diff options
Diffstat (limited to 'x11vnc/help.c')
| -rw-r--r-- | x11vnc/help.c | 122 |
1 files changed, 70 insertions, 52 deletions
diff --git a/x11vnc/help.c b/x11vnc/help.c index d31a038..a0c1bc3 100644 --- a/x11vnc/help.c +++ b/x11vnc/help.c @@ -401,34 +401,38 @@ void print_help(int mode) { " and last line be \"__BEGIN_VIEWONLY__\" to have 2\n" " full-access passwords)\n" "\n" -"-unixpw [list] Experimental option: use Unix username and password\n" -" authentication. x11vnc uses the su(1) program to verify\n" -" the user's password. [list] is an optional comma\n" -" separated list of allowed Unix usernames. See below\n" -" for per-user options that can be applied.\n" +"-unixpw [list] Use Unix username and password authentication. x11vnc\n" +" uses the su(1) program to verify the user's password.\n" +" [list] is an optional comma separated list of allowed\n" +" Unix usernames. See below for per-user options that\n" +" can be applied.\n" "\n" " A familiar \"login:\" and \"Password:\" dialog is\n" " presented to the user on a black screen inside the\n" " vncviewer. The connection is dropped if the user fails\n" " to supply the correct password in 3 tries or does not\n" -" send one before a 20 second timeout. Existing clients\n" +" send one before a 25 second timeout. Existing clients\n" " are view-only during this period.\n" "\n" " Since the detailed behavior of su(1) can vary from\n" " OS to OS and for local configurations, please test\n" " the mode carefully on your systems before using it.\n" -" Try different combinations of valid/invalid usernames\n" -" and passwords.\n" +" E.g. try different combinations of valid/invalid\n" +" usernames and valid/invalid passwords to see if it\n" +" behaves correctly. x11vnc will be conservative and\n" +" reject a user if anything abnormal occurs.\n" " \n" -" For example, on FreeBSD and the other BSD's and Tru64\n" -" it does not appear to be possible for the user running\n" -" x11vnc to validate his *own* password via su(1).\n" -" The x11vnc login will always fail in this case.\n" -" A possible workaround would be to start x11vnc as\n" -" root with the \"-users +nobody\" option to immediately\n" -" switch to user nobody. Another source of problems are\n" -" PAM modules that prompt for extra info, e.g. password\n" -" aging modules. These logins will always fail as well.\n" +" For example, on FreeBSD and the other BSD's by default\n" +" it is impossible for the user running x11vnc to validate\n" +" his *own* password via su(1) (evidently commenting\n" +" out the pam_self.so entry in /etc/pam.d/su eliminates\n" +" the problem). So the x11vnc login will always fail for\n" +" this case. A possible workaround would be to start\n" +" x11vnc as root with the \"-users +nobody\" option to\n" +" immediately switch to user nobody. Another source of\n" +" problems are PAM modules that prompt for extra info,\n" +" e.g. password aging modules. These logins will always\n" +" fail as well.\n" "\n" " *IMPORTANT*: to prevent the Unix password being sent in\n" " *clear text* over the network, two x11vnc options are\n" @@ -444,17 +448,18 @@ void print_help(int mode) { " Set UNIXPW_DISABLE_STUNNEL=1 to disable using -stunnel.\n" " Evidently you will be using a different method to\n" " encrypt the data between the vncviewer and x11vnc:\n" -" e.g. ssh(1) or a VPN. Note that use of ssh(1) with\n" -" -localhost is roughly the same as requiring a Unix\n" -" user login (since Unix password or the user's public\n" -" key authentication is used by ssh)\n" -"\n" -" As a convenience, if you ssh(1) in and start x11vnc\n" -" it will look to see if the environment variable\n" -" SSH_CONNECTION is set and appears reasonable. If it\n" -" does, then the stunnel requirement is dropped since\n" -" it is assumed you are using ssh for the encrypted\n" -" tunnelling. Use -stunnel to force stunnel usage.\n" +" e.g. ssh(1) or a VPN. Note that use of -localhost\n" +" with ssh(1) is roughly the same as requiring a Unix\n" +" user login (since a Unix password or the user's public\n" +" key authentication is used by ssh on the machine where\n" +" x11vnc runs and only local connections are accepted)\n" +"\n" +" As a convenience, if you ssh(1) in and start x11vnc it\n" +" will check if the environment variable SSH_CONNECTION\n" +" is set and appears reasonable. If it does, then the\n" +" stunnel requirement is dropped since it is assumed\n" +" you are using ssh for the encrypted tunnelling.\n" +" Use -stunnel to force stunnel usage.