I'm using Putty and RealVNC to establish a secure connection to an OSX 10.9 server machine. I've tried to run this connection over an ssh tunnel I set up, but the client warns of an unencryted connection to localhost:5901. Does this mean that only the local 'connection' to the tunnel is unencrypted and I shouldn't worry about it or is there still something wrong?
3 Answers
The client can't know that the connection is being ssh tunneled, it knows only that when it talks to the declared server - localhost:5901 - it does so in plaintext, and it's warning you about that. Since you have made arrangements for the traffic to be encrypted the rest of the way, you may continue in peace.
In particular, you can have confidence that the traffic from your desktop to the server is not leaking, since if you weren't running a tunnel (or a local VNC server, which would still have no wider security implications) there would be no way for the traffic to get from localhost out on to the network.
answered May 2, 2014 at 8:34
If the VNC connection is tunneled through SSH, it's encrypted. However, VNC is unaware of this and thus warns you.
I you forwarded local 5901 port to the localhost:5901 port on the remote machine, then only the connection inside your local machine is unencrypted (as connect to localhost), but it will go through the ssh tunnel through the internet (encrypted), and then it will be unencrypted inside the remote machine after it exits the tunnel. Don't worry.
