RE: Remote access solution

I had started to type up what I thought VNC does on login; then I decided to simply post this link. It should answer any question about security around the initial authentication:

http://www.uk.research.att.com/vnc/faq.html#q55

-----Original Message-----
From: Chris Berry [mailto:compjma@hotmail.com] Sent: Wednesday, February 26, 2003 1:15 PM To: security-basics@securityfocus.com
Subject: Re: Remote access solution

>From: "Mike Jensen" <jenseses@hotmail.com>

>your password is sent in the clear.
>
>I've always recommended tunneling the whole VNC session through some type
>of encryption method. (I prefer VPNs)

Actually, I don't think even the initial authentication is secure, you should definitely use some sort of encryption (ssh or vpn or both) Personally I'd say ssh is fine when you're connecting from one interior computer to another, but if you're going to connect from home or something I'd say tacking a vpn on top would be a good idea.

Chris Berry
compjma@hotmail.com
Systems Administrator
JM Associates

"Linux and I have a love/hate relationship. I hate its complexity until I figure out how something works, then I love its power."

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Blue Cross Blue Shield of Florida, Inc., and its subsidiary and affiliate companies are not responsible for errors or omissions in this e-mail message. Any personal comments made in this e-mail do not reflect the views of Blue Cross Blue Shield of Florida, Inc. Received on Thu Feb 27 12:28:55 2003