neulab/tldr huggingface dataset:
Establishing a connection may take a minute. While establishing a connection, nothing is shown on screen.
Starting a connection on an interface that is controlled by netctl-auto will cause wifi-menu to switch to the selected network. The interface will continue to be controlled by netctl-auto.
$NETCTL_DEBUG If set to "yes", debugging output is generated.
/etc/netctl Directory where generated profiles are stored.
netctl(1), netctl-auto(1)
GIT-WHATCHANGED(1)                 Git Manual                 GIT-WHATCHANGED(1)
git-whatchanged - Show logs with difference each commit introduces
git whatchanged <option>...
Shows commit logs and diff output each commit introduces.
New users are encouraged to use git-log(1) instead. The whatchanged command is essentially the same as git-log(1) but defaults to show the raw format diff output and to skip merges.
The command is kept primarily for historical reasons; fingers of many people who learned Git long before git log was invented by reading Linux kernel mailing list are trained to type it.
git whatchanged -p v2.6.12.. include/scsi drivers/scsi Show as patches the commits since version v2.6.12 that changed any file in the include/scsi or drivers/scsi subdirectories
git whatchanged --since="2 weeks ago" -- gitk Show the changes during the last two weeks to the file gitk. The "--" is necessary to avoid confusion with the branch named gitk
DOAS(1)                    BSD General Commands Manual                   DOAS(1)
doas — execute commands as another user
doas [-Lns] [-C config] [-u user] command [args]
The doas utility executes the given command as another user.  The command argument is mandatory unless -C, -L, or -s is specified.
The user will be required to authenticate by entering their password, unless configured otherwise.
By default, a new environment is created.  The variables HOME, LOGNAME, PATH, SHELL, and USER and the umask(2) are set to values appropriate for the target user.  DOAS_USER is set to the name of the user executing doas. The variables DISPLAY and TERM are inherited from the current environment. This behavior may be modified by the config file.  The working directory is not changed.
-C config   Parse and check the configuration file config, then exit.  If command is supplied, doas will also perform command matching. In the latter case either ‘permit’, ‘permit nopass’ or ‘deny’ will be printed on standard output, depending on command matching results.  No command is executed.
-L          Clear any persisted authentications from previous invocations, then immediately exit.  No command is executed.
-n          Non interactive mode, fail if the matching rule doesn't have the nopass option.
-s          Execute the shell from SHELL or /etc/passwd.
-u user     Execute the command as user.  The default is root.
The doas utility exits 0 on success, and >0 if an error occurs.  It may fail for one of the following reasons:
•   The config file /etc/doas.conf could not be parsed. •   The user attempted to run a command which is not permitted. •   The password was incorrect. •   The specified command was not found or is not executable.
su(1), doas.conf(5)
The doas command first appeared in OpenBSD 5.8.
Ted Unangst <tedu@openbsd.org>
X11VNC(1)                         User Commands                        X11VNC(1)
x11vnc - allow VNC connections to real X11 displays version: 0.9.16, lastmod: 2019-01-05
x11vnc [OPTION]...
Typical usage is:
Run this command in a shell on the remote machine "far-host" with X session you wish to view:
x11vnc -display :0
Then run this in another window on the machine you are sitting at:
vncviewer far-host:0
Once x11vnc establishes connections with the X11 server and starts listening as a VNC server it will print out a string: PORT=XXXX where XXXX is typically 5900 (the default VNC server port).  One would next run something like this on the local machine: "vncviewer hostname:N" where "hostname" is the name of the machine running x11vnc and N is XXXX - 5900, i.e. usually "vncviewer hostname:0".
By default x11vnc will not allow the screen to be shared and it will exit as soon as the client disconnects.  See -shared and -forever below to override these protections.  See the FAQ for details how to tunnel the VNC connection through an encrypted channel such as ssh(1).  In brief:
ssh -t -L 5900:localhost:5900 far-host 'x11vnc -localhost -display :0'
% vncviewer -encodings 'copyrect tight zrle hextile' localhost:0
Also, use of a VNC password (-rfbauth or -passwdfile) is strongly recommended.
For additional info see: http://www.karlrunge.com/x11vnc/ and http://www.karlrunge.com/x11vnc/faq.html
Config file support: if the file $HOME/.x11vncrc exists then each line in it is treated as a single command line option.  Disable with -norc.  For each option name, the leading character "-" is not required.  E.g. a line that is either "forever" or "-forever" may be used and are equivalent. Likewise "wait 100" or "-wait 100" are acceptable and equivalent lines. The "#" character comments out to the end of the line in the usual way (backslash it for a literal).  Leading and trailing whitespace is trimmed off.  Lines may be continued with a "\" as the last character of a line (it becomes a space character).
-display disp
X11 server display to connect to, usually :0.  The X server process must be running on same machine and support MIT-SHM. Equivalent to setting the DISPLAY environment variable to disp.
See the description below of the "-display WAIT:..."  extensions, where alias "-find" will find the user's display automatically, and "-create" will create a Xvfb session if no session is found.
-auth file
Set the X authority file to be file, equivalent to setting the XAUTHORITY environment variable to file before startup.  Same as -xauth file.  See Xsecurity(7) , xauth(1) man pages for more info.
Use '-auth guess' to have x11vnc use its -findauth mechanism (described below) to try to guess the XAUTHORITY filename and use it.
XDM/GDM/KDM: if you are running x11vnc as root and want to find the XAUTHORITY before anyone has logged into an X session yet, use: x11vnc -env FD_XDM=1 -auth guess ...  (This will also find the XAUTHORITY if a user is already logged into the X session.) When running as root, FD_XDM=1 will be tried if the initial -auth guess fails.
