HOWTO: Set up a Windows SSH server for VNC tunneling
[ 17 August 2006 ]
Marked under security, windows.

This tutorial will walk you through the steps to running a SSH server on your Windows machine and using it to create a secure tunnel through the Internet to use VNC.

SETUP: Server

Install the SSH server:

1. Log into Windows with Administrative privileges
2. If there is no password set for this user, set one in the Control Panel. *(a password is required)
3. Create a cygwin folder in the C: drive (C:\cygwin)
4. Download setup.exe from cygwin.com and save it to C:\cygwin
5. Run C:\cygwin\setup.exe
6. Install from the Internet and save to C:\cygwin\
7. For Local Package Directory, use C:\cygwin\
8. Select a download site from the large list.
9. On the Select Package screen, click View once so “Full” appears.
10. Scroll down to openssh in the package column, and click on “Skip” so an “X” will appear in column “Bin?”.
11. After the packages have been downloaded, finish the installation
12. Right click My Computer, Properties > Advanced > Environment Variables
13. Under System Variables, click New, add CYGWIN as the variable name, add ntsec as the variable value
14. Under System Variables, scroll down to Path, click Edit, add ;c:\cygwin\bin to the end of the string already in the field
15. Open Cygwin on the desktop and type in ssh-host-config
16. “Privilege Separation?” Yes
17. “Create local user SSHd?” Yes
18. “Install SSHd as a service?” Yes
19. “CYGWIN = ” enter ntsec
20. While in the same Cygwin window, enter net start sshd to start the SSH server
21. If you ever need to stop the SSH server, enter net stop sshd
22. In the Cygwin window enter mkpasswd –local > /etc/passwd to copy over the Windows user settings to Cygwin
23. In the Cygwin window enter mkgroup –local > /etc/group to copy over the Windows group settings to Cygwin

Test the SSH server:

1. Enter ssh localhost in a Cygwin window
2. Any time you SSH into a server for the first time, you will get an authenticity warning. The RSA key will be listed and it will ask you if you want to continue. Type in ‘yes‘ to continue.
3. If you get a prompt without any errors, enter ls -lh /cygdrive/c
4. If you see a directory listing of your C:\ drive, everything went right

Install the VNC server:

1. Install your VNC client of choice. Make sure you install the server portion of the client
2. If you are given the option to “allow loopback connections” choose Yes
3. Make sure you register the VNC Server as a system service. Various clients do this in different ways
4. Once it’s registered as a service, it will auto-run at Windows startup as a service

Tweak your firewall (if applicable) to allow port 22:

1. In your firewall, open TCP port 22 for SSH use
2. Example: in Norton Internet Security, Personal Firewall > Configure button > Advanced tab > General button > click Add. Permit to and from connections for TCP port 22. Name the rule something like SSH
3. Example: in Windows Firewall for SP2, Start > Control Panel > Windows Firewall > Exceptions Tab > Add port > port name SSH, port 22 TCP

Tweak your router (if applicable) to forward port 22:

1. If you’re behind a router, forward TCP port 22 to your internal IP
2. This means that any traffic coming in through port 22 (the SSH port) will be passed through the router and directed (forwarded) to your internal IP

SETUP: Remote machine

Install the SSH client and create a tunnel:

1. Install your SSH client of choice (mine is PuTTY)
2. Create a tunnel to your SSH server
3. In PuTTY, click the Add button under the tunnels section
4. Make the source port = 5900 and the destination = 127.0.0.1:5900
5. In the SSH Secure Shell client, edit your profile and go to the Tunneling tab
6. Make the listen port 5900, the Destination host 127.0.0.1 and the destination port 5900. Choose TCP for the type and uncheck “Allow local connections only.”

Configure PuTTY for auto-login (if you choose to use PuTTY):

1. Make a shortcut to putty.exe on your Desktop
2. Right click the shortcut, Properties > Shortcut tab > Target field
3. Add the following to the end of the string in the field: -load “[your profile name]” -l [login name] -pw [password]
4. Example: -load “home” -l Mark -pw mypassword

Install the VNC viewer:

1. Find a VNC program of your choice and install the VNC Viewer portion of the package.

EXECUTE: VNC over SSH

1. Open your SSH client, connect to your remote IP address
2. Open your VNC viewer, connect to 127.0.0.1:5900

“Computers are useless. They can only give you answers.”
          - Pablo Picaso