web-dev-qa-db-ja.com

Vinoサーバーが攻撃されていますか？

LUbuntu 18.04にvinoをインストールし、コマンドの意味を理解せずに https://askubuntu.com/a/530196/1471 に従ってvinoサーバーを構成して起動しました。

$ export DISPLAY=:0
$ gsettings set org.gnome.Vino enabled true # although fails, it doesn't matter
No such key “enabled”
$ gsettings set org.gnome.Vino Prompt-enabled false
$ gsettings set org.gnome.Vino require-encryption false    
$ /usr/lib/vino/vino-server

ifconfigとサーバー起動の出力メッセージから、サーバーの内部IPは192.168.1.3、ポートは5900であることがわかりました。サーバーに RealVNCのVNCビューアー からAndroid同じWIFIネットワーク内の電話で、提供するように求められた認証は、Ubuntuにログインするためのパスワードでした。私たちのwifiネットワークは以前のテナントによってセットアップされました。ISPはVerizon FIOSであり、特別なセットアップはありません。

サーバーの監視出力メッセージ（以下を参照）では、Android-c28b29b650f6548c.homeがAndroid電話のクライアントであるとしか推測できませんが、クライアント46.101.184.149が誰なのかわかりません。 zg-0817a-64.stretchoid.com、196.52.43.118、およびscan-06.shadowserver.orgは、以下を見つけることを除いて属します。

質問：

  • Android電話のクライアント以外の危険なクライアントからvinoサーバーにアクセスしているのは正しいですか？

  • インターネットでvinoサーバーを利用できるようにするために明示的に何もしようとしませんでした（または、それを認識していません）ので、これらのクライアントはインターネットからサーバーを見つけて接続できますか？

  • Ubuntuで何らかの損傷が発生したかどうかを確認するにはどうすればよいですか？

  • 必要に応じて、VNCサーバーを安全に使用するにはどうすればよいですか？

ありがとう。

$ /usr/lib/vino/vino-server

(vino-server:32529): dbind-WARNING **: 19:44:12.185: Error retrieving accessibility bus address: org.freedesktop.DBus.Error.ServiceUnknown: The name org.a11y.Bus was not provided by any .service files
19/08/2018 07:44:12 PM Autoprobing TCP port in (all) network interface
19/08/2018 07:44:12 PM Listening IPv6://[::]:5900
19/08/2018 07:44:12 PM Listening IPv4://0.0.0.0:5900
19/08/2018 07:44:12 PM Autoprobing selected port 5900
19/08/2018 07:44:12 PM Advertising security type: 'TLS' (18)
19/08/2018 07:44:12 PM Re-binding socket to listen for VNC connections on TCP port 5900 in (all) interface
19/08/2018 07:44:12 PM Listening IPv6://[::]:5900
19/08/2018 07:44:12 PM Listening IPv4://0.0.0.0:5900
19/08/2018 07:44:12 PM Clearing securityTypes
19/08/2018 07:44:12 PM Advertising security type: 'TLS' (18)
19/08/2018 07:44:12 PM Clearing securityTypes
19/08/2018 07:44:12 PM Advertising security type: 'TLS' (18)
19/08/2018 07:44:12 PM Advertising authentication type: 'No Authentication' (1)
19/08/2018 07:44:12 PM Re-binding socket to listen for VNC connections on TCP port 5900 in (all) interface
19/08/2018 07:44:12 PM Listening IPv6://[::]:5900
19/08/2018 07:44:12 PM Listening IPv4://0.0.0.0:5900
19/08/2018 07:44:12 PM Clearing securityTypes
19/08/2018 07:44:12 PM Clearing authTypes
19/08/2018 07:44:12 PM Advertising security type: 'TLS' (18)
19/08/2018 07:44:12 PM Advertising authentication type: 'VNC Authentication' (2)
19/08/2018 07:44:12 PM Clearing securityTypes
19/08/2018 07:44:12 PM Clearing authTypes
19/08/2018 07:44:12 PM Advertising security type: 'TLS' (18)
19/08/2018 07:44:12 PM Advertising authentication type: 'VNC Authentication' (2)
19/08/2018 07:44:12 PM Advertising security type: 'VNC Authentication' (2)
19/08/2018 07:44:17 PM [IPv4] Got connection from client Android-c28b29b650f6548c.home
19/08/2018 07:44:17 PM   other clients:
19/08/2018 07:44:17 PM Client Protocol Version 3.7
19/08/2018 07:44:17 PM Advertising security type 18
19/08/2018 07:44:17 PM Advertising security type 2
19/08/2018 07:44:17 PM Client returned security type 2

