From 5247fb96294a35608ca5108c0a39704277e5f135 Mon Sep 17 00:00:00 2001 From: Jens Ahrensfeld Date: Fri, 31 May 2024 11:19:13 +0200 Subject: [PATCH] Initial commit --- Dockerfile | 52 +++++++++++++++++ README.md | 0 conf/turbovncserver-security.conf | 97 +++++++++++++++++++++++++++++++ conf/turbovncserver.conf | 74 +++++++++++++++++++++++ conf/xstartup.turbovnc | 12 ++++ 5 files changed, 235 insertions(+) create mode 100644 Dockerfile create mode 100644 README.md create mode 100644 conf/turbovncserver-security.conf create mode 100644 conf/turbovncserver.conf create mode 100755 conf/xstartup.turbovnc diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..a39354b --- /dev/null +++ b/Dockerfile @@ -0,0 +1,52 @@ +# syntax=docker/dockerfile:1 +FROM jayfield/debian-baseimage as base + +ENV PASSWORD=vnc4me + +# Build tools +RUN apt-get update && \ + apt-get -y install --no-install-recommends dbus-x11 x11-xkb-utils xkb-data && \ + apt-get -y install --no-install-recommends python3 && \ + apt-get -y install --no-install-recommends git make gcc build-essential && \ + apt-get -y install --no-install-recommends icewm && \ + apt-get -y install --no-install-recommends x11-apps && \ + apt-get -y install --no-install-recommends net-tools socat python3-numpy && \ + apt-get -y install --no-install-recommends xauth && \ + apt-get -y install --no-install-recommends openssl && \ + rm -rf /var/lib/apt/lists/* + +FROM base as build +ADD https://github.com/TurboVNC/turbovnc/releases/download/3.1.1/turbovnc_3.1.1_amd64.deb /tmp/ +ADD https://github.com/novnc/websockify.git /tmp/websockify +ADD https://github.com/novnc/noVNC.git /tmp/noVNC + +WORKDIR "/tmp" +RUN dpkg -i turbovnc_3.1.1_amd64.deb + +WORKDIR "/tmp/websockify" +RUN make -j4 + +ENV PATH=$PATH:/opt/TurboVNC/bin +RUN mkdir ~/.vnc/ +RUN echo $PASSWORD | vncpasswd -f > ~/.vnc/passwd +RUN chmod 0600 ~/.vnc/passwd + +COPY conf/xstartup.turbovnc /etc/ +COPY conf/turbovncserver-security.conf /etc/ +COPY conf/turbovncserver.conf /etc/ + +RUN chmod 0600 /etc/turbovncserver-security.conf + +# see also +# https://github.com/ich777/docker-novnc-baseimage + +# and: +# https://dunedlin.wordpress.com/2020/10/24/a-minimal-x11-install/ +# https://askubuntu.com/questions/1313445/how-do-i-install-vnc-on-a-headless-ubuntu-20-10 +# https://github.com/mviereck/x11docker/wiki/How-to-access-X-over-TCP-IP-network +# https://jaydenm.com/blog/docker-x11-desktop/ +# https://github.com/karinepires/docker-secure-vncserver/blob/master/Dockerfile +# https://github.com/theonemule/docker-opengl-turbovnc/blob/master/dockerfile + +# MESA +# https://docs.mesa3d.org/install.html diff --git a/README.md b/README.md new file mode 100644 index 0000000..e69de29 diff --git a/conf/turbovncserver-security.conf b/conf/turbovncserver-security.conf new file mode 100644 index 0000000..0c47c35 --- /dev/null +++ b/conf/turbovncserver-security.conf @@ -0,0 +1,97 @@ +# the PAM User/Password authentication method is used. +# (Default: user ACL is disabled) + +#enable-user-acl + +# This specifies the maximum desktop size for all TurboVNC sessions started on +# this host. If a user attempts to start a session with a larger geometry than +# this or to use remote desktop resizing to increase the desktop size to a size +# larger than this, the desktop size will be clamped to this width/height. + +#max-desktop-size = 3200x1800 + +# This specifies the maximum idle timeout (in seconds) for all TurboVNC +# sessions started on this host. The idle timeout is the amount of time that +# a TurboVNC session can remain idle (with no VNC viewer connections) before it +# will