If the X display is :N, try to set the VNC display to also be :N This just sets the -rfbport option to 5900+N The program will exit immediately if that port is not available. The -N option only works with normal -display usage, e.g. :0 or :8, -N is ignored in the -display WAIT:..., -create, -find, -svc, -redirect, etc modes.
-autoport n
Automatically probe for a free VNC port starting at n.  The default is to start probing at 5900.  Use this to stay away from other VNC servers near 5900.
-rfbport str
The VNC port to listen on (a LibVNCServer option), e.g.  5900, 5901, etc.  If specified as "-rfbport PROMPT" then the x11vnc -gui is used to prompt the user to enter the port number.
IPv6 listening support.  In addition to IPv4, the IPv6 address is listened on for incoming connections.  The same port number as IPv4 is used.
NOTE:  This x11vnc binary was compiled to have the "-6" IPv6 listening mode ENABLED by default (CPPFLAGS -DX11VNC_LISTEN6=1). So to disable IPv6 listening mode you MUST supply the "-no6" option (see below.)
The "-6" mode works for both normal connections and -ssl encrypted ones.  Nearly everything is supported for the IPv6 case, but there are a few exceptions.  See -stunnel for its IPv6 support.
Currently, for absolutely everything to work correctly the machine may need to have some IPv4 support, at the least for the loopback interface.  However, for nearly all usage modes no IPv4 support is required. See -noipv4.
If you have trouble compiling or running in IPv6 mode, set -DX11VNC_IPV6=0 in CPPFLAGS when configuring to disable IPv6 support.
-no6
Disable IPv6 listening support (only useful if the "-6" mode is compiled in to be the default; see the X11VNC_LISTEN6 description above under "-6".)
-noipv6
Do not try to use IPv6 for any listening or connecting sockets. This includes both the listening service port(s) and outgoing connections from -connect, -connect_or_exit, or -proxy.  Use this if you are having problems due to IPv6.
-noipv4
Do not try to use IPv4 for any listening or connecting sockets. This is mainly for exploring the behavior of x11vnc on an IPv6-only system, but may have other uses.
-reopen
If the X server connection is disconnected, try to reopen the X display (up to one time.)  This is of use for display managers like GDM (KillInitClients option) that kill x11vnc just after the user logs into the X session.  Note: the reopened state may be unstable.  Set X11VNC_REOPEN_DISPLAY=n to reopen n times and set X11VNC_REOPEN_SLEEP_MAX to the number of seconds, default 10, to keep trying to reopen the display (once per second.)
Update: as of 0.9.9, x11vnc tries to automatically avoid being killed by the display manager by delaying creating windows or using XFIXES.  So you shouldn't need to use KillInitClients=false as long as you log in quickly enough (within 45 seconds of connecting.)  You can disable this by setting X11VNC_AVOID_WINDOWS=never.  You can also set it to the number of seconds to delay.
-reflect host:N
Instead of connecting to and polling an X display, connect to the remote VNC server host:N and be a reflector/repeater for it.  This is useful for trying to manage the case of many simultaneous VNC viewers (e.g. classroom broadcasting) where, e.g. you put a repeater on each network switch, etc, to improve performance by distributing the load and network traffic.  Implies -shared (use -noshared as a later option to disable). See the discussion below under -rawfb vnc:host:N for more details.
-id windowid
Show the X window corresponding to windowid not the entire display.  New windows like popup menus, transient toplevels, etc, may not be seen or may be clipped.  Disabling SaveUnders or BackingStore in the X server may help show them.  x11vnc may crash if the window is initially partially obscured, changes size, is iconified, etc.  Some steps are taken to avoid this and the -xrandr mechanism is used to track resizes.  Use xwininfo(1) to get the window id, or use "-id pick" to have x11vnc run xwininfo(1) for you and extract the id.  The -id option is useful for exporting very simple applications (e.g. the current view on a webcam).
-sid windowid
As -id, but instead of using the window directly it shifts a root view to it: this shows SaveUnders menus, etc, although they will be clipped if they extend beyond the window.
-appshare
Simple application sharing based on the -id/-sid mechanism.  Every new toplevel window that the application creates induces a new viewer window via a reverse connection.  The -id/-sid and -connect options are required.  Run 'x11vnc -appshare -help' for more info.
-clip WxH+X+Y
Only show the sub-region of the full display that corresponds to the rectangle geometry with size WxH and offset +X+Y.  The VNC display has size WxH (i.e. smaller than the full display).  This also works for -id/-sid mode where the offset is relative to the upper left corner of the selected window.  An example use of this option would be to split a large (e.g. Xinerama) display into two parts to be accessed via separate viewers by running a separate x11vnc on each part.
Use '-clip xinerama0' to clip to the first xinerama sub-screen (if xinerama is active).  xinerama1 for the 2nd sub-screen, etc.  This way you don't need to figure out the WxH+X+Y of the desired xinerama sub-screen.  screens are sorted in increasing distance from the (0,0) origin (I.e. not the Xserver's order).
-flashcmap
In 8bpp indexed color, let the installed colormap flash as the pointer moves from window to window (slow).  Also try the -8to24 option to avoid flash altogether.
