void-linux / void-linux/void-packages

x11vnc password is always in clear text, and clients are unable to connect with password

Open
#48,007 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-testing
Dominant language
Shell
Stars
3.4k
Forks
2.8k
Avg merge
2d 5h
Merged PRs (30d)
299

Description

Is this a new report?

Yes

System Info

Void 6.6.8_1 x86_64 GenuineIntel uptodate rrFFFFF

Package(s) Affected

x11vnc-0.9.16_6

Does a report exist for this bug with the project's home (upstream) and/or another distro?

It works ok in Debian bullseye

Expected behaviour

x11vnc can generate a password file with the option storepasswd among others. The password should be stored obfuscated or encrypted. In addition, vncviewer should be able to connect to the server when the correct password is set.

Actual behaviour

The password is always stored in clear text.

In addition, vncviewer always get "Authentication failure: password check failed!", even when the correct password is set.

Steps to reproduce
  1. Run x11vnc to generate a password:

x11vnc -storepasswd

  1. Input and verify the password

  2. See the generated file

cat $HOME/.vnc/passwd

The password should appear obfuscated or encrypted. In addition, vncviewer should be able to connect when the correct password is set. However, the password is in clear text and the client cannot connect, even when the password is properly set in the client (tested with client from tigervnc package)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with x11vnc-0.9.16_6 using x11vnc -storepasswd, inspect the generated $HOME/.vnc/passwd, and test connection with the TigerVNC client. Compare the Void package behavior with Debian bullseye and trace the package sources or patches; done means the password is not stored in clear text and a correctly configured client authenticates successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.