Remote administration -- with security!

Daily Newsletters

Sign up to ZDNet UK's daily newsletter.

ANALYSIS
As a tech pro, you almost always need to be in two places at once. Of course, remote administration software, such as VNC, can help. VNC, or Virtual Network Computing, is a platform-independent utility which displays a computer's screen remotely. Unfortunately, VNC isn't the most secure solution. Hackers can use a sniffer to view information that flows over a VNC connection. But with TightVNC, you can have your cake and eat it too. Let's look at how you can use TightVNC to administer workstations and servers remotely without giving up security. When is TightVNC a good option? For Windows-only administrators dealing exclusively with Windows 2000 on both the server and workstations, VNC of any flavor might not be the best solution for your remote administration needs. In this case, Windows 2000 includes Terminal Services, which can act as a great remote administration tool as well as an application server, and this would be your better bet. However, if you work in a mixed-OS environment, then Terminal Services won't work for remote administration of your non-Windows 2000 workstations. Likewise, you may not want to load down your Windows 2000 servers and workstations with the overhead required to run Terminal Services. To get around these problems, you can use a third-party tool like TightVNC. TightVNC will work on platforms other than Windows 2000, including all versions of Windows, Linux, and Unix. TightVNC also offers a Java viewer so that you can connect via a browser if you wish. Some of the main differences between VNC and TightVNC are:
  • Support for two passwords, one for full control, the other read-only.
  • Optional JPEG compression to help speed up slower connections.
  • General compression levels can be modified depending on connection speed and CPU power.
  • Compression algorithms are new in TightVNC, which performs better over slower connections than the traditional compression algorithms in the standard version of VNC.
  • Local cursor handling means the local viewer processes remote cursor movements so you don't see as many mouse trails.
  • The Java viewer has been improved to support 24-bit color.
  • TightVNC allows you to allocate arbitrary port numbers for TCP/IP connections.
  • The Unix version of TightVNC can automatically tunnel connections via SSH using local and SSH/OpenSSH installation.
Read this article, for more details on TighVNC's use of SSH. Obtaining and running TightVNC You can download TightVNC directly from the TightVNC Web site. It's available as a self-extracting file that's just shy of 900 KB. Running a default installation will put the files in Program Files\TightVNC. You can run a default TightVNC setup from the command line by typing tightvnc-1.2.8-setup.exe /sp- /verysilent and pressing [Enter]. TightVNC's installation is very simple and runs like most Windows Setup programs you've ever dealt with. TightVNC has two parts, the server (WinVNC) and the viewer. You'll run the server on the server or workstation you want to remotely control. You'll run the viewer on the administration workstation that you want to use to access the server. TightVNC can run in Application mode or in Service mode. Application mode requires a user to be logged in to the server for a remote administration session to occur. Service mode runs the server as a service that starts automatically when a machine is rebooted. Service mode allows you to access a machine when there is no one logged in to it. One important note: If you want remote [Ctrl][Alt][Delete] to work, you must run TightVNC as a service on the target machine! TightVNC installs with a default password, which, if security is not a great concern, can be replicated to other machines by copying over this registry key: HKCU\Software\ORL\WinWNC3 When you first run the program, the Properties window will open to let you enter a password for access. Each user can have a different password -- probably a good idea for security and accountability reasons. TightVNC adds a little icon to the system tray when it's running. This icon inverts its colors when sessions are in progress. Right-clicking the icon allows you to set the following options:
  • Add New Client -- Outgoing connections can be made to a viewer on another viewer that is in Listen mode. This is basically the inverse of how you would normally use a remote administration application. The effect is a shared connection.
  • Kill All Clients -- This option disconnects all TightVNC sessions immediately.
  • Disable New Clients -- Using this option prevents client connections from being made to the TightVNC server.
  • About WinVNC -- This option indicates the version number, etc.
  • Close -- This option shuts down the WinVNC server.
On the viewer side, you can connect using three modes:
  • Best Compression -- This mode is best for slow (i.e., 56 kbps modem) connections. All JPEGs are compressed. Compression and image quality can be tweaked.
  • Fast Compression -- Use this mode over a high-speed 10/100 LAN or WAN.
  • Listen -- This mode allows the viewer machine to accept reverse connections from the machine running WinVNC server, as explained above.
You can also connect to a TightVNC server through a Java-compatible browser. The WinVNC application comes with a small Web server built in, which listens on port 5800. I've tried this and there is a fair amount of latency (even with the compression enhancements offered in TightVNC), and if you're using 56Kbps dial-up, the Java browser is probably not the best solution. Over dial-up, you should stick to the traditional VNCViewer. The price is right There are a few remote administration products in the market, such as Symantec's PC Anywhere, but they aren't free and the extra bells and whistles they offer probably aren't needed in most remote administration situations. TightVNC is free and it's always benefiting from development, so it should keep getting better with time.
For a weekly round-up of the enterprise IT news, sign up for the Enterpise newsletter. Tell us what you think in the Enterprise Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

  • Login

Will not be displayed with your comment

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

Dennis Nilsson

If we allow corporate interest to dictate the way our government circumvents due process against foreign entities then we should accept the same...