-shiftcmap n
Rare problem, but some 8bpp displays use less than 256 colorcells (e.g. 16-color grayscale, perhaps the other bits are used for double buffering) *and* also need to shift the pixels values away from 0, .., ncells.  n indicates the shift to be applied to the pixel values.  To see the pixel values set DEBUG_CMAP=1 to print out a colormap histogram.  Example: -shiftcmap 240
-notruecolor
For 8bpp displays, force indexed color (i.e. a colormap) even if it looks like 8bpp TrueColor (rare problem).
-advertise_truecolor
If the X11 display is indexed color, lie to clients when they first connect by telling them it is truecolor.  To workaround RealVNC: inPF has colourMap but not 8bpp Use '-advertise_truecolor reset' to reset client fb too.
-visual n
This option probably does not do what you think.  It simply *forces* the visual used for the framebuffer; this may be a bad thing... (e.g. messes up colors or cause a crash). It is useful for testing and for some workarounds.  n may be a decimal number, or 0x hex.  Run xdpyinfo(1) for the values.  One may also use "TrueColor", etc. see <X11/X.h> for a list.  If the string ends in ":m" then for better or for worse the visual depth is forced to be m.  You may want to use -noshm when using this option (so XGetImage may automatically translate the pixel data).
-overlay
Handle multiple depth visuals on one screen, e.g. 8+24 and 24+8 overlay visuals (the 32 bits per pixel are packed with 8 for PseudoColor and 24 for TrueColor).
Currently -overlay only works on Solaris via XReadScreen(3X11) and IRIX using XReadDisplay(3).  On Solaris there is a problem with image "bleeding" around transient popup menus (but not for the menu itself): a workaround is to disable SaveUnders by passing the "-su" argument to Xsun (in /etc/dt/config/Xservers).
Use -overlay as a workaround for situations like these: Some legacy applications require the default visual to be 8bpp (8+24), or they will use 8bpp PseudoColor even when the default visual is depth 24 TrueColor (24+8).  In these cases colors in some windows will be incorrect in x11vnc unless -overlay is used.  Another use of -overlay is to enable showing the exact mouse cursor shape (details below).
Under -overlay, performance will be somewhat slower due to the extra image transformations required.  For optimal performance do not use -overlay, but rather configure the X server so that the default visual is depth 24 TrueColor and try to have all apps use that visual (e.g. some apps have -use24 or -visual options).
-overlay_nocursor
Sets -overlay, but does not try to draw the exact mouse cursor shape using the overlay mechanism.
-8to24 [opts]
Try this option if -overlay is not supported on your OS, and you have a legacy 8bpp app that you want to view on a multi-depth display with default depth 24 (and is 32 bpp) OR have a default depth 8 display with depth 24 overlay windows for some apps.  This option may not work on all X servers and hardware (tested on XFree86/Xorg mga driver and Xsun).  The "opts" string is not required and is described below.
This mode enables a hack where x11vnc monitors windows within 3 levels from the root window.  If it finds any that are 8bpp it extracts the indexed color pixel values using XGetImage() and then applies a transformation using the colormap(s) to create TrueColor RGB values that it in turn inserts into bits 1-24 of the framebuffer.  This creates a depth 24 "view" of the display that is then exported via VNC.
Conversely, for default depth 8 displays, the depth 24 regions are read by XGetImage() and everything is transformed and inserted into a depth 24 TrueColor framebuffer.
Note that even if there are *no* depth 24 visuals or windows (i.e. pure 8bpp), this mode is potentially an improvement over -flashcmap because it avoids the flashing and shows each window in the correct color.
This method works OK, but may still have bugs and it does hog resources.  If there are multiple 8bpp windows using different colormaps, one may have to iconify all but one for the colors to be correct.
There may be painting errors for clipping and switching between windows of depths 8 and 24.  Heuristics are applied to try to minimize the painting errors.  One can also press 3 Alt_L's in a row to refresh the screen if the error does not repair itself. Also the option -fixscreen 8=3.0 or -fixscreen V=3.0 may be used to periodically refresh the screen at the cost of bandwidth (every 3 sec for this example).
The [opts] string can contain the following settings.  Multiple settings are separated by commas.
For for some X servers with default depth 24 a speedup may be achieved via the option "nogetimage".  This enables a scheme were XGetImage() is not used to retrieve the 8bpp data.  Instead, it assumes that the 8bpp data is in bits 25-32 of the 32bit X pixels. There is no requirement that the X server should put the data there for our poll requests, but some do and so the extra steps to retrieve it can be skipped.  Tested with mga driver with XFree86/Xorg.  For the default depth 8 case this option is ignored.
To adjust how often XGetImage() is used to poll the non-default visual regions for changes, use the option "poll=t" where "t" is a floating point time.  (default: 0.05)
Setting the option "level2" will limit the search for non-default visual windows to two levels from the root window.  Do this on slow machines where you know the window manager only imposes one extra window between the app window and the root window.
Also for very slow machines use "cachewin=t" where t is a floating point amount of time to cache XGetWindowAttributes results.  E.g. cachewin=5.0.  This may lead to the windows being unnoticed for this amount of time when deiconifying, painting errors, etc.
While testing on a very old SS20 these options gave tolerable response: -8to24 poll=0.2,cachewin=5.0. For this machine -overlay is supported and gives better response.
Debugging for this mode can be enabled by setting "dbg=1", "dbg=2", or "dbg=3".
-24to32
Very rare problem: if the framebuffer (X display or -rawfb) is 24bpp instead of the usual 32bpp, then dynamically transform the pixels to 32bpp.  This will be slower, but can be used to work around problems where VNC viewers cannot handle 24bpp (e.g. "main: setPF: not 8, 16 or 32 bpp?").  See the FAQ for more info.
