X11vnc

Related articles
TigerVNC
x11vnc
is a VNC server, it allows remote access, view and control of real X displays (i.e. a display corresponding to a physical monitor, keyboard, and mouse) with any VNC viewer. While it is not developed any longer by its original author Karl Runge,
LibVNC
and x11vnc's
community
on GitHub have taken over the development.
x11vnc
, unlike
xvnc
of
TigerVNC
, by default, connects to an existing X display. However, one can use
-create
option to launch and connect to a new headless (virtual) X server.
Also note that x11vnc is not shipped with a VNC client (VNC viewer). Any
VNC viewer
should do the job and be compatible with the x11vnc server while not necessarily using all its functionalities. TigerVNC's
vncviewer
is a recommended client.
Installation
Install
the
x11vnc
package.
Usage
First, start an X display, either by
startx
or through a
display manager
. You can also use a
headless X display
too.
Then, run the following command, all available options are explained in
x11vnc(1)
.
$ x11vnc
Warning
This will set up the VNC server with no authentication password. This means that anybody who has access to the computer's network can see and control your X session. You can simply set a password, as
described below
.
By default, x11vnc tries to connect to the X display provided by
-display
option, or environment's
DISPLAY
variable's value otherwise, or to the
:0
display if neither of the earlier are provided.
$ x11vnc -display :1
Another option is to place the x11vnc command line in a script which is called at login, for example:
x11vnc -wait 50 -noxdamage -passwd PASSWORD -display :0 -forever -o /var/log/x11vnc.log -bg
-wait
option sets the time in milliseconds to pause between each poll from the X server's frame buffer.
-noxdamage
option disables X Damage extension. See
#Session closes unexpectedly
.
-forever
option keeps x11vnc server up, listening for further client connection, even after the first client disconnected. See
#Persistent x11vnc server
.
Note
The password "PASSWORD" above is not secured; anyone who can run
ps
on the machine will see it. Also note that
/var/log/x11vnc.log
needs to be created manually and its ownership needs to match that of the user who will run it.
Setting a password
Note
The password will only encrypt the login process itself. The transmission is still unencrypted
[1]
. You can use x11vnc's internal SSL or use SSH to tunnel your traffic.
x11vnc
provides many options to set and manage authentication passwords; a few of them are described in this section. Read
x11vnc(1)
manpage to find and read about all of them.
-usepw
option is used as the general purpose password flag:
$ x11vnc -usepw
It uses the password found in
~/.vnc/passwd
, where the password is obscured with a fixed key in a VNC compatible format, otherwise passwords found in
~/.vnc/passwdfile
. If none of these files can be located, it prompts the user for a password, which is saved in
~/.vnc/passwd
and is used right away.
The VNC viewer should then prompt for a password when connecting.
-showrfbauth
,
-rfbauth
and
-storepasswd
options allow one to see, use or set the RFB's authentication password, respectively.
-passwdfile
option can be used to provide a LibVNCServer password file which allows one to set multiple passwords and also passwords for view only connections.
Port setting
By default, x11vnc searches for the first free port from 5900 and use it for both IPv4 and IPv6 VNC connections, despite what is the X display number it's connected to.
-N
argument, sets port 5900 plus the number of display. For example:
$ x11vnc -display :3 -N
That will result to using port number 5903 for this VNC server.
-autoport
n
argument, sets port to the first free port from number
n
.
-rfbport
n
argument can be used to set the VNC port explicitly to
n
.
In all three cases above, an additional port with the same number will be used for IPv6 connections; aside a 5900 IPv6 port, which also will be used if free. So you will end up with three open ports for that x11vnc server, one for IPv4 and two for IPv6. For example:
$ x11vnc -display :2 -rfbport 5905
That will connect to X server of display number 2 and listen to IPv4 port 5905 and IPv6 ports 5905 and 5900 for VNC client connections.
For setting IPv6 port directly, use
-rfbportv6
n
option.
Passing X authority file
For a x11vnc server to connect to an X display server, it needs to access the display’s X authority file, authorising itself.
To pass on the target display’s X authority file to the x11vnc server, you can set
XAUTHORITY
environment variable to the appropriate file path before calling
x11vnc
command or through
-env
option:
$ x11vnc -display :0 -env XAUTHORITY=/home/
user
/.Xauthority
Where user is the username of the user who is running the X server.
You also can use the
-auth
argument following with X authority file address:
$ x11vnc -display :0 -auth ~/.Xauthority
Alternatively, you can use
-auth guess
option, which will try to guess the XAUTHORITY filename for the target X display and use it:
$ x11vnc -display :1 -auth guess
Generally, if the desired X display is not launched by your current user, accessing its X authority file requires running
x11vnc
as root or as the user who has the permission of reading X authority file of the target X display:
# x11vnc -display :1 -auth /home/
user
/.Xauthority
Running from xinetd
X11vnc can be run using a xinetd service, which only starts X11vnc once a user connects.
Create an xinetd service entry for x11vnc, for example:
/etc/xinetd/x11vnc
service x11vncservice
{
       port            = 5900
       type            = UNLISTED
       socket_type     = stream
       protocol        = tcp
       wait            = no
       user            = root
       server          = /usr/bin/x11vnc
       server_args     = -inetd -o /var/log/x11vnc.log -noxdamage -display :0 -auth guess
       disable         = no
}
After reloading
xinetd.service
, X11vnc will start once a client connects to port 5900.
As a systemd service
To run x11vnc when system boots, use a
drop-in unit file
for
x11vnc.service
. The content should be like the following
/etc/systemd/system/x11vnc.service.d/override.conf
[Service]
ExecStart=
ExecStart=/usr/bin/x11vnc -many -display :0 -no6 -rfbport 5901 -auth /var/run/lightdm/root/:0

