UltraVNC

@prandal: I'm not sure if obscurity is an option here. There is already a tool available on the web that grabs the Windows password from the mslogon authentication. I think there has to be some pressure to update insecure servers. Otherwise you won't notice that you're still using the old insecure ...

This is one case where security via obscurity might be desirable... No warning at all.

Please notice that the mslogon fix introduces a change in the protocol. I.e. you cannot use a 1.0.1 (or older) viewer (vncviewer or JavaViewer) with a 1.0.2 winvnc using mslogon. You can do it the other way round (1.0.1 winvnc with 1.0.2 viewer) but then you're still using the unsecure protocol ...

Please notice that the mslogon fix introduces a change in the protocol. I.e. you cannot use a 1.0.1 (or older) viewer (vncviewer or JavaViewer) with a 1.0.2 winvnc using mslogon. You can do it the other way round (1.0.1 winvnc with 1.0.2 viewer) but then you're still using the unsecure protocol ...

I'll second that. NTLM pass-through authentication would be very useful. But it might not be a trivial exercise to implement it.

You will need to have UltraVNC intalled on the box you need to manage, and the current Java Runtime Environment installed ( JRE 1.5.0_02 is the best, from http://java.sun.com/j2se/1.5.0/download.jsp ) on the PC doing the remote controlling. Microsoft's Java Virtual Machine (which is well obsolete ...

Could you provide more detail to how you set this up ? I actually been fighting to make fast push work for me..... Not at the moment, but it was fairly trivial. When I have some time I'll hack fastpush 7.2 beta and feed back my changes to the fastpush author. No point in a howto for an unsupported ...

redge wrote:install only JRE 1.4.2_06 !
JRE 1.5 is so much slowly with UltraVNC !

JRE 1.4.2_07 is out now too.

Kevin wrote:How can this be pushed out in a domain environment with the MSLOGON groups intact ?

I use a modified version of VNC Fastpush 6.5, using Sysinternals' psexec to remotely run mslogonacl.exe on the target PC.

Rush off to http://java.sun.com and get JRE 1.5.0_02 and install it. Looks like you're using Microsoft's imitation Java rubbish.

That's it! "domain\user" or "machine\user" is working for me with authSSP_NT4.dll. It would be nice to assume first "machine" if only username is specified, and as a second try if there is no local account "user" to assume "domain". Maybe it's possible to use the registry-value "CachePrimaryDomain ...

Phew, glad it's not just me.

Phil

Well, almost there, but...

No more secur32.dll warnings but it still will not authenticate.

If file transfer is disabled on the server, then the file transfer button (and menu item) in VNCViewer should be grayed out. Does not the server report its capabilities when the viewer connects? The confusing message when you try is a pain in the neck, because you don't know without looking ...

Excellent!

Martin,

It still complains that it wants secur32.dll and doesn't authenticate, even with the latest AuthSSP.dll.

Sorry I wasn't clear about that,

Phil

Martin,

This still doesn't work with Rudi's latest pre-RC197 winvnc.exe builds. Should it?

Phil

Marscha wrote: aclui.dll is called with /delayload option to allow operation on NT4 and Win9x.

Does this mean that the security configuration manager is no longer needed on NT 4 boxes?

Thanks for the feedback. Currently this new ms-logon feature is not really integrated with the rest of ultravnc because - it is indeed very new - it is supposed to change further - there's very limited feedback until now Once it's more stable it will be integrated into the 'normal' releases :wink ...

You could peek at Mozilla's Bug 231529 which seeks to do the same thing

Yes, you should create the .zip in the windows temp directory (or user-nominated drive and directory). I personally think that any file transfer solution shouldn't do it that way, but should just copy unzipped files. The .zip way fails when the space used by the files copied (from server) exceeds ...

I use a slightly modified version of VNC fastpush - search these forums for fastpush and you'll get the idea.

Yes,

HKLM\Software\UltraVNC\mslogon

Any chance you could post your modified Fastpush script and reg-settings here? Have you fastpushed the video driver? If so, could you post that script too? Thanks. DC - Could you tell us a bit more about vncspread? A google search for it came up empty. I'd love to, but... The key thing is to copy ...

These might be in a help file or FAQ somewhere, but if so, I can't find the answers. If they are answered somewhere else, please tell me. 1) What is the purpose of the additional video driver? Is it installed on server, client, or both? 2) I had Windows logon working with RC11, but now it's not ...

Any chance you could post your modified Fastpush script and reg-settings here? Have you fastpushed the video driver? If so, could you post that script too? Thanks. DC - Could you tell us a bit more about vncspread? A google search for it came up empty. I'd love to, but... The key thing is to copy ...

I'm pushing out UltraVNC (without video driver) using FastPush. I had to modify the fastpush script to copy all the relevant files for ultravnc. I used the Windows Resource kit's reg.exe to export the registry keys involved to put in the default settings (hint, use regedit to search for both ORL and ...

Install good antivirus on all your PCs, make sure they are up to date. Fully patch all your boxes. And firewall your internet connection. Problem solved.

It is NOT UtraVNC's fault.

Optionally would be better. Some people may think that those registry changes are somewhat intrusive. The solution, if possible, is to do the following on a VNC-sent reboot request: 1: Save current values of those keys 2: Put something into the RunOnce on startup to restore those values (you could ...

I've seen that once on a Win 2003 server and I can't for the life of me remember what I did which solved it. I haven't seen it happen at all with the Test 18 WinVNC, mirror drivers, and latest viewer, even with RDP enabled on the server.

Phil