In the case of -rawfb mode, the pixels are directly modified by inserting a 0 byte to pad them out to 32bpp.  For X displays, a kludge is done that is equivalent to "-noshm -visual TrueColor:32".  (If better performance is needed for the latter, feel free to ask).
-scale fraction
Scale the framebuffer by factor fraction.  Values less than 1 shrink the fb, larger ones expand it. Note: the image may not be sharp and response may be slower.  If fraction contains a decimal point "." it is taken as a floating point number, alternatively the notation "m/n" may be used to denote fractions exactly, e.g. -scale 2/3
To scale asymmetrically in the horizontal and vertical directions, specify a WxH geometry to stretch to: e.g. '-scale 1024x768', or also '-scale 0.9x0.75'
Scaling Options: can be added after fraction via ":", to supply multiple ":" options use commas.  If you just want a quick, rough scaling without blending, append ":nb" to fraction (e.g. -scale 1/3:nb).  No blending is the default for 8bpp indexed color, to force blending for this case use ":fb".
To disable -scrollcopyrect and -wirecopyrect under -scale use ":nocr".  If you need to to enable them use ":cr" or specify them explicitly on the command line.  If a slow link is detected, ":nocr" may be applied automatically.  Default: :cr
More esoteric options: for compatibility with vncviewers the scaled width is adjusted to be a multiple of 4: to disable this use ":n4".  ":in" use interpolation scheme even when shrinking, ":pad" pad scaled width and height to be multiples of scaling denominator (e.g. 3 for 2/3).
-geometry WxH
Same as -scale WxH
-scale_cursor frac
By default if -scale is supplied the cursor shape is scaled by the same factor.  Depending on your usage, you may want to scale the cursor independently of the screen or not at all.  If you specify -scale_cursor the cursor will be scaled by that factor.  When using -scale mode to keep the cursor at its "natural" size use "-scale_cursor 1".  Most of the ":" scaling options apply here as well.
-viewonly
All VNC clients can only watch (default off).
-shared
VNC display is shared, i.e. more than one viewer can connect at the same time (default off).
-once
Exit after the first successfully connected viewer disconnects, opposite of -forever. This is the Default.
Keep listening for more connections rather than exiting as soon as the first client(s) disconnect. Same as -many
To get the standard non-shared VNC behavior where when a new VNC client connects the existing VNC client is dropped use: -nevershared -forever   This method can also be used to guard against hung TCP connections that do not go away.
-loop
Create an outer loop restarting the x11vnc process whenever it terminates.  -bg and -inetd are ignored in this mode (however see -loopbg below).
Useful for continuing even if the X server terminates and restarts (at that moment the process will need permission to reconnect to the new X server of course).
Use, e.g., -loop100 to sleep 100 millisecs between restarts, etc. Default is 2000ms (i.e. 2 secs) Use, e.g. -loop300,5 to sleep 300 ms and only loop 5 times.
If -loopbg (plus any numbers) is specified instead, the "-bg" option is implied and the mode approximates inetd(8) usage to some degree.  In this case when it goes into the background any listening sockets (i.e. ports 5900, 5800) are closed, so the next one in the loop can use them.  This mode will only be of use if a VNC client (the only client for that process) is already connected before the process goes into the background, for example, usage of -display WAIT:.., -svc, and -connect can make use of this "poor man's" inetd mode.  The default wait time is 500ms in this mode. This usage could use useful:  -svc -bg -loopbg
-timeout n
Exit unless a client connects within the first n seconds after startup.
If there have been no connection attempts after n seconds x11vnc exits immediately.  If a client is trying to connect but has not progressed to the normal operating state, x11vnc gives it a few more seconds to finish and exits if it does not make it to the normal state.
For reverse connections via -connect or -connect_or_exit a timeout of n seconds will be set for all reverse connects.  If the connect timeout alarm goes off, x11vnc will exit immediately.
-sleepin n
At startup sleep n seconds before proceeding (e.g. to allow redirs and listening clients to start up)
If a range is given: '-sleepin min-max', a random value between min and max is slept. E.g. '-sleepin 0-20' and ´-sleepin 10-30'. Floats are allowed too.
-inetd
Launched by inetd(8): stdio instead of listening socket.  Note: if you are not redirecting stderr to a log file (via shell 2> or -o option) you MUST also specify the -q option, otherwise the stderr goes to the viewer which will cause it to abort.  Specifying both -inetd and -q and no -o will automatically close the stderr.
-tightfilexfer
Enable the TightVNC file transfer extension. Note that that when the -viewonly option is supplied all file transfers are disabled. Also clients that log in viewonly cannot transfer files.  However, if the remote control mechanism is used to change the global or per-client viewonly state the filetransfer permissions will NOT change.
IMPORTANT: please understand if -tightfilexfer is specified and you run x11vnc as root for, say, inetd or display manager (gdm, kdm, ...) access and you do not have it switch users via the -users option, then VNC Viewers that connect are able to do filetransfer reads and writes as *root*.
Also, tightfilexfer is disabled in -unixpw mode.
-ultrafilexfer
Note: to enable UltraVNC filetransfer and to get it to work you probably need to supply these LibVNCServer options: "-rfbversion 3.6 -permitfiletransfer" "-ultrafilexfer" is an alias for this combination.
IMPORTANT: please understand if -ultrafilexfer is specified and you run x11vnc as root for, say, inetd or display manager (gdm, kdm, ...) access and you do not have it switch users via the -users option, then VNC Viewers that connect are able to do filetransfer reads and writes as *root*.
