Vnc Password

[flochi1]

I know that vnc password can easily be cracked(it is stored in ultravnc.ini).
Is there an method to beter secure it?

[Rudi De Vos]

[v] non portable password make it more secure.
It can only be cracked with a tool running on that pc.
Using the encryption plugins you can set
-a long passwd
- use a public/private key pair.

[flochi1]

[v] non portable password make it more secure.

this works great indeed but we cant automate it. We create the response file and everything is ok.

Can we set this after deployment automatically ? silent?

We are using SCCM to deploy.

[flochi1]

So my question is say that vnc is already installed can you send a command or modify the regristry or something like that to set up that [v] non portable password make it more secure.

[Rudi De Vos]

There is no tool.

Fast created one.
createpassword [-secure] mypassword
Need to be executed in the ultravnc.ini folder
1) set secure to 1
2) set secure password

Warning: code differ on 32/64bit.
You need to use 64bit when winvnc.exe is 64bit

It was never made to be cross plaform compatible, your deployment tool need to check the vnc installed version (32/64)

try it first om some local 32/64... NOT fully tested.

http://www.uvnc.eu/download/133/createpassword.zip

My virus checker doesn't like the zip... createpasswd...checking
Seem ok now, needed to sign the exe

[flochi1]

it works.

thank you!

[esc]

I knew the password was in an .ini file but didn't know it could be decoded that easily. If this is the case, there should be a large text informing about it.

I understand that you can enable the only plugin SecureVNCPlugin64.dsm but is it safe?

Why does the program not use this plug-in by default after installation?

[Rudi De Vos]

You can
-activate []non portable password, then the password isn't portable and only works on that pc.
-activate the plugin and set a long password
-activate the plugin and use prive/public keys...

The simple vnc password is the default authentication. It's portable and work with all vnc flavors.

The password is in the ini file and there are tools that allow to decrypt them.
Even if we would make it more complex, there would still be tools who does it.
You even can decode the OS admin password i you get access to the disk.

If you allow other people disk access nothing is safe.

[Bonji]

I knew the password was in an .ini file but didn't know it could be decoded that easily. If this is the case, there should be a large text informing about it.

I understand that you can enable the only plugin SecureVNCPlugin64.dsm but is it safe?

Why does the program not use this plug-in by default after installation?

Part of using/supporting software is being informed about its origin and current state of development. VNC was created in the late 90s, and its priority was connectivity. Security from that day just doesn't hold up now, but the original mechanism is left in place because all flavors of VNC support it as a minimal level of compatibility. You'll notice any version of VNC (configured simply) can connect to any other version of VNC. This is its power, but you have to be aware of the consequences if you use it in its native state.

UltraVNC is one of the best versions because of how extensible it is which allows these original flaws to be overcome. The Secure plugin with MSLogon authentication completely negates the original password limitations. This tool isn't meant for computer novices (imo), so understanding its components and capabilities is important in deploying it securely and successfully.