seq: 13, Ack: 15, Len: 1 Virtual Network Computing Security type selected: VNC (2) == Frame 10: Packet, 82 bytes on wire (656 bits), 82 bytes captured (656 bits) Ethernet II, Src: ProxmoxServe_8f:6f:0d (bc:24:11:8f:6f:0d), Dst: ProxmoxServe_a2:87:83 (bc:24:11:a2:87:83) Internet Protocol Version 4, Src: 192.168.51.136, Dst: 192.168.50.1 Transmission Control Protocol, Src Port: 5901, Dst Port: 54024, Seq: 15, Ack: 14, Len: 16 Virtual Network Computing Authentication challenge: f04a54958cd782731d48550c8e1c2aa9 == Frame 11: Packet, 82 bytes on wire (656 bits), 82 bytes captured (656 bits) Ethernet II, Src: ProxmoxServe_a2:87:83 (bc:24:11:a2:87:83), Dst: ProxmoxServe_8f:6f:0d (bc:24:11:8f:6f:0d) Internet Protocol Version 4, Src: 192.168.50.1, Dst: 192.168.51.136 Transmission Control Protocol, Src Port: 54024, Dst Port: 5901, Seq: 14, Ack: 31, Len: 16 Virtual Network Computing Authentication response: 69dac1a77bbba48f23b6aed80e25a044 == Frame 12: Packet, 70 bytes on wire (560 bits), 70 bytes captured (560 bits) Ethernet II, Src: ProxmoxServe_8f:6f:0d (bc:24:11:8f:6f:0d), Dst: ProxmoxServe_a2:87:83 (bc:24:11:a2:87:83) Internet Protocol Version 4, Src: 192.168.51.136, Dst: 192.168.50.1 Transmission Control Protocol, Src Port: 5901, Dst Port: 54024, Seq: 31, Ack: 30, Len: 4 Virtual Network Computing .... .... .... .... .... .... .... ...0 = Authentication result: OK == -Nick