[Install]
WantedBy=graphical.target
Replace the second ExecStart with the command you run interactively.
Enable
x11vnc.service
if needed.
Starting with display managers
A typical use case is to start x11vnc server for the login session itself before any user has logged into an X session.
Display managers usually put their X authorisation files in directories not accessible by regular users, launching x11vnc with root privileges necessary.
Automatic discovery of display manager's X authority file
x11vnc
command tries to find the current display manager's X authority file when it's provided with
-auth guess
option and environment's
FD_XDM
variable is bound to
1
:
$ x11vnc -find -env FD_XDM=1 -auth guess
GDM
Note
Newer GDM packages ship with Xwayland as the default display server backend. The following instructions, however, only apply when using Xorg (else
.Xauthority
is not created, and
x11vnc
fails to start). You are therefore advised to uncomment
#WaylandEnable=false
setting in
/etc/gdm/custom.conf
in order to proceed.
# x11vnc -display :0 -auth /var/lib/gdm/:0.Xauth
Newer versions of GDM uses /run/user. Example for user 120 (gdm), used for login screen.
# x11vnc -display :0 -auth /run/user/120/gdm/Xauthority
or see
Troubleshooting
section below
LightDM
Running in bash:
# x11vnc -display :0 -auth /var/run/lightdm/root/\:0
LXDM
# x11vnc -display :0 -auth /var/run/lxdm/lxdm-\:0.auth
SDDM
SDDM uses an unpredictable UUID for the auth file
[2]
therefore one needs to:
# x11vnc -display :0 -auth $(find /var/run/sddm/ -type f)
Embedding this into a systemd .service file will require a trick to evaluate the find command as shown here
[3]
.
If the above method does not work, an alternative is to start x11vnc when SDDM runs the Xsetup script. To do this, add the following line into
/usr/share/sddm/scripts/Xsetup
:
/usr/bin/x11vnc -auth /var/run/sddm/* -display :0 >/dev/null 2>&1 &
SLIM
# x11vnc -display :0 -auth /var/run/slim.auth
Persistent x11vnc server
By default, x11vnc terminates upon client's (VNC viewer's) disconnection and/or X server's termination. However, There are a few ways to keep up x11vnc server in such situations.
-many
or
-forever
arguments specify that x11vnc do not terminate after viewer's disconnection and wait for further possible connections, with no timeouts. Next connection requests can be from the same or any other client:
$ x11vnc -many
However, display's termination by any mean still terminates x11vnc.
-loop
flag, creates a loop that tries to start x11vnc server up again after it terminated for any reason. By default, this will keep trying every two seconds indefinitely.
$ x11vnc -loop
Retry times and frequency can be adjusted as follows:
$ x11vnc -loop5000,5
This will effectively make the server to restart after its termination for 5 times, each 5 seconds, until it's established; reconnecting to a display server and VNC client.
One can combine both
-loop
and
-forever
flags; making x11vnc server to do not stop by client's disconnection at all, and also restart if the X display is terminated until an X server with the same display number and X authority file is up again.
$ x11vnc -display :1 -forever -loop5000
View-only connection
By default, VNC clients can both view and also control X desktops they are connected to.
-view-only
make current server view-only so that VNC viewers only can watch desktop and not interact with it.
