x11vnc: gui speedup and fixes. -unixpw and -inetd

1 files changed, 46 insertions, 29 deletions

diff --git a/x11vnc/help.c b/x11vnc/help.c
index a0c1bc3..293104b 100644
--- a/x11vnc/help.c
+++ b/x11vnc/help.c
@@ -315,8 +315,9 @@ void print_help(int mode) {
 "-novncconnect          VNC program vncconnect(1).  When the property is\n"
 "                       set to \"host\" or \"host:port\" establish a reverse\n"
 "                       connection.  Using xprop(1) instead of vncconnect may\n"
-"                       work (see the FAQ).  The -remote control mechanism also\n"
-"                       uses this VNC_CONNECT channel.  Default: %s\n"
+"                       work (see the FAQ).  The -remote control mechanism uses\n"
+"                       X11VNC_REMOTE channel, and this option disables/enables\n"
+"                       it as well.  Default: %s\n"
 "\n"
 "-allow host1[,host2..] Only allow client connections from hosts matching\n"
 "                       the comma separated list of hostnames or IP addresses.\n"
@@ -431,8 +432,8 @@ void print_help(int mode) {
 "                       x11vnc as root with the \"-users +nobody\" option to\n"
 "                       immediately switch to user nobody.  Another source of\n"
 "                       problems are PAM modules that prompt for extra info,\n"
-"                       e.g. password aging modules.  These logins will always\n"
-"                       fail as well.\n"
+"                       e.g. password aging modules.  These logins will fail\n"
+"                       as well even when the correct password is supplied.\n"
 "\n"
 "                       *IMPORTANT*: to prevent the Unix password being sent in\n"
 "                       *clear text* over the network, two x11vnc options are\n"
@@ -459,17 +460,28 @@ void print_help(int mode) {
 "                       is set and appears reasonable.  If it does, then the\n"
 "                       stunnel requirement is dropped since it is assumed\n"
 "                       you are using ssh for the encrypted tunnelling.\n"
-"                       Use -stunnel to force stunnel usage.\n"
+"                       Use -stunnel to force stunnel usage for this case.\n"
 "\n"
 "                       Set UNIXPW_DISABLE_LOCALHOST=1 to disable the -localhost\n"
 "                       requirement.  One should never do this (i.e. allow the\n"
 "                       Unix passwords to be sniffed on the network).\n"
 "\n"
-"                       NOTE: in -inetd mode the two settings are not enforced\n"
-"                       since x11vnc does not make network connections in\n"
-"                       that case.  Be sure to use encryption from the viewer\n"
-"                       to inetd.  One can also have your own stunnel spawn\n"
-"                       x11vnc in -inetd mode.  See the FAQ.\n"
+"                       Regarding reverse connections (e.g. -R connect:host),\n"
+"                       the -localhost constraint is in effect and the reverse\n"
+"                       connections can only be used to connect to the same\n"
+"                       machine x11vnc is running on (default port 5500).\n"
+"                       Please use a ssh or stunnel port redirection to the\n"
+"                       viewer machine to tunnel the reverse connection over\n"
+"                       an encrypted channel.  Note that Unix username and\n"
+"                       password *will* be prompted for (unlike VNC passwords\n"
+"                       that are skipped for reverse connections).\n"
+"\n"
+"                       NOTE: in -inetd mode the two settings are attempted\n"
+"                       to be enforced for reverse connections.  Be sure to\n"
+"                       use encryption from the viewer to inetd since x11vnc\n"
+"                       cannot guess easily if it is encrpyted.  Note: you can\n"
+"                       also have your own stunnel spawn x11vnc in -inetd mode\n"
+"                       (i.e. bypassing inetd).  See the FAQ.\n"
 "\n"
 "                       The user names in the comma separated [list] can have\n"
 "                       per-user options after a \":\", e.g. \"fred:opts\"\n"
@@ -484,16 +496,21 @@ void print_help(int mode) {
 "                       Use \"deny\" to explicitly deny some users if you use\n"
 "                       \"*\" to set a global option.\n"
 "\n"
-"-unixpw_nis [list]     As -unixpw above, however do not run su(1) but rather\n"
-"                       use the traditional getpwnam() + crypt() method instead.\n"
-"                       This requires that the encrpyted passwords be readable.\n"
-"                       Passwords stored in /etc/shadow will be inaccessible\n"
