我在 Lubuntu 18.04 上安装了 vino VNC 服务器，并按照https://askubuntu.com/a/530196/1471：
$ export DISPLAY=:0
$ gsettings set org.gnome.Vino enabled true # although fails, it doesn't matter
No such key “enabled”
$ gsettings set org.gnome.Vino prompt-enabled false
$ gsettings set org.gnome.Vino require-encryption false
$ /usr/lib/vino/vino-server
https://www.cl.cam.ac.uk/research/dtg/attarchive/vnc/sshvnc.html说
VNC 使用随机质询-响应系统来提供基本验证允许您连接到 VNC 服务器。这相当安全；密码不会通过网络发送。但是，一旦您连接，查看器和服务器之间的流量未加密，可能会被有权访问中间网络的人窥探。因此，如果安全性对您来说很重要，我们建议您通过某些更安全的通道（如 SSH）“隧道化” VNC 协议。
vino VNC 服务器是否使用质询-响应方法对客户端进行身份验证，而不是传输密码？
我可以从端口 5900 连接到服务器RealVNC 的 VNC 查看器在同一个 WIFI 网络内的 Android 手机上，我只被要求提供一个密码，我以为这是用于登录 Lubuntu 的密码。
开头的引文说 VNC 使用质询-响应系统，不传输密码，那么我必须提供密码是否意味着 VNC 服务器会传输密码而不是使用质询-响应系统？如果它使用质询-响应系统，为什么我必须提供密码？
在以下服务端的监控输出消息中，我发现了以下可疑的客户端
46.101.184.149，zg-0817a-64.stretchoid.com，196.52.43.118， 和scan-06.shadowserver.org。他们是否成功连接到我的 vino VNC 服务器，并且是否通过了身份验证？由于开头的引文说 VNC 使用质询响应系统，并且不传输密码，如果可疑客户端已通过身份验证，他们如何找到密码？通过测试每个密码登录并碰运气？
如果可疑客户端没有尝试登录，而只是窥探了查看器和服务器之间的流量，那么服务器是否应该不知道这些客户端的存在？
谢谢。
$ /usr/lib/vino/vino-server
(vino-server:32529): dbind-WARNING **: 19:44:12.185: Error retrieving accessibility bus address: org.freedesktop.DBus.Error.ServiceUnknown: The name org.a11y.Bus was not provided by any .service files
19/08/2018 07:44:12 PM Autoprobing TCP port in (all) network interface
19/08/2018 07:44:12 PM Listening IPv6://[::]:5900
19/08/2018 07:44:12 PM Listening IPv4://0.0.0.0:5900
19/08/2018 07:44:12 PM Autoprobing selected port 5900
19/08/2018 07:44:12 PM Advertising security type: 'TLS' (18)
19/08/2018 07:44:12 PM Re-binding socket to listen for VNC connections on TCP port 5900 in (all) interface
19/08/2018 07:44:12 PM Listening IPv6://[::]:5900
19/08/2018 07:44:12 PM Listening IPv4://0.0.0.0:5900
19/08/2018 07:44:12 PM Clearing securityTypes
19/08/2018 07:44:12 PM Advertising security type: 'TLS' (18)
19/08/2018 07:44:12 PM Clearing securityTypes
19/08/2018 07:44:12 PM Advertising security type: 'TLS' (18)
19/08/2018 07:44:12 PM Advertising authentication type: 'No Authentication' (1)
19/08/2018 07:44:12 PM Re-binding socket to listen for VNC connections on TCP port 5900 in (all) interface
19/08/2018 07:44:12 PM Listening IPv6://[::]:5900
19/08/2018 07:44:12 PM Listening IPv4://0.0.0.0:5900
19/08/2018 07:44:12 PM Clearing securityTypes
19/08/2018 07:44:12 PM Clearing authTypes
19/08/2018 07:44:12 PM Advertising security type: 'TLS' (18)
19/08/2018 07:44:12 PM Advertising authentication type: 'VNC Authentication' (2)
19/08/2018 07:44:12 PM Clearing securityTypes