Multicat DNS broadcasting
Many VNC clients have the ability to discover zeroconf VNC servers advertised on their local networks.
To advertise a VNC server with zeroconf protocol start it with
-avahi
or
-mdns
or
-zeroconf
options. These three options are aliases. For example:
$ x11vnc -display :0 -mdns
You also need to have your
Avahi
or
mDNS
daemon running, and your port 5353 of UDP open which depends on your firewall configuration.
Sharing standalone X windows
Instead of sharing an entire X display with clients, x11vnc can connect to an X server to only poll a window of that X display. This is specially usefull with
-view-only
option.
To do so start x11vnc with
id
id
or
sid
id
options; where
id
denotes the ID of an X window which can be acquired using
xwininfo(1)
.
pick
parameter can be used instead, which will make x11vnc call
xwininfo
directely and then extract the ID of the chosen X window, interactively. For example:
$ x11vnc -id pick
-id
option will poll an X window directly, which will omit new windows open by that windows; popups menus and transient toplevels may not be seen. In contrast,
-sid
option will shift a root view to that window, which resolves that problem.
Note, closing the X window that x11vnc server is connected to terminates x11vnc.
Accessing
Get a VNC client on another computer, and type in the IP address of the computer running x11vnc. Hit connect, and you should be set.
If you are attempting to access a VNC server / computer (running x11vnc) from outside of its network then you will need to ensure that it has port 5900 forwarded.
SSH tunnel
You need to have
SSH
installed and configured.
Use the
-localhost
flag with x11vnc for it to bind to the local interface. Once that is done, you can use SSH to tunnel the port; then, connect to VNC through SSH.
Simple example (from
http://www.karlrunge.com/x11vnc/index.html#tunnelling
):
$ ssh -t -L 5900:localhost:5900 remote_host 'x11vnc -localhost -display :0'
(You will likely have to provide passwords/passphrases to login from your current location into your remote_host Unix account; we assume you have a login account on remote_host and it is running the SSH server)
And then in another terminal window on your current machine run the command:
$ vncviewer -PreferredEncoding=ZRLE localhost:0
Troubleshooting
1. You can check your ip address and make sure port 5900 is forwarded by visiting
this
[
dead link
2020-04-03—HTTP 404]
website.
The factual accuracy of this article or section is disputed.
Reason:
please use the first argument of the template to provide a brief explanation.
(Discuss in
Talk:X11vnc
)
2. Tested only on
GNOME
+
GDM
If you cannot start the tunnel, and get error like XOpenDisplay(":0") failed,
Check if you have a
~/.Xauthority
directory.
If that does not exist, You can create one easily (Actually a symlink to actual one) by running command given below as normal user NOT ROOT OR USING
Sudo
as below:
$ ln -sv $(dirname $(xauth info | awk '/Authority file/{print $3}')) ~/.Xauthority
then try above
tunneling
example and it should work fine.
Further if you want this to be automatically done each time
Xorg
is restarted, create the
xprofile
file & make is executable as below
$ ln -sf $(dirname $(xauth info | awk '/Authority file/{print $3}')) ~/.Xauthority
3.
GNOME 3
and
x11vnc
If you are using GNOME 3 and x11vnc and you get the following errors
*** XOpenDisplay failed (:0) 