Note that sadly you cannot do both -tightfilexfer and -ultrafilexfer at the same time because the latter requires setting the version to 3.6 and tightvnc will not do filetransfer when it sees that version number.
-http
Instead of using -httpdir (see below) to specify where the Java vncviewer applet is, have x11vnc try to *guess* where the directory is by looking relative to the program location and in standard locations (/usr/local/share/x11vnc/classes, etc).  Under -ssl or -stunnel the ssl classes subdirectory is sought.
-http_ssl
As -http, but force lookup for ssl classes subdir.
Note that for HTTPS, single-port Java applet delivery you can set X11VNC_HTTPS_DOWNLOAD_WAIT_TIME to the max number of seconds to wait for the applet download to finish.  The default is 15.
-avahi
Use the Avahi/mDNS ZeroConf protocol to advertise this VNC server to the local network. (Related terms: Rendezvous, Bonjour). Depending on your setup, you may need to start avahi-daemon and open udp port 5353 in your firewall.
You can set X11VNC_AVAHI_NAME, X11VNC_AVAHI_HOST, and/or X11VNC_AVAHI_PORT environment variables to override the default values.  For example: -env X11VNC_AVAHI_NAME=wally
If the avahi API cannot be found at build time, a helper program like avahi- publish(1) or dns- sd(1) will be tried
-mdns
Same as -avahi.
-zeroconf
-connect string
For use with "vncviewer -listen" reverse connections.  If string has the form "host" or "host:port" the connection is made once at startup.
Use commas for a list of host's and host:port's.  E.g. -connect host1,host2 or host1:0,host2:5678.  Note that to reverse connect to multiple hosts at the same time you will likely need to also supply: -shared
Note that unlike most vnc servers, x11vnc will require a password for reverse as well as for forward connections.  (provided password auth has been enabled, -rfbauth, etc) If you do not want to require a password for reverse connections set X11VNC_REVERSE_CONNECTION_NO_AUTH=1 in your environment before starting x11vnc.
If string contains "/" it is instead interpreted as a file to periodically check for new hosts.  The first line is read and then the file is truncated.  Be careful about the location of this file if x11vnc is running as root (e.g. via gdm(1) , etc).
Repeater mode: Some services provide an intermediate "vnc repeater": http://www.uvnc.com/addons/repeater.html (and also http://koti.mbnet.fi/jtko/ for linux port) that acts as a proxy/gateway.  Modes like these require an initial string to be sent for the reverse connection before the VNC protocol is started.  Here are the ways to do this:
-connect pre=some_string+host:port -connect pre128=some_string+host:port -connect repeater=ID:1234+host:port -connect repeater=23.45.67.89::5501+host:port
SSVNC notation is also supported:
-connect repeater://host:port+ID:1234
As with normal -connect usage, if the repeater port is not supplied 5500 is assumed.
The basic idea is between the special tag, e.g. "pre=" and "+" is the pre-string to be sent.  Note that in this case host:port is the repeater server, NOT the vnc viewer.  Somehow the pre-string tells the repeater server how to find the vnc viewer and connect you to it.
In the case pre=some_string+host:port, "some_string" is simply sent. In the case preNNN=some_string+host:port "some_string" is sent in a null padded buffer of length NNN.  repeater= is the same as pre250=, this is the ultravnc repeater buffer size.
Strings like "\n" and "\r", etc. are expanded to newline and carriage return.  "\c" is expanded to "," since the connect string is comma separated.
See also the -proxy option below for additional ways to plumb reverse connections.
Reverse SSL: using -connect in -ssl mode makes x11vnc act as an SSL client (initiates SSL connection) rather than an SSL server. The idea is x11vnc might be connecting to stunnel on the viewer side with the viewer in listening mode.  If you do not want this behavior, use -env X11VNC_DISABLE_SSL_CLIENT_MODE=1.  With this the viewer side can act as the SSL client as it normally does for forward connections.
Reverse SSL Repeater mode:  This will work, but note that if the VNC Client does any sort of a 'Fetch Cert' action before connecting, then the Repeater will likely drop the connection and both sides will need to restart.  Consider the use of -connect_or_exit and -loop300,2 to have x11vnc reconnect once to the repeater after the fetch.  You will probably also want to supply -sslonly to avoid x11vnc thinking the delay in response means the connection is VeNCrypt.  The env var X11VNC_DISABLE_SSL_CLIENT_MODE=1 discussed above may also be useful (i.e. the viewer can do a forward connection as it normally does.)
IPv6: as of x11vnc 0.9.10 the -connect option should connect to IPv6 hosts properly.  If there are problems you can disable IPv6 by setting -DX11VNC_IPV6=0 in CPPFLAGS when configuring.  If there problems connecting to IPv6 hosts consider a relay like the included inet6to4 script or the -proxy option.
-connect_or_exit str
As with -connect, except if none of the reverse connections succeed, then x11vnc shuts down immediately
An easier to type alias for this option is '-coe'
By the way, if you do not want x11vnc to listen on ANY interface use -rfbport 0  which is handy for the -connect_or_exit mode.
-proxy string
Use proxy in string (e.g. host:port) as a proxy for making reverse connections (-connect or -connect_or_exit options).
Web proxies are supported, but note by default most of them only support destination connections to ports 443 or 563, so this might not be very useful (the viewer would need to listen on that port or the router would have to do a port redirection).
A web proxy may be specified by either "host:port" or "http://host:port" (the port is required even if it is the common choices 80 or 8080)
SOCKS4, SOCKS4a, and SOCKS5 are also supported.  SOCKS proxies normally do not have restrictions on the destination port number.
