Learn Remote Desktop - x11vnc: Sharing a Running X Display

#Introduction

In episode 3 you installed x11vnc. Episode 4 is the first real hands-on episode: turning on a share session for the X11 display currently running on your machine. This is the most common scenario in the real world — you're sitting in front of a Linux desktop and want others to see or control it from afar, without building a new session.

x11vnc differs from TigerVNC's Xvnc: it doesn't create a virtual display, but rather reads the already-active X11 display and shares it over the VNC protocol. In this episode we'll start the simplest server, understand it through key options like -forever, -noxdamage, and -ncache, and then secure access with a password and localhost restrictions.

#Turning On Your First Share Session

#The Basic x11vnc Command

A key concept to understand first: x11vnc needs to know which display to share, and it needs access to the X11 authority belonging to the logged-in user. Because display :0 is owned by that user, you must use -auth guess so x11vnc guesses the correct authority file:

x11vnc -display :0 -auth guess

The x11vnc -display :0 -auth guess command opens port 5900 and starts sending the framebuffer of display :0. Without a password option, anyone on the network can connect — so for the first experiment, just run it temporarily and stop it with Ctrl+C.

#Creating a Password and Storing an Auth File

Before opening the server to a wider network, create a password file first. x11vnc provides -storepasswd to generate an auth file:

x11vnc -storepasswd rahasia123 /etc/x11vnc.pass
sudo chmod 600 /etc/x11vnc.pass

The x11vnc -storepasswd rahasia123 /etc/x11vnc.pass command writes the encrypted password to the /etc/x11vnc.pass file. Then run the server with that file:

x11vnc -display :0 -auth guess -rfbauth /etc/x11vnc.pass

Now, connecting viewers will be asked for the password before seeing the screen.

#Key Options for Stability

#-forever: Don't Exit When the Client Disconnects

By default x11vnc exits as soon as the last client disconnects. That's annoying for on-demand access. Use -forever so the server keeps running and waits for the next connection:

x11vnc -display :0 -auth guess -rfbauth /etc/x11vnc.pass -forever

#-noxdamage and -ncache

These two options address two common problems. -noxdamage disables the use of the X Damage extension — which sometimes triggers unstable refreshes on certain drivers. Meanwhile -ncache enables client-side caching: screen regions that don't change are cached on the viewer side, making refreshes much smoother:

x11vnc -display :0 -auth guess -forever -noxdamage -ncache 10

A -ncache 10 value means 10 percent of the viewer area is allocated for caching. The -forever -noxdamage -ncache combination is the most common recipe for a stable connection on a Linux desktop.

#Authentication and Access Restrictions

#-passwdfile and -localhost

For stricter environments, you can restrict access to localhost only and store the password in a plain text file (useful when called by systemd):

x11vnc -display :0 -auth guess -passwdfile /etc/x11vnc.pass -localhost

The -localhost option makes the server listen only on 127.0.0.1 — no other machine on the network can connect directly. This is a highly recommended pattern: keep x11vnc bound to localhost, then access it through an SSH tunnel (episode 14).

#-rfbauth vs -passwdfile

The difference between the two: -rfbauth reads the password file generated by -storepasswd (encrypted format), while -passwdfile can read a plain text file or other formats. For production, -rfbauth is cleaner because the file can be given strict permissions:

ss -tulpn | grep 5900

The ss -tulpn | grep 5900 command will show x11vnc listening on port 5900. If you added -localhost, its listen address will show 127.0.0.1:5900 — a sign that the restriction is working.

#Summary of Common Scenarios

#Recipes for Three Situations

For easy reuse, here are three complete scenarios:

• Quick helpdesk (internal LAN): x11vnc -display :0 -auth guess -forever -ncache 10.
• Restricted access with a password: add -rfbauth /etc/x11vnc.pass.
• Secure via SSH tunnel: add -localhost and don't open port 5900 in the firewall.

Choose according to your needs, and remember: x11vnc can only share a display that is currently active. If you need a new session without a physical monitor, that's the job of TigerVNC Xvnc, covered in episode 5.

#Conclusion

Episode 4 took you through the first hands-on practice: turning on x11vnc to share display :0 with -auth guess, creating a password via -storepasswd, stabilizing the connection with -forever, -noxdamage, and -ncache, and restricting access with -localhost and -passwdfile.

Key takeaways:

• x11vnc shares a running display; it doesn't create a new session.
• -display :0 -auth guess is the basis for sharing an active desktop.
• -forever keeps the server alive after clients disconnect.
• -ncache smooths refreshes; -noxdamage fixes unstable refreshes.
• -localhost restricts access to localhost — the foundation for SSH tunnels.

In the next episode, episode 5, we move to the second tool: TigerVNC for virtual displays and multi-session — creating displays :1, :2 without a physical monitor using vncserver -geometry 1920x1080 -depth 24, understanding x0vncserver for sharing a physical display, and configuring vncpasswd and ~/.vnc/xstartup. See you there!