Tools to remote into Linux Environments

#yum groupinstall 'GNOME Desktop Environment' 'X Window System'

1) VNC

x11vnc – simples of this 3 methods to get remote access. VNC stands for Virtual Network Computing) is a very useful network graphics protocol

Perhaps you need to enable EPEL (Extra Packages for Enterprise Linux) repository. Run

#yum -y install epel-release

Now we can install x11vnc. This command will install server and solve all dependencies

#yum -y install x11vnc

Then we will protect server with password:

# x11vnc -storepasswd

Enter VNC password:

Verify password:

Write password to /root/.vnc/passwd? [y]/n y

Password written to: /root/.vnc/passwd

!Do not use simple password!

We ready to start server:

# x11vnc --reopen --forever -rfbauth ~/.vncpasswd &

You can check if servers started:

    #netstat -an | grep 5900

    tcp 0 0 0.0.0.0:5900 0.0.0.0:* LISTEN

    tcp6 0 0 :::5900 :::* LISTEN

    If its ok, simply try to connect to it using vncviewer.
    #yum -y install vnc
    #vncviewer YOUR_SERVER_IP

That's all! Now you have access to your desktop. After reboot just ssh again and do again

    x11vnc --reopen --forever -rfbauth ~/.vncpasswd &

2) Tigervnc server

Tigervnc - is a high-performance, platform-neutral implementation of VNC

   #yum install -y tigervnc-server

Lets copy example config and edit it:

    #cp /lib/systemd/system/vncserver@.service /etc/systemd/system/vncserver@:1.service

    #vi /etc/systemd/system/vncserver@:1.service

Example of config:

[Unit]
    Description=Remote desktop service (VNC)
    After=syslog.target network.target
    [Service]
    Type=forking
    ExecStartPre=/bin/sh -c '/usr/bin/vncserver -kill %i > /dev/null 2>&1 || :'
    ExecStart=/usr/sbin/runuser -l YOUR_NAME -c "/usr/bin/vncserver
    PIDFile=/home/YOUR_NAME/.vnc/%H%i.pid
    ExecStop=/bin/sh -c '/usr/bin/vncserver -kill %i > /dev/null 2>&1 || :'
    [Install]
    WantedBy=multi-user.target

Now enable autostart service and restart it:

    systemctl enable vncserver@:1.service
    systemctl restart vncserver@:1.service

And finally connect to it:

    #vncviewer YOUR_SERVER_IP

3) XRDP

xrdp is an Open Source Remote desktop Protocol server. First of all we need to install EPEL repository and xrdp server:

    #yum -y install epel-release
    #yum -y install xrdp

Now lets start server

    #systemctl start xrdp.service 

Check if its running, and add him to autostart.

#netstat -an | grep 3389 
tcp 0 0 0.0.0.0:3389 0.0.0.0:* LISTEN
#systemctl enable xrdp.service

Thats all now you can connect to your server from any windows machine.

4) Teamviewer

Teamviewer does not exist in standard repos, so we need to install wget and download TeamViewer rpm package

    #yum -y install wget
    #wget https://download.teamviewer.com/download/linux/teamviewer.x86_64.rpm

Install it, using this command:

    #yum install teamviewer.x86_64.rpm

And set your password

    # teamviewer passwd YOUR_PASSWORD
    ok
    #systemctl start teamviewerd.service

Now you only need to get your id to connect

#teamviewer –info
  TeamViewer ID: 9XXXXXXX7

Try to connect to it using this id and password you set

5) FreeNX

FreeNX is a Remote Access solution based on enterprise class open source technologies by NoMachine. If you like exact this tool to get remote access you may upgrade to cloud version.