-"                       unless run as root.  This is called \"NIS\" mode\n"
-"                       simply because in most NIS setups the user encrypted\n"
-"                       passwords are accessible (e.g. \"ypcat passwd\").\n"
-"                       NIS is not required for this mode to work, but it\n"
-"                       is unlikely it will work for any other environment.\n"
-"                       All of the -unixpw options and contraints apply.\n"
+"                       There are also some tools for testing password if [list]\n"
+"                       starts with the \"%\" character.  See the quick_pw()\n"
+"                       function for details.\n"
+"\n"
+"-unixpw_nis [list]     As -unixpw above, however do not use su(1) but rather\n"
+"                       use the traditional getpwnam(3) + crypt(3) method\n"
+"                       instead.  This requires that the encrpyted passwords\n"
+"                       be readable.  Passwords stored in /etc/shadow will\n"
+"                       be inaccessible unless run as root.  This is called\n"
+"                       \"NIS\" mode simply because in most NIS setups the\n"
+"                       user encrypted passwords are accessible (e.g. \"ypcat\n"
+"                       passwd\").  NIS is not required for this mode to\n"
+"                       work, but it is unlikely it will work for any other\n"
+"                       environment.  All of the -unixpw options and contraints\n"
+"                       apply.\n"
 "\n"
 "-stunnel [pem]         Use the stunnel(1) (www.stunnel.org) to provide\n"
 "                       an encrypted SSL tunnel between viewers and x11vnc.\n"
@@ -1767,7 +1784,7 @@ void print_help(int mode) {
 "                       -remote command.\n"
 "\n"
 "                       The default communication channel is that of X\n"
-"                       properties (specifically VNC_CONNECT), and so this\n"
+"                       properties (specifically X11VNC_REMOTE), and so this\n"
 "                       command must be run with correct settings for DISPLAY\n"
 "                       and possibly XAUTHORITY to connect to the X server\n"
 "                       and set the property.  Alternatively, use the -display\n"
@@ -2056,9 +2073,9 @@ void print_help(int mode) {
 "                       it comes back with prefix \"aro=\" instead of \"ans=\".\n"
 "\n"
 "                       Some -remote commands are pure actions that do not make\n"
-"                       sense as variables, e.g. \"stop\" or \"disconnect\",\n"
-"                       in these cases the value returned is \"N/A\".  To direct\n"
-"                       a query straight to the VNC_CONNECT property or connect\n"
+"                       sense as variables, e.g. \"stop\" or \"disconnect\", in\n"
+"                       these cases the value returned is \"N/A\".  To direct a\n"
+"                       query straight to the X11VNC_REMOTE property or connect\n"
 "                       file use \"qry=...\" instead of \"cmd=...\"\n"
 "\n"
 "                       Here is the current list of \"variables\" that can\n"
@@ -2157,9 +2174,9 @@ void print_help(int mode) {
 "\n"
 "                       A note about security wrt remote control commands.\n"
 "                       If someone can connect to the X display and change\n"
-"                       the property VNC_CONNECT, then they can remotely\n"
+"                       the property X11VNC_REMOTE, then they can remotely\n"
 "                       control x11vnc.  Normally access to the X display is\n"
-"                       protected.  Note that if they can modify VNC_CONNECT\n"
+"                       protected.  Note that if they can modify X11VNC_REMOTE\n"
 "                       on the X server, they have enough permissions to also\n"
 "                       run their own x11vnc and thus have complete control\n"
 "                       of the desktop.  If the  \"-connect /path/to/file\"\n"
@@ -2169,9 +2186,9 @@ void print_help(int mode) {
 "                       permissions.  See -privremote below.\n"
 "\n"
 "                       If you are paranoid and do not think -noremote is\n"
-"                       enough, to disable the VNC_CONNECT property channel\n"
-"                       completely use -novncconnect, or use the -safer\n"
-"                       option that shuts many things off.\n"
+"                       enough, to disable the X11VNC_REMOTE property channel\n"
+"                       completely use -novncconnect, or use the -safer option\n"
+"                       that shuts many things off.\n"
 "\n"
 "-unsafe                A few remote commands are disabled by default\n"
 "                       (currently: id:pick, accept:<cmd>, gone:<cmd>, and\n"