** (vino-server:32529): WARNING **: 19:44:28.888: VNC authentication failure from 'Android-c28b29b650f6548c.home'

19/08/2018 07:44:28 PM rfbAuthPasswordChecked: password check failed
19/08/2018 07:44:28 PM Client Android-c28b29b650f6548c.home gone
19/08/2018 07:44:28 PM Statistics:
19/08/2018 07:44:28 PM   framebuffer updates 0, rectangles 0, bytes 0
19/08/2018 07:44:30 PM [IPv4] Got connection from client Android-c28b29b650f6548c.home
19/08/2018 07:44:30 PM   other clients:
19/08/2018 07:44:30 PM Client Protocol Version 3.7
19/08/2018 07:44:30 PM Advertising security type 18
19/08/2018 07:44:30 PM Advertising security type 2
19/08/2018 07:44:30 PM Client returned security type 2

** (vino-server:32529): WARNING **: 19:44:40.531: Deferring authentication of 'Android-c28b29b650f6548c.home' for 5 seconds

19/08/2018 07:44:45 PM rfbProcessClientNormalMessage: ignoring unknown encoding type 22
19/08/2018 07:44:45 PM rfbProcessClientNormalMessage: ignoring unknown encoding type 21
19/08/2018 07:44:45 PM rfbProcessClientNormalMessage: ignoring unknown encoding type 15
19/08/2018 07:44:45 PM rfbProcessClientNormalMessage: ignoring unknown encoding type -314
19/08/2018 07:44:45 PM Enabling NewFBSize protocol extension for client Android-c28b29b650f6548c.home
19/08/2018 07:44:45 PM Pixel format for client Android-c28b29b650f6548c.home:
19/08/2018 07:44:45 PM   8 bpp, depth 6
19/08/2018 07:44:45 PM   true colour: max r 3 g 3 b 3, shift r 4 g 2 b 0
19/08/2018 07:44:45 PM Pixel format for client Android-c28b29b650f6548c.home:
19/08/2018 07:44:45 PM   32 bpp, depth 24, little endian
19/08/2018 07:44:45 PM   true colour: max r 255 g 255 b 255, shift r 16 g 8 b 0
19/08/2018 07:44:45 PM no translation needed

Gtk-Message: 20:43:41.511: GtkDialog mapped without a transient parent. This is discouraged.
Gtk-Message: 20:43:44.339: GtkDialog mapped without a transient parent. This is discouraged.
Gtk-Message: 20:43:52.072: GtkDialog mapped without a transient parent. This is discouraged.
19/08/2018 10:39:57 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:39:57 PM   other clients:
19/08/2018 10:39:57 PM      Android-c28b29b650f6548c.home
19/08/2018 10:39:57 PM Client Protocol Version 3.3

** (vino-server:32529): WARNING **: 22:39:57.238: VNC authentication failure from '46.101.184.149'

19/08/2018 10:39:57 PM rfbAuthPasswordChecked: password check failed
19/08/2018 10:39:57 PM Client 46.101.184.149 gone
19/08/2018 10:39:57 PM Statistics:
19/08/2018 10:39:57 PM   framebuffer updates 0, rectangles 0, bytes 0
19/08/2018 10:43:41 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:43:41 PM   other clients:
19/08/2018 10:43:41 PM      Android-c28b29b650f6548c.home
19/08/2018 10:43:41 PM Client Protocol Version 3.3