First of all we need to add e EPEL + nux-dextop repositories, for Centos 6:

# rpm -Uvh https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
# rpm -Uvh http://li.nux.ro/download/nux/dextop/el6/x86_64/nux-dextop-release-0-2.el6.nux.noarch.rpm

For Centos 7

rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
# rpm -Uvh http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm

Install server and agent:

#yum install freenx-server nxagent 

Enable passdb authentication:

#echo 'ENABLE_PASSDB_AUTHENTICATION="1"' >> /etc/nxserver/node.conf

Now we need to create user for remote access and assign password for him:

# /usr/libexec/nx/nxserver --adduser bob 
NX> 100 NXSERVER - Version 3.2.0-74-SVN OS (GPL, using backend: not detected)
NX> 1000 NXNODE - Version 3.2.0-74-SVN OS (GPL, using backend: not detected)
NX> 716 Public key added to: /home/bob/.ssh/authorized_keys2
NX> 1001 Bye.
NX> 999 Bye

#/usr/libexec/nx/nxserver --passwd bob 
NX> 100 NXSERVER - Version 3.2.0-74-SVN OS (GPL, using backend: not detected)
New password:
Password changed.
NX> 999 Bye

Now we will install epel-repos and opennx client on your machine:

#yum install opennx

After starting opennx wizard you will be asked about session name,server address and port. Most important thing is to set your key. You need to copy key from servers /etc/nxserver/client.id_dsa.key and paste it general tab of your client session properties.

Enforced Password Change at next logon attempt - Windows

If your AD account has the “User must change password at next logon” option enabled:

and you try to logon to a RDP session (with correct credentials):

you might encounter this error message:

“You must change your password before logging on the first time. Please update your password or contact your system administrator or technical support.”

This is a classic catch 22 issue: You have to logon to change you password, but you cannot logon until you’ve changed you password.

If you have access to a “normal” network connected Windows client you can change the password that way, but what if you only have RDP access?

Client side

Well, if the server allows it, you can temporary disable “Credential Security Support Provider (CredSSP)” in the RPD client. This disables Network Layer Authentication, the pre-RPD-connection authentication, and therefore enables you to change your password via RDP. CredSSP is enabled by default in the RDP client on Windows Vista and forward.

There is no option to disable CredSSP in the RDP client, so here is how you have to do it:

• Start mstsc.exe
• Click Show Options
• Click Save As

• Call it ChangePassword.rpd (or anything you’d like, but avoid the name Default.rdp)
• Open the saved ChangePassword.rpd in Notepad
• Add a new row at the end with the following text:
  enablecredsspsupport:i:0

• Save the rdp file
• Double-click the rdp file
• Enter the name/IP of a domain connected computer with RDP enabled

Instead of the local Windows Security prompt (the second image in the blog post) you should see a Windows Logon screen on the remote computer (if not, read on anyway):

If the account you log on with at this point has the “User must change password at next logon” option enabled, you get notified about that:

By clicking OK you get the possibility to change the password (yay!):

After changing the password you get confirmation about the change:

´

Clicking OK logs you in.

In fact, you do not need to have access to sign in through RDP, in that case this shows up, but only after you successfully changed your password:

Delete the ChangePassword.rdp file when you are done (or at least do not use it until you are forced to change your password again), since disabling CredSSP lowers the security of RDP connections.

If the server requires CredSSP

If the server does not allow you to disable Credential Security Support Provider, you get this error message when connecting:

In that case, try connecting using the FQDN (DC01.tomdemo.se and not only DC01) or connect to other servers that might allow you to disable CredSSP. As I mentioned above, you don’t have to have access to actually logon to the server.

Server side

You can also disable CredSSP on the server side, but since that lowers the security on all RDP connections to that server it is not recommended.

If you chose to do this anyway, you do it either by de-selecting “Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended)” in System Properties:

Or if you run the Terminal Server Role:

• Open Terminal Server Configuration
• Open RDP-Tcp configuration page
• On the General tab, set the Security Layer to RDP Security Layer

Note that if you already have an existing access to a server (with the account you need to change the password with) you could just change your password in that session by pressing Ctrl-Alt-Del (or Ctrl-Alt-End in an RDP connection) and choosing Change a password:

I hope this post helped.