*** x11vnc was unable to open the X DISPLAY: ":0", it cannot continue.
Try running x11vnc like
$ x11vnc -noxdamage -many -display :0 -auth /var/run/gdm/$(sudo ls /var/run/gdm | grep $(whoami))/database -forever -bg
Please update if this works / not works for any other
display manager
or
desktop environment
.
Screensaver problem
If screensaver starts every 1-2 second, start x11vnc with
-nodpms
key.
IPv6 port different from IPv4 port
The default behavior for the command:
$ x11vnc -display :0 -rfbport 5908
is for the server to listen to TCP port 5908 and TCP6 port 59
00
.
For the server to listen to the same TCP6 port, also use the
-rfbportv6
option to force the IPv6 listening port.
For example:
$ x11vnc -display :0 -rfbport 5908 -rfbportv6 5908
Copying and Pasting
If copying and pasting does not work as expected, particularly if pasting to the
remote side is not working or clipboard behaviour is not as expected, try adding
-xkb
:
$ x11vnc -xkb -display :0
Although the documentation does not indicate
-xkb
specifically for
clipboard problems, it resolved an issue where vim complained that there was
nothing in the
*
register.
Session closes unexpectedly
x11vnc
enables the X Damage extension by default, which significantly reduces the load when the screen is not changing much and detects changed areas more quickly. This extension is known to cause issues
[4]
[5]
FS#71685
[6]
, and it may cause the session to close unexpectedly with
caught XIO error
messages appearing at the log. This issue can be circumvented by using the
-noxdamage
option.
Tips and tricks
Run x11vnc "system-wide" in (GDM and GNOME Shell)
Note
These instructions will only work if you are using GDM and GNOME shell in Xorg.
Perform the following steps to run
x11vnc
in GDM to log in and then run
x11vnc
in a GNOME shell user session for a "system-wide"
x11vnc
:
First we need to create a
systemd
service to launch an
x11vnc
server in GDM:
/etc/systemd/system/x11vnc-gdm.service
[Unit]
Description=x11vnc server for GDM
After=display-manager.service

