VNC¶
This chapter contains an example of a basic Wheel Fudo PAM configuration, to monitor VNC access to a remote server.
In this scenario, the user connects to the remote server over the VNC protocol and logs in to the Wheel Fudo PAM using an individual login and password combination (john_smith
/john
). When establishing the connection with the remote server, Wheel Fudo PAM substitutes the password with the previously defined value: password
(authentication modes are described in the User authentication modes section).
Note
Due to specifics of VNC protocol, which authenticates the user using password only, the substitution login string entered in account properties is ignored when establishing a VNC connection.
![../../_images/quickstart_overview_vnc.png](../../_images/quickstart_overview_vnc.png)
Prerequisites¶
Description below assumes that the system has been already initiated. The initiation procedure is described in the System initiation topic.
Configuration¶
![../../_images/data_modeling1.png](../../_images/data_modeling1.png)
Adding a server
is a definition of the IT infrastructure resource, which can be accessed over one of the specified protocols.
- Select > .
- Click .
- Provide essential configuration parameters:
Parameter | Value |
---|---|
General | |
Name | vnc_server |
Blocked | ![]() |
Protocol | VNC |
Description | ![]() |
Permissions | |
Granted users | ![]() |
Destination host | |
Address | 10.0.40.230 |
Port | 5900 |
- Click .
Adding a user
User defines a subject entitled to connect to servers within monitored IT infrastructure. Detailed object definition (i.e. unique login and domain combination, full name, email address etc.) enables precise accountability of user actions when login and password are substituted with a shared account login credentials.
- Select > .
- Click .
- Provide essential user information:
Parameter | Value |
---|---|
General | |
Login | john_smith |
Blocked | ![]() |
Account validity | Indefinite |
Role | user |
Preferred language | English |
Safes | default settings |
Full name | John Smith |
john@smith.com |
|
Organization | ![]() |
Phone | ![]() |
AD Domain | ![]() |
LDAP Base | ![]() |
Permissions | |
Granted users | ![]() |
Authentication | |
Type | Password |
Password | john |
Repeat password | john |
- Click .
Adding a listener
determines server connection mode (proxy, gateway, transparent, bastion) as well as its specifics.
- Select > .
- Click .
- Provide essential configuration parameters:
Parameter | Value |
---|---|
General | |
Name | vnc_listener |
Blocked | ![]() |
Protocol | VNC |
Permissions | |
Granted users | ![]() |
Connection | |
Mode | proxy |
Local address | 10.0.150.151 |
Port | 5900 |
- Click .
Adding an account
defines the privileged account existing on the monitored server. It specifies the actual login credentials, user authentication mode: anonymous (without user authentication), regular (with login credentials substitution) or forward (with login and password forwarding); password changing policy as well as the password changer itself.
- Select > .
- Click .
- Provide essential configuration parameters:
Parameter | Value |
---|---|
General | |
Name | admin_vnc_server |
Account type | regular |
Session recording | complete |
OCR sessions | ![]() |
Delete session data after | 61 days |
Permissions | |
Granted users | ![]() |
Server | |
Server | vnc_server |
Credentials | |
Domain | ![]() |
Login | ![]() |
Replace secret with | with password |
Password | root |
Repeat password | root |
Password change policy | Static, without restrictions |
Password changer | |
Password changer | None |
Privileged user | ![]() |
Privileged user password | ![]() |
- Click .
Defining a safe
directly regulates user access to monitored servers. It specifies available protocols’ features, policies and other details concerning users and servers relations.
- Select > .
- Click .
- Provide essential configuration parameters:
Parameter | Value |
---|---|
General | |
Name | vnc_safe |
Notifications | ![]() |
Ask for login reason | ![]() |
Policies | ![]() |
Users | john_smith |
Protocol functionality | |
RDP | ![]() |
SSH | ![]() |
VNC | ![]() |
Accounts | |
admin_vnc_server |
vnc_listener |
- Click .
Establishing connection¶
- Launch VNC Viewer, enter
10.0.150.151
in the server address field and press the enter key.
![../../_images/vnc_viewer_1.png](../../_images/vnc_viewer_1.png)
- Enter username and password and press the enter key.
![../../_images/vnc_viewer_2.png](../../_images/vnc_viewer_2.png)
![../../_images/vnc_viewer_3.png](../../_images/vnc_viewer_3.png)
Viewing user session¶
- Open a web browser and go to the
10.0.150.151
web address. - Enter the login and password to login to the Wheel Fudo PAM administration panel.
- Select > .
- Click .
- Find John Smith’s session and click i.
![../../_images/vnc_ongoing.png](../../_images/vnc_ongoing.png)
Related topics: