Starting VNC server under unprivileged user as service.

kfmut

Hi,

I would like to run VNC server(TigerVNC 1.9.0 package) on my headless NetBSD 9.1 setup, it should work under a single unprivileged user and have the same screen for all incoming connections.

For now it’s working if I connect via ssh and start VNC through vncserver script. But if I start it through inetd it starts with a blank screen without any window manager. But I can run apps on those virtual screen specifying display for them like “xterm -display :0”

5900 stream tcp wait netbsd /usr/pkg/bin/Xvnc Xvnc -inetd -PasswordFile=/home/netbsd/.vnc/passwd

Some guides state that Xvnc should read /etc/X11/xinit/xinitrc startup script but it’s not. I’ve tried to search for solutions in TigerVNC github but they have a new version(1.11.0 I believe) of server which is not using vncserver script at all and issue tracker is literally flooded with “blank screen” problem and I was unable to find any relevant information myself. So I’m asking for community help 😄

PS NetBSD host isn’t exposed to to any hostile networks and host security isn’t an issue, .vnc/passwd method is perfectly sufficient

JuvenalUrbino

kfmut But if I start it through inetd it starts with a blank screen without any window manager

That's because, unlike vncserver (which itself is a perl wrapper around Xvnc), Xvnc doesn't read the ~/.vnc/xstartup script –much less /etc/X11/xinit/xinitrc– resulting in a empty X session. As far as I know, Xvnc by default expects a running display manager configured to respond to incoming requests and allow remote sessions via XDMCP .

For my Rpi3, I wrote a vncserver rc(8) service script which starts a standard Xvnc server for a single, dedicated (with restricted class capabilities set in login.conf), unprivileged user upon boot:

#!/bin/sh

# PROVIDE: vncserver
# REQUIRE: NETWORKING SERVERS DAEMON LOGIN
# KEYWORD: shutdown

$_rc_subr_loaded . /etc/rc.subr
 
name=vncserver
rcvar=$name

VNCSERVER=/usr/pkg/bin/vncserver

load_rc_config $name
vncdir="/home/vnc/.vnc"
required_files="${vncdir}/passwd ${vncdir}/xstartup"
start_cmd="vncserver_start"
stop_cmd="vncserver_stop"

: ${vncserver_user="vnc"}
: ${vncserver_display="1"}
: ${vncserver_depth="24"}
: ${vncserver_geometry="1024x768"}

vncserver_start()
{
  CMD="$VNCSERVER -depth ${vncserver_depth} -geometry ${vncserver_geometry} :${vncserver_display}"
  su -l ${vncserver_user} -c "${CMD}"
}

vncserver_stop()
{
  CMD="$VNCSERVER -kill :${vncserver_display}"
  su -l ${vncserver_user} -c "${CMD}"
}

run_rc_command "$1"

Put it in /etc/rc.d, change its permissions to 555 and have it started:

$ echo vncserver=YES >> /etc/rc.conf
$ service vncserver start

Make sure a suitable TERM definition is set system-wide in /etc/profile, otherwise tset shall prompt you to interactively provide one. Also, the service requires ~/.vnc/passwd and ~/.vnc/xstartup to be present and readable; my ~/.vnc/xstartup:

PATH=/bin:/usr/bin:/usr/X11R7/bin:/usr/pkg/sbin:/usr/local/bin
unset SESSION_MANAGER.
unset DBUS_SESSION_BUS_ADDRESS
LC_LANG="en_US.UTF-8"; export LC_LANG
LC_CTYPE="en_US.UTF-8"; export LC_CTYPE
setxkpmap it
xsetroot -grey
xset m 55/20 4
xset r rate 250 40
xset +fp /usr/pkg/share/fonts/X11/artwiz-aleczapka/
xset +fp /usr/pkg/share/fonts/X11/Dina/
xrdb ${HOME}/.Xresources
xmodmap ${HOME}/.xmodmap
xclock &
xload &
ctwm -W &

kfmut PS NetBSD host isn’t exposed to to any hostile networks and host security isn’t an issue, .vnc/passwd method is perfectly sufficient

You may want to additionally configure a npf(7) firewall to allow incoming VNC connections on local network only and reject everything else.

$NIC = ifaddrs(<your network interface here>)
$LAN = { 192.168.1.1/24 }
alg "icmp"

group default {
    pass final on lo0 all
    pass stateful out final all
    pass stateful in final proto tcp from $LAN to $NIC port 5901 
    block return in final all
}

kfmut

JuvenalUrbino Thanks a lot for such an elaborate answer! Was also thinking about using vncserver script in rc.d service but for some reason was thinking that using su isn't OK for that 🤔

JuvenalUrbino

kfmut Was also thinking about using vncserver script in rc.d service but for some reason was thinking that using su isn't OK for that 🤔

Why? Truthfully speaking, su is invoked by the rc.subr(8) script to change the process ownership to that of the unprivileged user optionally specified by the $name_user variable within the service script (providing $name_chroot hasn't been given at the same time, they're mutually exclusive); have a look at rc.subr sources.

The rationale behind using a su hook to start/stop the service in place of a standard $name_user variable is that $name_user defaults to su -m, as opposed to su -l. The latter simulates a full login, by discarding root's environment –which is why I recommended you to define TERM capabilities system-wide– changing the working directory to target's HOME and setting the PATH to that of target's login class, as defined in /etc/login.conf.

vncserver needs to be started from user's home in order to detect the ~/.vnc dir and create a session-specific process pid with proper ownership/permissions (for this reason I didn't define/check a process pid in my service script, normally one would have it set to /var/run/{name}.pid). It also requires xauth (which on NetBSD resides at /usr/X11R7/bin) to be found within the PATH. If started with su -m vncserver shall attempt (and fail) to create a .vnc dir at /.

kfmut

JuvenalUrbino didn't get that part with colon builtin command in parameters assignment but everything seems working fine. Thank you!

JuvenalUrbino

kfmut didn't get that part with colon builtin command in parameters assignment but everything seems working fine. Thank you!

passing a ${parameter=word} PE as an argument to the colon builtin command means that the default interpreter should expand and assign word to parameter if the latter was unset (not null), and is equivalent to:

if [ -z "${parameter}" ]; then
    parameter="word"
fi

In other words it assigns a default value when the parameter was unset:

$ unset VAR
$ : ${VAR=x}
$ echo $VAR 
x
$ VAR=y
$ : ${VAR=x}
$ echo $VAR 
y

kfmut

JuvenalUrbino so it's same as:
${parameter:=word}
???

JuvenalUrbino

kfmut ${parameter:=word}

slightly different, without the colon an empty string is an accepted value for the parameter (in our case the vncserver already provides default options); from sh(1):

 In the parameter expansions shown previously, use of the colon in the
 format results in a test for a parameter that is unset or null; omission
 of the colon results in a test for a parameter that is only unset.

kfmut

JuvenalUrbino oops missed that in man sh 🤔 Thank you for clarification!

kfmut

And a small question: are there any official publications about correct usage of /etc/rc.conf.d directory for rc.d scripts overrides?

JuvenalUrbino

kfmut are there any official publications about correct usage of /etc/rc.conf.d directory for rc.d scripts overrides?

the basics are covered inside The Design and Implementation of the NetBSD rc.d system; but really, it's as easy as putting the relevant service-specific overrides (e.g. $rcvar_flags="...") in a readable file at /etc/rc.conf.d and name it after the service name 😉

kfmut

JuvenalUrbino it's quite convenient, thank you! Looks like in those overrides I could also disable or enable services instead of rc.conf.