Use a format like this: socks://host:port or socks5://host:port. Note that ssh -D does not support SOCKS4a, so use socks5://.  For socks:// SOCKS4 is used on a numerical IP and "localhost", otherwise SOCKS4a is used (and so the proxy tries to do the DNS lookup).
An experimental mode is "-proxy http://host:port/..."  Note the "/" after the port that distinguishes it from a normal web proxy. The port must be supplied even if it is the default 80.  For this mode a GET is done to the supplied URL with the string host=H&port=P appended.  H and P will be the -connect reverse connect host and port.  Use the string "__END__" to disable the appending.  The basic idea here is that maybe some cgi script provides the actual viewer hookup and tunnelling.  How to actually achieve this within cgi, php, etc. is not clear...  A custom web server or apache module would be straight-forward.
Another experimental mode is "-proxy ssh://user@host" in which case a SSH tunnel is used for the proxying.  "user@" is not needed unless your unix username is different on "host".  For a non- standard SSH port use ssh://user@host:port.  If proxies are chained (see next paragraph) then the ssh one must be the first one.  If ssh-agent is not active, then the ssh password needs to be entered in the terminal where x11vnc is running.  Examples:
-connect localhost:0 -proxy ssh://me@friends-pc:2222
-connect snoopy:0 -proxy ssh://ssh.company.com
Multiple proxies may be chained together in case one needs to ricochet off of a number of hosts to finally reach the VNC viewer. Up to 3 may be chained, separate them by commas in the order they are to be connected to.  E.g.: http://host1:port1,socks5://host2:port2 or three like: first,second,third
IPv6: as of x11vnc 0.9.10 the -proxy option should connect to IPv6 hosts properly.  If there are problems you can disable IPv6 by setting -DX11VNC_IPV6=0 in CPPFLAGS when configuring.  If there problems connecting to IPv6 hosts consider a relay like the included inet6to4 script.
-vncconnect, -novncconnect
Monitor the VNC_CONNECT X property set by the standard VNC program vncconnect(1).  When the property is set to "host" or "host:port" establish a reverse connection.  Using xprop(1) instead of vncconnect may work (see the FAQ).  The -remote control mechanism uses X11VNC_REMOTE channel, and this option disables/enables it as well.  Default: -vncconnect
To use different names for these X11 properties (e.g. to have separate communication channels for multiple x11vnc's on the same display) set the VNC_CONNECT or X11VNC_REMOTE env. vars. to the string you want, for example: -env X11VNC_REMOTE=X11VNC_REMOTE_12345 Both sides of the channel must use the same unique name.  The same can be done for the internal X11VNC_TICKER property (heartbeat and timestamp) if desired.
-allow host1[,host2..]
Only allow client connections from hosts matching the comma separated list of hostnames or IP addresses.  Can also be a numerical IP prefix, e.g. "192.168.100."  to match a simple subnet, for more control build LibVNCServer with libwrap support (See the FAQ).  If the list contains a "/" it instead is a interpreted as a file containing addresses or prefixes that is re- read each time a new client connects.  Lines can be commented out with the "#" character in the usual way.
-allow applies in -ssl mode, but not in -stunnel mode.
IPv6: as of x11vnc 0.9.10 a host can be specified in IPv6 numerical format, e.g. 2001:4860:b009::93.
-localhost
Basically the same as "-allow 127.0.0.1".
Note: if you want to restrict which network interface x11vnc listens on, see the -listen option below.  E.g. "-listen localhost" or "-listen 192.168.3.21".  As a special case, the option "-localhost" implies "-listen localhost".
A rare case, but for non-localhost -listen usage, if you use the remote control mechanism (-R) to change the -listen interface you may need to manually adjust the -allow list (and vice versa) to avoid situations where no connections (or too many) are allowed.
If you do not want x11vnc to listen on ANY interface (evidently you are using -connect or -connect_or_exit, or plan to use remote control: -R connect:host), use -rfbport 0
IPv6: if IPv6 is supported, this option automatically implies the IPv6 loopback address '::1' as well.
-unixsock str
Listen on the unix socket (AF_UNIX) 'str' for connections.  This mode is for either local connections or a tunnel endpoint where one wants the file permission of the unix socket file to determine what can connect to it.  (This currently requires an edit to libvnserver/rfbserver.c: comment out lines 310 and 311, 'close(sock)' and 'return NULL' in rfbserver.c after the setsockopt() call.) Note that to disable all tcp listening ports specify '-rfbport 0' and should be useful with this mode. Example: mkdir ~/s; chmod 700 ~/s; x11vnc -unixsock ~/s/mysock -rfbport 0 ...  The SSVNC unix vncviewer can connect to unix sockets.
-listen6 str
When in IPv6 listen mode "-6", listen only on the network interface with address str.  It also works for link scope addresses (fe80::219:dbff:fee5:3f92%eth0) and IPv6 hostname strings (e.g. ipv6.google.com.)  Use LibVNCServer -listen option for the IPv4 interface.
-nolookup
Do not use gethostbyname() or gethostbyaddr() to look up host names or IP numbers.  Use this if name resolution is incorrectly set up and leads to long pauses as name lookups time out, etc.
