How to disable VNC login, after brut force vnc attack??

Question

Level 1

38 points

How to disable VNC login, after brut force vnc attack??

Hello

We have an OS X 10.6.8 Server. Whe normaly connect to the Network over L2TP. As BackDoor we have an ARD Forward vor 3282, 5900 & 5988.

Now we recognised a attack to login to our Server to VNC. This is failed.

09.04.13 18:43:57

/System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Mac OS/AppleVNCServer[218]

Authentication: FAILED :: User Name: N/A :: Viewer Address: 1xx.1xx.2xx.2xx :: Type: VNC DES

Is it possible to disable to VNC Login after e.g. 5 attemps for anotther 1 hour.

In the GUI I can't find this option. Is their a way to do this with an CLI-Command

Who is able to help me

Regards

Posted on Apr 9, 2013 10:13 AM

Reply

Answer 1

Apr 9, 2013 1:04 PM in response to Gerard Dirks

I use fail2ban and a jail specifically for vnc. You can read about it at the URL below.

http://thefragens.com/blog/2010/11/fail2ban-and-os-x-server-part-deux/

You should be able to set it up yourself with my OSX specific modifications.

FWIW, I get a ton of vnc access attempts.

Reply

Answer 2

UptimeJeff

Level 4

3,479 points

Apr 14, 2013 1:37 PM in response to Gerard Dirks

a simple approach is to change your VNC port so it's not hit by automated explot scripts.

many routers make this simple, they let you remap the public port to a different internal port

something like

55455 -> 5900

Then from mac

vnc://server.domain.com:55455

You can't count on this to protect you from a knowledgeable attacker with a purpose/mission directed at your organization.. but it does simply hide you from the auto-hacks, which are 99% of the problem

Reply