** (vino-server:32529): WARNING **: 22:43:41.812: Deferring authentication of '46.101.184.149' for 5 seconds


** (vino-server:32529): WARNING **: 22:43:47.449: VNC authentication failure from '46.101.184.149'

19/08/2018 10:43:47 PM rfbAuthPasswordChecked: password check failed
19/08/2018 10:47:27 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:47:27 PM   other clients:
19/08/2018 10:47:27 PM      46.101.184.149
19/08/2018 10:47:27 PM      Android-c28b29b650f6548c.home
19/08/2018 10:47:27 PM Client Protocol Version 3.3

** (vino-server:32529): WARNING **: 22:47:27.692: Deferring authentication of '46.101.184.149' for 5 seconds


** (vino-server:32529): WARNING **: 22:47:32.452: VNC authentication failure from '46.101.184.149'

19/08/2018 10:47:32 PM rfbAuthPasswordChecked: password check failed
19/08/2018 10:51:12 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:51:12 PM   other clients:
19/08/2018 10:51:12 PM      46.101.184.149
19/08/2018 10:51:12 PM      46.101.184.149
19/08/2018 10:51:12 PM      Android-c28b29b650f6548c.home
19/08/2018 10:51:12 PM Client Protocol Version 3.3

** (vino-server:32529): WARNING **: 22:51:12.833: Deferring authentication of '46.101.184.149' for 5 seconds


** (vino-server:32529): WARNING **: 22:51:18.448: VNC authentication failure from '46.101.184.149'

19/08/2018 10:51:18 PM rfbAuthPasswordChecked: password check failed
19/08/2018 10:54:58 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:54:58 PM   other clients:
19/08/2018 10:54:58 PM      46.101.184.149
19/08/2018 10:54:58 PM      46.101.184.149
19/08/2018 10:54:58 PM      46.101.184.149
19/08/2018 10:54:58 PM      Android-c28b29b650f6548c.home
19/08/2018 10:54:58 PM Client Protocol Version 3.3

** (vino-server:32529): WARNING **: 22:54:58.339: Deferring authentication of '46.101.184.149' for 5 seconds


** (vino-server:32529): WARNING **: 22:55:03.449: VNC authentication failure from '46.101.184.149'

19/08/2018 10:55:03 PM rfbAuthPasswordChecked: password check failed
19/08/2018 10:58:43 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 10:58:43 PM   other clients:
19/08/2018 10:58:43 PM      46.101.184.149
19/08/2018 10:58:43 PM      46.101.184.149
19/08/2018 10:58:43 PM      46.101.184.149
19/08/2018 10:58:43 PM      46.101.184.149
19/08/2018 10:58:43 PM      Android-c28b29b650f6548c.home
19/08/2018 10:58:43 PM Client Protocol Version 3.3

** (vino-server:32529): WARNING **: 22:58:43.756: Deferring authentication of '46.101.184.149' for 5 seconds


** (vino-server:32529): WARNING **: 22:58:49.448: VNC authentication failure from '46.101.184.149'

19/08/2018 10:58:49 PM rfbAuthPasswordChecked: password check failed

19/08/2018 11:02:28 PM [IPv4] Got connection from client 46.101.184.149
19/08/2018 11:02:28 PM   other clients:
19/08/2018 11:02:28 PM      46.101.184.149
19/08/2018 11:02:28 PM      46.101.184.149
19/08/2018 11:02:28 PM      46.101.184.149
19/08/2018 11:02:28 PM      46.101.184.149
19/08/2018 11:02:28 PM      46.101.184.149
19/08/2018 11:02:28 PM      Android-c28b29b650f6548c.home
19/08/2018 11:02:28 PM Client Protocol Version 3.3