-input string
Fine tuning of allowed user input.  If string does not contain a comma "," the tuning applies only to normal clients.  Otherwise the part before "," is for normal clients and the part after for view-only clients.  "K" is for Keystroke input, "M" for Mouse- motion input, "B" for Button-click input, "C" is for Clipboard input, and "F" is for File transfer (ultravnc only).  Their presence in the string enables that type of input.  E.g. "-input M" means normal users can only move the mouse and  "-input KMBCF,M" lets normal users do anything and enables view-only users to move the mouse.  This option is ignored when a global -viewonly is in effect (all input is discarded in that case).
-grabkbd
When VNC viewers are connected, attempt to the grab the keyboard so a (non-malicious) user sitting at the physical display is not able to enter keystrokes.  This method uses XGrabKeyboard(3X11) and so it is not secure and does not rule out the person at the physical display injecting keystrokes by flooding the server with them, grabbing the keyboard himself, etc.  Some degree of cooperation from the person at the display is assumed.  This is intended for remote help-desk or educational usage modes.
Note: on some recent (12/2010) X servers and/or desktops, -grabkbd no longer works: it prevents the window manager from resizing windows and similar things.  Try -ungrabboth below (might not work.)
-grabptr
As -grabkbd, but for the mouse pointer using XGrabPointer(3X11). Unfortunately due to the way the X server works, the mouse can still be moved around by the user at the physical display, but he will not be able to change window focus with it.  Also some window managers that call XGrabServer(3X11) for resizes, etc, will act on the local user's input.  Again, some degree of cooperation from the person at the display is assumed.
-ungrabboth
Whenever there is any input (either keyboard or pointer), ungrab *both* the keyboard and the pointer while injecting the synthetic input.  This is to allow window managers, etc. a chance to grab.
-grabalways
Apply both -grabkbd and -grabptr even when no VNC viewers are connected.  If you only want one of them, use the -R remote control to turn the other back on, e.g. -R nograbptr.
-viewpasswd string
Supply a 2nd password for view-only logins.  The -passwd (full- access) password must also be supplied.
-passwdfile filename
Specify the LibVNCServer password via the first line of the file filename (instead of via -passwd on the command line where others might see it via ps(1) ).
See the descriptions below for how to supply multiple passwords, view-only passwords, to specify external programs for the authentication, and other features.
If the filename is prefixed with "rm:" it will be removed after being read.  Perhaps this is useful in limiting the readability of the file.  In general, the password file should not be readable by untrusted users (BTW: neither should the VNC -rfbauth file: it is NOT encrypted, only obscured with a fixed key).
If the filename is prefixed with "read:" it will periodically be checked for changes and reread.  It is guaranteed to be reread just when a new client connects so that the latest passwords will be used.
If filename is prefixed with "cmd:" then the string after the ":" is run as an external command: the output of the command will be interpreted as if it were read from a password file (see below). If the command does not exit with 0, then x11vnc terminates immediately.  To specify more than 1000 passwords this way set X11VNC_MAX_PASSWDS before starting x11vnc.  The environment variables are set as in -accept.
Note that due to the VNC protocol only the first 8 characters of a password are used (DES key).
If filename is prefixed with "custom:" then a custom password checker is supplied as an external command following the ":". The command will be run when a client authenticates.  If the command exits with 0 the client is accepted, otherwise it is rejected. The environment variables are set as in -accept.
The standard input to the custom command will be a decimal digit "len" followed by a newline. "len" specifies the challenge size and is usually 16 (the VNC spec).  Then follows len bytes which is the random challenge string that was sent to the client. This is then followed by len more bytes holding the client's response (i.e. the challenge string encrypted via DES with the user password in the standard situation).
The "custom:" scheme can be useful to implement dynamic passwords or to implement methods where longer passwords and/or different encryption algorithms are used.  The latter will require customizing the VNC client as well.  One could create an MD5SUM based scheme for example.
File format for -passwdfile:
If multiple non-blank lines exist in the file they are all taken as valid passwords.  Blank lines are ignored.  Password lines may be "commented out" (ignored) if they begin with the character "#" or the line contains the string "__SKIP__".  Lines may be annotated by use of the "__COMM__" string: from it to the end of the line is ignored.  An empty password may be specified via the "__EMPTY__" string on a line by itself (note your viewer might not accept empty passwords).
If the string "__BEGIN_VIEWONLY__" appears on a line by itself, the remaining passwords are used for viewonly access.  For compatibility, as a special case if the file contains only two password lines the 2nd one is automatically taken as the viewonly password.  Otherwise the "__BEGIN_VIEWONLY__" token must be used to have viewonly passwords.  (tip: make the 3rd and last line be "__BEGIN_VIEWONLY__" to have 2 full-access passwords)
-showrfbauth filename
Print to the screen the obscured VNC password kept in the rfbauth file filename and then exit.
-unixpw [list]
Use Unix username and password authentication.  x11vnc will use the su(1) program to verify the user's password.  [list] is an optional comma separated list of allowed Unix usernames.  If the [list] string begins with the character "!" then the entire list is taken as an exclude list.  See below for per-user options that can be applied.
A familiar "login:" and "Password:" dialog is presented to the user on a black screen inside the vncviewer.  The connection is dropped if the user fails to supply the correct password in 3 tries or does not send one before a 45 second timeout.  Existing clients are view-only during this period.
If the first character received is "Escape" then the unix username will not be displayed after "login:" as it is typed.  This could be of use for VNC viewers that automatically type the username and password.
Since the detailed behavior of su(1) can vary from OS to OS and for local configurations, test the mode before deployment to make sure it is working properly.  x11vnc will attempt to be conservative and reject a login if anything abnormal occurs.