19/08/2018 07:44:12 PM Clearing authTypes
19/08/2018 07:44:12 PM Advertising security type: 'TLS' (18)
19/08/2018 07:44:12 PM Advertising authentication type: 'VNC Authentication' (2)
19/08/2018 07:44:12 PM Advertising security type: 'VNC Authentication' (2)
19/08/2018 07:44:17 PM [IPv4] Got connection from client android-c28b29b650f6548c.home
19/08/2018 07:44:17 PM other clients:
19/08/2018 07:44:17 PM Client Protocol Version 3.7
19/08/2018 07:44:17 PM Advertising security type 18
19/08/2018 07:44:17 PM Advertising security type 2
19/08/2018 07:44:17 PM Client returned security type 2
** (vino-server:32529): WARNING **: 19:44:28.888: VNC authentication failure from 'android-c28b29b650f6548c.home'
19/08/2018 07:44:28 PM rfbAuthPasswordChecked: password check failed
19/08/2018 07:44:28 PM Client android-c28b29b650f6548c.home gone
19/08/2018 07:44:28 PM Statistics:
19/08/2018 07:44:28 PM framebuffer updates 0, rectangles 0, bytes 0
19/08/2018 07:44:30 PM [IPv4] Got connection from client android-c28b29b650f6548c.home
19/08/2018 07:44:30 PM other clients:
19/08/2018 07:44:30 PM Client Protocol Version 3.7
19/08/2018 07:44:30 PM Advertising security type 18
19/08/2018 07:44:30 PM Advertising security type 2
19/08/2018 07:44:30 PM Client returned security type 2
** (vino-server:32529): WARNING **: 19:44:40.531: Deferring authentication of 'android-c28b29b650f6548c.home' for 5 seconds
19/08/2018 07:44:45 PM rfbProcessClientNormalMessage: ignoring unknown encoding type 22
19/08/2018 07:44:45 PM rfbProcessClientNormalMessage: ignoring unknown encoding type 21
19/08/2018 07:44:45 PM rfbProcessClientNormalMessage: ignoring unknown encoding type 15
19/08/2018 07:44:45 PM rfbProcessClientNormalMessage: ignoring unknown encoding type -314
19/08/2018 07:44:45 PM Enabling NewFBSize protocol extension for client android-c28b29b650f6548c.home
19/08/2018 07:44:45 PM Pixel format for client android-c28b29b650f6548c.home:
19/08/2018 07:44:45 PM 8 bpp, depth 6
19/08/2018 07:44:45 PM true colour: max r 3 g 3 b 3, shift r 4 g 2 b 0
19/08/2018 07:44:45 PM Pixel format for client android-c28b29b650f6548c.home:
19/08/2018 07:44:45 PM 32 bpp, depth 24, little endian
19/08/2018 07:44:45 PM true colour: max r 255 g 255 b 255, shift r 16 g 8 b 0
19/08/2018 07:44:45 PM no translation needed
Gtk-Message: 20:43:41.511: GtkDialog mapped without a transient parent. This is discouraged.
Gtk-Message: 20:43:44.339: GtkDialog mapped without a transient parent. This is discouraged.
Gtk-Message: 20:43:52.072: GtkDialog mapped without a transient parent. This is discouraged.
