"Too many authentication failures" through VNC after a day of having a droplet run?

August 16, 2017 13.8k views
Applications DigitalOcean Debian
substancegamesd
By:
substancegamesd

I've set up a server running Debian 9 and installed VNC using this guide:

https://www.digitalocean.com/community/tutorials/how-to-set-up-vnc-server-on-debian-8

Everything seems to work fine but it doesn't last for long. After a day or two of running without issues my VNC viewer gives me the error "Too many authentication failures." I can still SSH into the server without any issues, but I really need to access the desktop without resetting VNC.

It's not even a password issue or limited to a single client, as I tried to enter through my Raspberry Pi and I got the same error even though it gave me no password input and I've never entered through the Pi before.

Long ago I set up a server with Ubuntu and I had the same issue, but remaking the droplet with Debian seemed to fix the issue, but now I'm having it again in a new droplet even though the distro is still Debian. I've already tried resetting vncpasswd but it doesn't change anything.

What can I do to enter the server again, and hopefully fix the issue for good so it doesn't happen again?

Log In to Comment
1 Answer
philzona August 16, 2017

Check your /var/log/auth.log file. It's possible that someone scanned and saw that you had a VNC server running (based on the port), and tried to brute force their way in. I'm not aware of any built in security on VNC, but it sounds like that's why you're getting the error.

To avoid this in the future, you can try setting up fail2ban. If you haven't used it before, it's a neat little piece of software that bans users based on their IP address after a certain number of failed attempts. If VNC is limiting the number of failed login attempts, this should help mitigate that.

You should also be connecting to VNC through an SSH tunnel, since it's not a secure protocol. You can also try running it on a higher port that isn't covered by generic nmap scans, although this is more supplemental and should not be relied upon for security.

Reply
Have another answer? Share your knowledge.

Related Questions