\n" "\n" " Set UNIXPW_DISABLE_LOCALHOST=1 to disable the -localhost\n" " requirement. One should never do this (i.e. allow the\n" @@ -471,16 +476,28 @@ void print_help(int mode) { " where \"opts\" is a \"+\" separated list of\n" " \"viewonly\", \"fullaccess\", \"input=XXXX\", or\n" " \"deny\", e.g. \"karl,fred:viewonly,boss:input=M\".\n" -" For \"input=\" it is the K,M,B,C describe under -input.\n" -"\n" -" If a user in the list is \"*\" that means those options\n" -" apply to all users. It also means all users are allowed\n" -" to log in. Use \"deny\" to explicitly deny some users\n" -" if you use \"*\" to set a global option.\n" -"\n" -"-stunnel [pem] Use the stunnel(1) (www.stunnel.org) to provide an\n" -" encrypted SSL tunnel between viewers and x11vnc.\n" -" This requires stunnel be installed on the system and\n" +" For \"input=\" it is the K,M,B,C described under -input.\n" +"\n" +" If a user in the list is \"*\" that means those\n" +" options apply to all users. It also means all users\n" +" are allowed to log in after supplying a valid password.\n" +" Use \"deny\" to explicitly deny some users if you use\n" +" \"*\" to set a global option.\n" +"\n" +"-unixpw_nis [list] As -unixpw above, however do not run su(1) but rather\n" +" use the traditional getpwnam() + crypt() method instead.\n" +" This requires that the encrpyted passwords be readable.\n" +" Passwords stored in /etc/shadow will be inaccessible\n" +" unless run as root. This is called \"NIS\" mode\n" +" simply because in most NIS setups the user encrypted\n" +" passwords are accessible (e.g. \"ypcat passwd\").\n" +" NIS is not required for this mode to work, but it\n" +" is unlikely it will work for any other environment.\n" +" All of the -unixpw options and contraints apply.\n" +"\n" +"-stunnel [pem] Use the stunnel(1) (www.stunnel.org) to provide\n" +" an encrypted SSL tunnel between viewers and x11vnc.\n" +" This requires stunnel to be installed on the system and\n" " available via PATH (n.b. stunnel is often installed in\n" " sbin directories). Version 4.x of stunnel is assumed;\n" " see -stunnel3 below.\n" @@ -492,9 +509,9 @@ void print_help(int mode) { "\n" " stunnel is started up as a child process of x11vnc and\n" " any SSL connections stunnel receives are decrypted and\n" -" sent to x11vnc over a local socket. The strings \"The\n" -" SSL VNC desktop is ...\" and SSLPORT=... are printed\n" -" out at startup.\n" +" sent to x11vnc over a local socket. The strings\n" +" \"The SSL VNC desktop is ...\" and \"SSLPORT=...\"\n" +" are printed out at startup.\n" "\n" " The -localhost option is enforced by default to\n" " avoid people routing around the SSL channel. Set\n" @@ -502,7 +519,7 @@ void print_help(int mode) { "\n" " Your VNC viewer will need to be able to connect via SSL.\n" " Unfortunately not too many do this. UltraVNC seems to\n" -" have a SSL plugin. It is not too difficult to set up\n" +" have a SSL plugin. It is not too difficult to set up\n" " an stunnel or other SSL tunnel on the viewer side.\n" "\n" " A simple example on Unix using stunnel 3.x is:\n" @@ -2100,16 +2117,17 @@ void print_help(int mode) { " http_url auth xauth users rootshift clipshift\n" " scale_str scaled_x scaled_y scale_numer scale_denom\n" " scale_fac scaling_blend scaling_nomult4 scaling_pad\n" -" scaling_interpolate inetd privremote unsafe safer nocmds\n" -" passwdfile unixpw unixpw_list stunnel stunnel_pem\n" -" using_shm logfile o flag rc norc h help V version\n" -" lastmod bg sigpipe threads readrate netrate netlatency\n" -" pipeinput clients client_count pid ext_xtest ext_xtrap\n" -" ext_xrecord ext_xkb ext_xshm ext_xinerama ext_overlay\n" -" ext_xfixes ext_xdamage ext_xrandr rootwin num_buttons\n" -" button_mask mouse_x mouse_y bpp depth indexed_color\n" -" dpy_x dpy_y wdpy_x wdpy_y off_x off_y cdpy_x cdpy_y\n" -" coff_x coff_y rfbauth passwd viewpasswd\n" +" scaling_interpolate inetd privremote unsafe safer\n" +" nocmds passwdfile unixpw unixpw_nis unixpw_list stunnel\n" +" stunnel_pem using_shm logfile o flag rc norc h help\n" +" V version lastmod bg sigpipe threads readrate netrate\n" +" netlatency pipeinput clients client_count pid ext_xtest\n" +" ext_xtrap ext_xrecord ext_xkb ext_xshm ext_xinerama\n" +" ext_overlay ext_xfixes ext_xdamage ext_xrandr rootwin\n" +" num_buttons button_mask mouse_x mouse_y bpp depth\n" +" indexed_color dpy_x dpy_y wdpy_x wdpy_y off_x off_y\n" +" cdpy_x cdpy_y coff_x coff_y rfbauth passwd viewpasswd\n" +"\n" "-QD variable Just like -query variable, but returns the default\n" " value for that parameter (no running x11vnc server\n" " is consulted)\n" |