19/08/2018 10:39:57 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:39:57 PM other clients:
19/08/2018 10:39:57 PM android-c28b29b650f6548c.home
19/08/2018 10:39:57 PM Client Protocol Version 3.3
** (vino-server:32529): WARNING **: 22:39:57.238: VNC authentication failure from '46.101.184.149'
19/08/2018 10:39:57 PM rfbAuthPasswordChecked: password check failed
19/08/2018 10:39:57 PM Client 46.101.184.149 gone
19/08/2018 10:39:57 PM Statistics:
19/08/2018 10:39:57 PM framebuffer updates 0, rectangles 0, bytes 0
19/08/2018 10:43:41 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:43:41 PM other clients:
19/08/2018 10:43:41 PM android-c28b29b650f6548c.home
19/08/2018 10:43:41 PM Client Protocol Version 3.3
** (vino-server:32529): WARNING **: 22:43:41.812: Deferring authentication of '46.101.184.149' for 5 seconds
** (vino-server:32529): WARNING **: 22:43:47.449: VNC authentication failure from '46.101.184.149'
19/08/2018 10:43:47 PM rfbAuthPasswordChecked: password check failed
19/08/2018 10:47:27 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:47:27 PM other clients:
19/08/2018 10:47:27 PM 46.101.184.149
19/08/2018 10:47:27 PM android-c28b29b650f6548c.home
19/08/2018 10:47:27 PM Client Protocol Version 3.3
** (vino-server:32529): WARNING **: 22:47:27.692: Deferring authentication of '46.101.184.149' for 5 seconds
** (vino-server:32529): WARNING **: 22:47:32.452: VNC authentication failure from '46.101.184.149'
19/08/2018 10:47:32 PM rfbAuthPasswordChecked: password check failed
19/08/2018 10:51:12 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:51:12 PM other clients:
19/08/2018 10:51:12 PM 46.101.184.149
19/08/2018 10:51:12 PM 46.101.184.149
19/08/2018 10:51:12 PM android-c28b29b650f6548c.home
19/08/2018 10:51:12 PM Client Protocol Version 3.3
** (vino-server:32529): WARNING **: 22:51:12.833: Deferring authentication of '46.101.184.149' for 5 seconds
** (vino-server:32529): WARNING **: 22:51:18.448: VNC authentication failure from '46.101.184.149'
19/08/2018 10:51:18 PM rfbAuthPasswordChecked: password check failed
19/08/2018 10:54:58 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:54:58 PM other clients:
19/08/2018 10:54:58 PM 46.101.184.149
19/08/2018 10:54:58 PM 46.101.184.149
19/08/2018 10:54:58 PM 46.101.184.149
19/08/2018 10:54:58 PM android-c28b29b650f6548c.home
19/08/2018 10:54:58 PM Client Protocol Version 3.3
** (vino-server:32529): WARNING **: 22:54:58.339: Deferring authentication of '46.101.184.149' for 5 seconds
** (vino-server:32529): WARNING **: 22:55:03.449: VNC authentication failure from '46.101.184.149'
19/08/2018 10:55:03 PM rfbAuthPasswordChecked: password check failed
19/08/2018 10:58:43 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:58:43 PM other clients:
19/08/2018 10:58:43 PM 46.101.184.149
19/08/2018 10:58:43 PM 46.101.184.149
19/08/2018 10:58:43 PM 46.101.184.149
19/08/2018 10:58:43 PM 46.101.184.149
19/08/2018 10:58:43 PM android-c28b29b650f6548c.home
19/08/2018 10:58:43 PM Client Protocol Version 3.3
** (vino-server:32529): WARNING **: 22:58:43.756: Deferring authentication of '46.101.184.149' for 5 seconds
** (vino-server:32529): WARNING **: 22:58:49.448: VNC authentication failure from '46.101.184.149'
19/08/2018 10:58:49 PM rfbAuthPasswordChecked: password check failed
19/08/2018 11:02:28 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 11:02:28 PM other clients:
19/08/2018 11:02:28 PM 46.101.184.149
19/08/2018 11:02:28 PM 46.101.184.149
19/08/2018 11:02:28 PM 46.101.184.149
19/08/2018 11:02:28 PM 46.101.184.149
19/08/2018 11:02:28 PM 46.101.184.149
19/08/2018 11:02:28 PM android-c28b29b650f6548c.home
19/08/2018 11:02:28 PM Client Protocol Version 3.3
** (vino-server:32529): WARNING **: 23:02:28.345: Deferring authentication of '46.101.184.149' for 5 seconds
** (vino-server:32529): WARNING **: 23:02:33.449: VNC authentication failure from '46.101.184.149'
19/08/2018 11:02:33 PM rfbAuthPasswordChecked: password check failed
19/08/2018 11:30:51 PM [IPv4] Got connection from client zg-0817a-64.stretchoid.com
19/08/2018 11:30:51 PM other clients:
19/08/2018 11:30:51 PM 46.101.184.149
19/08/2018 11:30:51 PM 46.101.184.149
19/08/2018 11:30:51 PM 46.101.184.149
19/08/2018 11:30:51 PM 46.101.184.149
19/08/2018 11:30:51 PM 46.101.184.149
19/08/2018 11:30:51 PM 46.101.184.149
19/08/2018 11:30:51 PM android-c28b29b650f6548c.home
19/08/2018 11:31:01 PM rfbProcessClientProtocolVersion: client gone
19/08/2018 11:31:01 PM Client zg-0817a-64.stretchoid.com gone
19/08/2018 11:31:01 PM Statistics:
19/08/2018 11:31:01 PM framebuffer updates 0, rectangles 0, bytes 0
sendto: Network is unreachable
sendto: Network is unreachable
20/08/2018 10:37:54 AM rfbProcessClientNormalMessage: read: Connection reset by peer
20/08/2018 10:37:54 AM Client android-c28b29b650f6548c.home gone
20/08/2018 10:37:54 AM Statistics:
20/08/2018 10:37:54 AM key events received 32, pointer events 3932
20/08/2018 10:37:54 AM framebuffer updates 7016, rectangles 13714, bytes 270216867
20/08/2018 10:37:54 AM ZRLE rectangles 13714, bytes 270216867
20/08/2018 10:37:54 AM raw bytes equivalent 538553044, compression ratio 1.993040
20/08/2018 02:15:10 PM [IPv4] Got connection from client 196.52.43.118
20/08/2018 02:15:10 PM other clients:
20/08/2018 02:15:10 PM 46.101.184.149
20/08/2018 02:15:10 PM 46.101.184.149
20/08/2018 02:15:10 PM 46.101.184.149
20/08/2018 02:15:10 PM 46.101.184.149
20/08/2018 02:15:10 PM 46.101.184.149
20/08/2018 02:15:10 PM 46.101.184.149
20/08/2018 02:15:10 PM Client Protocol Version 3.7
20/08/2018 02:15:10 PM Advertising security type 18
20/08/2018 02:15:10 PM Advertising security type 2
20/08/2018 02:15:10 PM Client returned security type 1
20/08/2018 02:15:10 PM rfbAuthProcessSecurityTypeMessage: client returned unadvertised security type 1
20/08/2018 02:15:10 PM Client 196.52.43.118 gone
20/08/2018 02:15:10 PM Statistics:
20/08/2018 02:15:10 PM framebuffer updates 0, rectangles 0, bytes 0
20/08/2018 02:31:26 PM [IPv4] Got connection from client scan-06.shadowserver.org
20/08/2018 02:31:26 PM other clients:
20/08/2018 02:31:26 PM 46.101.184.149
20/08/2018 02:31:26 PM 46.101.184.149
20/08/2018 02:31:26 PM 46.101.184.149
20/08/2018 02:31:26 PM 46.101.184.149
20/08/2018 02:31:26 PM 46.101.184.149
20/08/2018 02:31:26 PM 46.101.184.149
20/08/2018 02:31:28 PM rfbProcessClientProtocolVersion: client gone
20/08/2018 02:31:28 PM Client scan-06.shadowserver.org gone
20/08/2018 02:31:28 PM Statistics:
20/08/2018 02:31:28 PM framebuffer updates 0, rectangles 0, bytes 0
答案1
“我可以通过端口 5900 连接到服务器”
这可以解释为什么其他系统也可以，没有软件防火墙限制在服务器本身上这会阻止与该端口/服务的连接。
要解释远程客户端如何连接，这取决于您的网络设置。如果 Ubuntu 服务器没有公共互联网 IP 地址，例如在家庭环境中，您仍可能在 NAT 路由器上设置端口转发，将其配置为 DMZ 主机，或者
您的路由器和 vino 服务器都支持 uPnP，并且您的服务器指示您的路由器打开并转发必要的端口。
我的 VNC 服务器存在什么样的安全问题？
它接受传入的互联网连接。
乍一看，没有什么比这更关键的了。