automatically exit. If this value is set to a number greater than 0, +# then all TurboVNC sessions on this host will use this idle timeout value by +# default, and the user will only be allowed to override it with a lower value. + +#max-idle-timeout = 86400 + +# Uncomment the following to globally disable the automatic sending of +# clipboard changes to TurboVNC sessions from their connected viewers. +# (Default: clipboard receiving is allowed) + +#no-clipboard-recv + +# Uncomment the following to globally disable the automatic sending of +# clipboard changes from TurboVNC sessions to their connected viewers. +# (Default: clipboard sending is allowed) + +#no-clipboard-send + +# Uncomment the following to globally disable creating/opening PAM sessions in +# all TurboVNC sessions started on this host. + +#no-pam-sessions + +# Uncomment the following to globally disable inbound remote connections to all +# TurboVNC sessions started on this host. This effectively forces SSH +# tunneling to be used for all inbound TurboVNC connections. +# (Default: inbound remote connections are allowed) + +#no-remote-connections + +# Uncomment the following to globally disable remote desktop resizing. +# (Default: remote desktop resizing is allowed) + +#no-remote-resize + +# Uncomment the following to globally disable the ability to make reverse +# VNC connections. +# (Default: reverse connections are allowed) + +#no-reverse-connections + +# Uncomment the following to globally disable X11 TCP connections to all +# TurboVNC sessions started on this host. + +#no-x11-tcp-connections + +# Set pam-service-name to the name of the PAM service that you will use to +# to process PAM User/Password authentications from TurboVNC. This service +# name typically corresponds to a file in /etc/pam.d or to one or more lines in +# /etc/pam.conf. +# (Default: turbovnc) + +#pam-service-name = turbovnc + +# Set the following to a colon-separated list of permitted TLS cipher suites +# for the TLS* and X509* security types. (Run 'openssl ciphers aNULL' for a +# list of possible options for the TLS* security types, and 'openssl ciphers' +# for a list of possible options for the X509* security types.) This directive +# also controls the order in which the cipher suites are advertised to the VNC +# viewer. +# (Default: allow any cipher suite supported by the host's OpenSSL +# implementation) + +#permitted-cipher-suites = + +# Set the following to any combination of "TLSVnc", "TLSOtp", "TLSPlain", +# "TLSNone", "X509Vnc", "X509Otp", "X509Plain", "X509None", "VNC", "OTP", +# "UnixLogin", "Plain", or "None", separated by commas (security types are +# case-insensitive.) If the following directive is enabled and a particular +# security type is not listed in it, then users cannot enable that security +# type by using Xvnc command-line arguments. This directive also controls the +# order in which the corresponding authentication capabilities are advertised +# to the VNC viewer. See the man pages and User's Guide for more information. +# (Default: TLSVnc, TLSOtp, TLSPlain, TLSNone, X509Vnc, X509Otp, X509Plain, X509None, VNC, OTP, UnixLogin, Plain, None) + +#permitted-security-types = TLSVnc, TLSOtp, TLSPlain, X509Vnc, X509Otp, X509Plain, VNC, OTP, UnixLogin, Plain +permitted-security-types = none +# This specifies the length of the key, in bits, that the TurboVNC Server will +# generate for any of the TLS* (anonymous TLS) security types. +# (Default: 2048) + +#tls-key-length = 2048 diff --git a/conf/turbovncserver.conf b/conf/turbovncserver.conf new file mode 100644 index 0000000..064d8be --- /dev/null +++ b/conf/turbovncserver.conf @@ -0,0 +1,74 @@ +## +## Configuration of the TurboVNC Server. +## +## This file uses Perl syntax, although only one-line assignments +## are allowed. Assignments can be applied to the following variables: +## +## $geometry -- desktop geometry, WIDTHxHEIGHT or +## W0xH0+X0+Y0[,W1xH1+X1+Y1,...,WnxHn+Xn+Yn] +## $depth -- color depth in bits per pixel (between 8 and 32) +## $desktopName -- X desktop name +## $vncUserDir -- path to TurboVNC user directory (session information, +## VNC passwords, and log files are stored here) +## $fontPath -- X font path +## $securityTypes -- comma-separated list of security types to enable +## (passed to Xvnc in the -securitytypes argument) +## $generateOTP -- 1 to generate an initial one-time password. (OTP +## authentication must be enabled and permitted) +## $wm -- the window manager to use (for instance, "mate" or "2d".) +## This variable is ignored if $xstartup or $noxstartup is +## specified. +## $useVGL -- 1 to run the window manager using VirtualGL. This variable +## is ignored if $xstartup or $noxstartup is specified. +## $autokill -- 1 to automatically kill the TurboVNC session when the +## X startup script finishes or 0 to leave it running +## $noVNC -- directory containing noVNC +## $passwdFile -- path to VNC password file to use with VNC Password +## authentication +## $x509CertFile -- path to X.509 signed certificate file (in PEM format) to +## use with X.509 encryption +## $x509KeyFile -- path to X.509 private key file (in PEM format) to use with +## X.509 encryption +## $xstartup -- path to alternative X startup script +## $noxstartup -- 1 to start the TurboVNC session with no X startup script +## $serverArgs -- additional arguments to pass to Xvnc (refer to the Xvnc man +## page for a list of accepted arguments) +## $useUDS -- listen on a Unix domain socket rather than a TCP port for +## connections from VNC viewers +## + +## These settings are the default. Uncomment and edit to change. +# +# $geometry = "1240x900"; +# $depth = 24; +# $desktopName = "TurboVNC ($ENV{USER})"; +# $vncUserDir = "$ENV{HOME}/.vnc"; +# $fontPath = ""; +# $securityTypes = "TLSVnc, TLSOtp, TLSPlain, X509Vnc, X509Otp, X509Plain, VNC, OTP, UnixLogin, Plain"; +# $generateOTP = 0; +# $wm = ""; +# $useVGL = 0; +# $autokill = 1; +# $noVNC = ""; +# $xstartup = "${exedir}xstartup.turbovnc"; +# $noxstartup = 0; +# $serverArgs = ""; +# $useUDS = 0; + +## Here is an example of setting the font path: +# +# $fontPath = "/usr/lib/X11/fonts/misc/" +# $fontPath = "$fontPath,/usr/lib/X11/fonts/75dpi/"; + +## You might wish to create the TurboVNC user directories under /tmp, to +## ensure that VNC passwords are always kept on the local filesystem. To do +## that, uncomment the line below. Note that in this case, Xvnc will search +## for the .Xauthority file in this same directory by default. +# +# $vncUserDir = "/tmp/$ENV{USER}-vnc"; + +## These settings are the default. Uncomment and edit to change. +# +# $passwdFile = "$vncUserDir/passwd"; +# $x509CertFile = "$vncUserDir/x509_cert.pem"; +# $x509KeyFile = "$vncUserDir/x509_private.pem"; diff --git a/conf/xstartup.turbovnc b/conf/xstartup.turbovnc new file mode 100755 index 0000000..f9acbc6 --- /dev/null +++ b/conf/xstartup.turbovnc @@ -0,0 +1,12 @@ +#!/bin/sh + +unset SESSION_MANAGER +unset DBUS_SESSION_BUS_ADDRESS +XDG_SESSION_TYPE=x11; export XDG_SESSION_TYPE +/usr/bin/icewm-session& + +# Do NOT use 3D unity on Ubuntu 16.10 +export TVNC_WM=2d + +# Start the window manager under VGL so that we always get acceleration +export TVNC_VGL=0