[Service]
ExecStart=
ExecStart=/usr/bin/x11vnc -many -shared -display :0 -auth /run/user/120/gdm/Xauthority -noxdamage -rfbauth
user_home
/.vnc/passwd
Restart=on-failure
RestartSec=3

[Install]
WantedBy=graphical.target
This will start an
x11vnc
server protected by the password stored at
user_home
/.vnc/passwd
that shows GDM to any connected VNC client, however as you may notice, if you click on any of the users, as soon as you log in, all the VNC clients will show a black screen. To fix this, we need to create another
systemd
service that will start another
x11vnc
server in the GNOME Shell session as soon as you log in:
/etc/systemd/system/x11vnc-gnome-shell-YOUR_USER.service
[Unit]
Description=x11vnc server for Gnome shell session of
your_user
[Service]
User=YOUR_USER
Type=simple
ExecStartPre=/bin/sh -c 'while ! pgrep -U "
your_user
" Xorg; do sleep 2; done'
ExecStart=/bin/sh -c 'sudo systemctl stop x11vnc-gdm.service && /usr/bin/x11vnc -many -shared -display :1 -auth
user_home
/.Xauthority -rfbauth
user_home
/.vnc/passwd'
Restart=on-failure
RestartSec=3

[Install]
WantedBy=graphical.target
Now, you need to keep the following in mind:
As you may notice in the
ExecStart
part of the
systemd
service, the command that executes can be separated in two tasks: first it stops
x11vnc-gdm.service
(killing the GDM
x11vnc
server) and then it starts the
x11vnc
server for the user in the GNOME shell session. This is done because if you keep running the GDM
x11vnc
server in the background, the new
x11vnc
server for the user will use the next available port, and you would need to change your client connection settings to connect either to the GDM
x11vnc
server or for your user-specific
x11vnc
server. A setup like this is useful because the GDM
x11vnc
server stops as soon as you log in into your account.
You need to create a service like this for each user that you want to have this functionality. (Do not forget to replace
your_user
and
user_home
with your actual username.)
You may need to change the
-display :
X
part of the command to match your system settings. You can view your current display by running
echo $DISPLAY
. Use the resulting output to match the
systemd
service.
Now, as you might notice,
x11vnc-gnome-shell.service
is executed as your (probably) unprivileged user. This presents a problem if we want to
stop
the
x11vnc-gdm.service
, so we need to allow the user to stop the GDM service. This can be accomplished using
sudo
, but we need to allow the execution of only that specific command without a password.
Edit the
sudoers
file to add:
YOUR_USER
ALL=(root) NOPASSWD: /usr/bin/systemctl stop x11vnc-gdm.service
Now you simply need to
enable
x11vnc-gdm.service
and
x11vnc-gnome-shell-
your_user
.service
. When you restart your computer, both of them will start running and you can connect to your GDM and GNOME Shell using VNC.
Run x11vnc "system-wide" in (SDDM and Plasma)
To run
x11vnc
when the system boots into
SDDM
(if the aforementioned methods do not work for you), just
edit
x11vnc.service
as follows:
/etc/systemd/system/x11vnc.service.d/override.conf
[Service]
ExecStart=
ExecStart=/bin/bash -c "/usr/bin/x11vnc -auth /var/run/sddm/* -display :0 -forever -loop -noxdamage -repeat -rfbauth /home/
your_user
/.vnc/passwd -shared"
ExecStartPre=/usr/bin/sleep 1
Remember to change
your_user
in the path, or use the preferred auth method.
Disable
the old
x11vnc.service
and
reload
the
systemd
manager configuration.
Reenable
the
x11vnc.service
unit afterwards. You may need to put the service to sleep for a while, otherwise it will not start properly.
Change x11vnc password in each boot
A setup like this could be useful if you need to share your desktop with several people that you do not trust and if you do not want to manually change the password every time. Such a setup would generate boot-unique passwords, so if you share your password with someone, you only need to reboot your computer (or re-run the
systemd
service) to change the password.
The new generated password will be stored as
plain text
in
~/.vnc/autovncpass
, so it can be accessed with
$ cat /home/$USER/.vnc/autovncpass
Warning
Storing the password as plain text can pose a security threat, so
use this at your own risk
.
To accomplish this, perform the following steps:
First install the
expect
package.
Then, create the following script anywhere in your home directory:
~/Automatic-x11vnc-Password-Changer.exp
#!/usr/bin/expect -f

set timeout -1

log_user 0

#Change your username here
set USER "
your_user
"

#First we need to generate the password, if you want to 
#change the password generation, change the "openssl rand -hex 4" line

set NewVNCPassword [exec openssl rand -hex 4]

#Now we invoke x11vnc to change the password

spawn x11vnc --storepasswd

match_max 100000

expect -exact "Enter VNC password: "

send -- "$NewVNCPassword\r"

expect -exact "\r
Verify password:    "

send -- "$NewVNCPassword\r"

expect -exact "\r
Write password to /home/$USER/.vnc/passwd?  \[y\]/n "

send -- "y\r"

expect eof

#Save the Password to the /home/$USER/.vnc/ directory as plaintext, 

exec echo "$NewVNCPassword" > /home/$USER/.vnc/autovncpass
Now we need to create a
systemd
unit file that will execute the script at boot time:
/etc/systemd/system/vnc-automatic-password-changer.service
[Unit]
Description=x11vnc automatic password changer
Before=display-manager.service

[Service]
User=YOUR_USER
Type=oneshot
ExecStart=
/path/to/script/
Automatic-x11vnc-Password-Changer.exp                 

[Install]
WantedBy=graphical.target
Finally,
start/enable
the service to change the password. You can access the current password with
$ cat /home/$USER/.vnc/autovncpass
See also
original author site
https://github.com/LibVNC/x11vnc
Wikipedia:x11vnc