void-linux / void-linux/void-packages
x11vnc password is always in clear text, and clients are unable to connect with password
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 3.4k
- Forks
- 2.8k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 299
Description
Is this a new report?
Yes
System Info
Void 6.6.8_1 x86_64 GenuineIntel uptodate rrFFFFF
Package(s) Affected
x11vnc-0.9.16_6
Does a report exist for this bug with the project's home (upstream) and/or another distro?
It works ok in Debian bullseye
Expected behaviour
x11vnc can generate a password file with the option storepasswd among others. The password should be stored obfuscated or encrypted. In addition, vncviewer should be able to connect to the server when the correct password is set.
Actual behaviour
The password is always stored in clear text.
In addition, vncviewer always get "Authentication failure: password check failed!", even when the correct password is set.
Steps to reproduce
- Run x11vnc to generate a password:
x11vnc -storepasswd
-
Input and verify the password
-
See the generated file
cat $HOME/.vnc/passwd
The password should appear obfuscated or encrypted. In addition, vncviewer should be able to connect when the correct password is set. However, the password is in clear text and the client cannot connect, even when the password is properly set in the client (tested with client from tigervnc package)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with x11vnc-0.9.16_6 using x11vnc -storepasswd, inspect the generated $HOME/.vnc/passwd, and test connection with the TigerVNC client. Compare the Void package behavior with Debian bullseye and trace the package sources or patches; done means the password is not stored in clear text and a correctly configured client authenticates successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100