** (vino-server:32529): WARNING **: 23:02:28.345: Deferring authentication of '46.101.184.149' for 5 seconds


** (vino-server:32529): WARNING **: 23:02:33.449: VNC authentication failure from '46.101.184.149'

19/08/2018 11:02:33 PM rfbAuthPasswordChecked: password check failed
19/08/2018 11:30:51 PM [IPv4] Got connection from client zg-0817a-64.stretchoid.com
19/08/2018 11:30:51 PM   other clients:
19/08/2018 11:30:51 PM      46.101.184.149
19/08/2018 11:30:51 PM      46.101.184.149
19/08/2018 11:30:51 PM      46.101.184.149
19/08/2018 11:30:51 PM      46.101.184.149
19/08/2018 11:30:51 PM      46.101.184.149
19/08/2018 11:30:51 PM      46.101.184.149
19/08/2018 11:30:51 PM      Android-c28b29b650f6548c.home
19/08/2018 11:31:01 PM rfbProcessClientProtocolVersion: client gone
19/08/2018 11:31:01 PM Client zg-0817a-64.stretchoid.com gone
19/08/2018 11:31:01 PM Statistics:
19/08/2018 11:31:01 PM   framebuffer updates 0, rectangles 0, bytes 0
sendto: Network is unreachable
sendto: Network is unreachable
20/08/2018 10:37:54 AM rfbProcessClientNormalMessage: read: Connection reset by peer
20/08/2018 10:37:54 AM Client Android-c28b29b650f6548c.home gone
20/08/2018 10:37:54 AM Statistics:
20/08/2018 10:37:54 AM   key events received 32, pointer events 3932
20/08/2018 10:37:54 AM   framebuffer updates 7016, rectangles 13714, bytes 270216867
20/08/2018 10:37:54 AM     ZRLE rectangles 13714, bytes 270216867
20/08/2018 10:37:54 AM   raw bytes equivalent 538553044, compression ratio 1.993040
20/08/2018 02:15:10 PM [IPv4] Got connection from client 196.52.43.118
20/08/2018 02:15:10 PM   other clients:
20/08/2018 02:15:10 PM      46.101.184.149
20/08/2018 02:15:10 PM      46.101.184.149
20/08/2018 02:15:10 PM      46.101.184.149
20/08/2018 02:15:10 PM      46.101.184.149
20/08/2018 02:15:10 PM      46.101.184.149
20/08/2018 02:15:10 PM      46.101.184.149
20/08/2018 02:15:10 PM Client Protocol Version 3.7
20/08/2018 02:15:10 PM Advertising security type 18
20/08/2018 02:15:10 PM Advertising security type 2
20/08/2018 02:15:10 PM Client returned security type 1
20/08/2018 02:15:10 PM rfbAuthProcessSecurityTypeMessage: client returned unadvertised security type 1
20/08/2018 02:15:10 PM Client 196.52.43.118 gone
20/08/2018 02:15:10 PM Statistics:
20/08/2018 02:15:10 PM   framebuffer updates 0, rectangles 0, bytes 0
20/08/2018 02:31:26 PM [IPv4] Got connection from client scan-06.shadowserver.org
20/08/2018 02:31:26 PM   other clients:
20/08/2018 02:31:26 PM      46.101.184.149
20/08/2018 02:31:26 PM      46.101.184.149
20/08/2018 02:31:26 PM      46.101.184.149
20/08/2018 02:31:26 PM      46.101.184.149
20/08/2018 02:31:26 PM      46.101.184.149
20/08/2018 02:31:26 PM      46.101.184.149
20/08/2018 02:31:28 PM rfbProcessClientProtocolVersion: client gone
20/08/2018 02:31:28 PM Client scan-06.shadowserver.org gone
20/08/2018 02:31:28 PM Statistics:
20/08/2018 02:31:28 PM   framebuffer updates 0, rectangles 0, bytes 0
18.04securityvncvino
1
Tim

SSHを使用して、VNCの安全な接続を提供します。ボーナスとして、これは、接続が覚えにくいパスワードや安全でないパスワードの代わりに、既存の安全なSSHキーを使用できることを意味します。

どのように機能し、どのように設定するかについては、 https://help.ubuntu.com/community/VNC で詳しく説明されています。

VNCサーバーが既に侵害されている可能性があるため、安全なコンピューティングを実践し、Ubuntuのインスタンスをnuke-and-reinstallします。

2
user535733