One case to note: FreeBSD and the other BSD's by default it is impossible for the user running x11vnc to validate his *own* password via su(1) (commenting out the pam_self.so entry in /etc/pam.d/su eliminates this behavior).  So the x11vnc login will always *FAIL* for this case (even when the correct password is supplied).
A possible workaround for this on *BSD would be to start x11vnc as root with the "-users +nobody" option to immediately switch to user nobody where the su'ing will proceed normally.
Another source of potential problems are PAM modules that prompt for extra info, e.g. password aging modules.  These logins will fail as well even when the correct password is supplied.
**IMPORTANT**: to prevent the Unix password being sent in *clear text* over the network, one of two schemes will be enforced: 1) the -ssl builtin SSL mode, or 2) require both -localhost and -stunnel be enabled.
Method 1) ensures the traffic is encrypted between viewer and server.  A PEM file will be required, see the discussion under -ssl below (under some circumstances a temporary one can be automatically generated).
Method 2) requires the viewer connection to appear to come from the same machine x11vnc is running on (e.g. from a ssh -L port redirection).  And that the -stunnel SSL mode be used for encryption over the network. (see the description of -stunnel below).
Note: as a convenience, if you ssh(1) in and start x11vnc it will check if the environment variable SSH_CONNECTION is set and appears reasonable.  If it does, then the -ssl or -stunnel requirement will be dropped since it is assumed you are using ssh for the encrypted tunnelling.  -localhost is still enforced.  Use -ssl or -stunnel to force SSL usage even if SSH_CONNECTION is set.
To override the above restrictions you can set environment variables before starting x11vnc:
Set UNIXPW_DISABLE_SSL=1 to disable requiring either -ssl or -stunnel (as under SSH_CONNECTION.)  Evidently you will be using a different method to encrypt the data between the vncviewer and x11vnc: perhaps ssh(1) or an IPSEC VPN. -localhost is still enforced (however, see the next paragraph.)
Set UNIXPW_DISABLE_LOCALHOST=1 to disable the -localhost requirement in -unixpw modes.  One should never do this (i.e. allow the Unix passwords to be sniffed on the network.)  This also disables the localhost requirement for reverse connections (see below.)
Note that use of -localhost with ssh(1) (and no -unixpw) is roughly the same as requiring a Unix user login (since a Unix password or the user's public key authentication is used by sshd on the machine where x11vnc runs and only local connections from that machine are accepted).
Regarding reverse connections (e.g. -R connect:host and -connect host), when the -localhost constraint is in effect then reverse connections can only be used to connect to the same machine x11vnc is running on (default port 5500).  Please use a ssh or stunnel port redirection to the viewer machine to tunnel the reverse connection over an encrypted channel.
In -inetd mode the Method 1) will be enforced (not Method 2). With -ssl in effect reverse connections are disabled.  If you override this via env. var, be sure to also use encryption from the viewer to inetd.  Tip: you can also have your own stunnel spawn x11vnc in -inetd mode (thereby bypassing inetd).  See the FAQ for details.
The user names in the comma separated [list] may have per-user options after a ":", e.g. "fred:opts" where "opts" is a "+" separated list of "viewonly", "fullaccess", "input=XXXX", or "deny", e.g. "karl,wally:viewonly,boss:input=M".  For "input=" it is the K,M,B,C described under -input.
If an item in the list is "*" that means those options apply to all users.  It ALSO implies all users are allowed to log in after supplying a valid password.  Use "deny" to explicitly deny some users if you use "*" to set a global option.  If [list] begins with the "!" character then "*" is ignored for checking if the user is allowed, but the option values associated with it do apply as normal.
There are also some utilities for checking passwords if [list] starts with the "%" character.  See the quick_pw() function for more details.  Description: "%-" or "%stdin" means read one line from stdin.  "%env" means it is in $UNIXPW env var.  A leading "%/" or "%." means read the first line from the filename that follows after the % character. % by itself means prompt for the username and password.  Otherwise: %user:pass   E.g. -unixpw %fred:swordfish For the other cases user:pass is read from the indicated source.  If the password is correct 'Y user' is printed and the program exit code is 0.  If the password is incorrect it prints 'N user' and the exit code is 1.  If there is some other error the exit code is 2.  This feature enables x11vnc to be a general unix user password checking tool; it could be used from scripts or other programs.  These % password checks also apply to the -unixpw_nis and -unixpw_cmd options.
For the % password check, if the env. var. UNIXPW_CMD is set to a command then it is run as the user (assuming the password is correct.)  The output of the command is not printed, the program or script must manage that by some other means.  The exit code of x11vnc will depend on the exit code of the command that is run.
Use -nounixpw to disable unixpw mode if it was enabled earlier in the cmd line (e.g. -svc mode)
-unixpw_nis [list]
As -unixpw above, however do not use su(1) but rather use the traditional getpwnam(3) + crypt(3) method to verify passwords. All of the above -unixpw options and constraints apply.
This mode requires that the encrypted passwords be readable. Encrypted passwords stored in /etc/shadow will be inaccessible unless x11vnc is run as root.
This is called "NIS" mode simply because in most NIS setups user encrypted passwords are accessible (e.g. "ypcat passwd") by an ordinary user and so that user can authenticate ANY user.
NIS is not required for this mode to work (only that getpwnam(3) return the encrypted password is required), but it is unlikely it will work (as an ordinary user) for most modern environments unless NIS is available.  On the other hand, when x11vnc is run as root it will be able to to access /etc/shadow even if NIS is not available (note running as root is often done when running x11vnc from inetd and xdm/gdm/kdm).