45 minutes ago by Dennis Nilsson via Facebook on ACTA stumbles in Germany
GHar123

I totally dislike pirating of works, I fear that artists will be deterred from creating works if they think that they are going to get ripped off....

2 hours ago by GHar123 on ACTA stumbles in Germany
JCB33

How dare film makers, artists or anybody that invests in creativity stop us pirating their works for free. I want to be able to walk into my local...

8 hours ago by JCB33 on ACTA stumbles in Germany
Moley

@GrueMaster. I prefer horses for courses rather than one size fits all. I, and I suspect most other computer users, do not really wish to have...

10 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint
greycynic

The product that scares me every time I have to use it is the Office 2007 version of Excel. The first bug that I found was applying the median...

10 hours ago by greycynic on Ten flawed products that derail productivity
GrueMaster

Nice review and very informative. One thing I'd like to add (in reply to whs001's 1st question), the main reason to have the same interface from...

12 hours ago by GrueMaster on A tale of two distros: Ubuntu and Linux Mint
Frederick Wrigley

I'be been using Mint 12 since the RC came out, and I am far more happy with the Cinnamon, the Mate, and, yes (with extensions), theGnome 3...

12 hours ago by Frederick Wrigley via Facebook on A tale of two distros: Ubuntu and Linux Mint
bdantas

Excellent article. One small correction, though--although a fresh installation of Linux Mint 12 will, indeed, provide the user with a version of...

13 hours ago by bdantas on A tale of two distros: Ubuntu and Linux Mint
Alan Ralph

In related news, the ISPs club together to get the members of the Home Affairs Select Committee (ya goofed on that part, ZDNet UK) copies of "The...

14 hours ago by Alan Ralph via Facebook on MPs urge ISPs to take down terrorist material
Alan Ralph

In related news, the ISPs club together to get the members of the Home Affairs Select Committee (ya goofed on that part, ZDNet UK) copies of "The...

14 hours ago by Alan Ralph via Facebook on MPs urge ISPs to take down terrorist material
Moley

For Gnome 2 die-hards, it is possible to add icons to the bottom panel (or top top panel, if you prefer) which provide the exact Gnome 2...

15 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint
ramwellian

Your comments would seem pretty naive and immature. Your 'solution' appears to be, "gee, let's all just give in to the hackers and give them...

15 hours ago by ramwellian on Cloud computing security: no more oxymoron?
BugStalker

"Interesting thought ... If you installed Win7 as a dual boot on a machine that previously only had Linux, and it wrecked your Linux installation,...

15 hours ago by BugStalker on Windows 7 Declares War on GRUB
whs001

This is an excellent summary of Ubuntu and Mint and the interface differences between them. Most such articles take a very partisan position for...

15 hours ago by whs001 on A tale of two distros: Ubuntu and Linux Mint
Moley

@ewallace. Not so clear. Anyone can obtain the text, for example from here http://www.ustr.gov/webfm_send/2379. I support ACTA so long as it and...

15 hours ago by Moley on ACTA: Facts, misconceptions and questions
45283

I think WinRT is fantastic. I just wish it was an option for people that didn't want to go through Microsoft's App Store with its attendant...

18 hours ago by 45283 on Why Windows 8 needs architectural hygiene for WOA
Burn-IT

Nine people? £30m? Who's back pocket is that lot going in? And IF they say it is for new buildings, what about all the ones the government has...

20 hours ago by Burn-IT on Police set to launch three £30m e-crime hubs
ewallace

Just to be clear, nobody knows what is in the text of ACTA, here is a photograph of the text of ACTA http://twitpic.com/8h9iju as submitted to the...

20 hours ago by ewallace on ACTA: Facts, misconceptions and questions
fgvrg56

Unfortunately main issue is that ASUS is refusing to accept that they make some mistake on this version of asus Transformer prime. 1 - GPS sensor...

21 hours ago by fgvrg56 on Asus Eee Pad Transformer Prime Wi-Fi & GPS problems?
Ben Woods

@Marcus A fair question. Just talked with Archos which said it was working on an announcement for next week....

22 hours ago by Ben Woods on Archos confirms G9 Ice Cream Sandwich update schedule