VNC :: Too many authentication failures error Print

Why does it happen?

The too many authentication failures error usually happens when someone trying to login to your server via VNC with wrong login credentials. It might be brute forcing using some kind of bots or scripts. Here I am providing the way to get it back to work.

How to get back VNC access?

1. Login to the server via SSH.
2. #su - rathena
3. Get PID of the current VNC session by using 'pgrep' command:

   # pgrep vnc
   6981

4. Kill the PID you got as the result of 'pgrep':

   # kill 6981

5. Restart a new VNC session:

   #vncserver -geometry 1920x1080

How to solve the issue?

In order to make sure that the issue is not happening again, we can allow access to the VNC port for the required public IPs only and blocking all others on the firewall. But it needs a static IP otherwise it will be changed every time and will cause more access issues. Here I am providing the steps to whitelist the required IPs and blocking the other ranges using IPTABLES:

1. You can list the currently active firewall rules:

   # iptables -L

2. You can add a rule to allow your IP on a specific port:

   # iptables -I INPUT -p tcp -s  your-ip --dport 5901 -j ACCEPT

   
   Here you need to replace the field 'your-ip' with the IP address and change the VNC port as per your VNC setup.
3. Once allowed all of your IPs/ranges, we need to block all others:

   # iptables -A INPUT -p tcp -s 0.0.0.0/0 --dport 5901 -j DROP

   
   Make sure that you have allowed all required IPs before activating the above rule, otherwise, the access will be gone. That's it.