* TurboVNC Authentication Extensions

The TurboVNC Server supports four "authentication methods", which are used to
validate authentication credentials sent from a VNC viewer:

	No Authentication :: {:}
		Any viewer may connect without sending any authentication credentials.

	VNC Password Authentication :: {:}
		A valid VNC password must be sent from the VNC viewer using the "Standard
		VNC" authentication scheme (see below) before it is allowed to connect.
		The VNC password is typically stored in a file under the user's home
		directory on the server machine.  It is separate from any other login
		credentials and thus represents less of a security threat if compromised
		(that is, assuming the VNC password and the Unix login password are not set
		to the same value.)

	One-Time Password (OTP) Authentication :: {:}
		Using ''vncpasswd'', a unique password is generated "on the fly" for the
		TurboVNC session and is printed on the server's command line (see the man
		page for ''vncpasswd'' for more details.)  The user enters this password in
		the VNC viewer as if it were a VNC password, and the viewer sends the
		OTP using the "Standard VNC" authentication scheme (see below.)
		However, once the OTP has been used once to authenticate a viewer, it is
		forgotten and cannot be reused.  OTP authentication can be used, for
		instance, to launch or connect to TurboVNC sessions from an automated web
		portal or from a job scheduler.  OTP authentication is also useful for
		allowing temporary access to a TurboVNC session for collaboration purposes.

	PAM User/Password Authentication :: {:}
		The TurboVNC Server uses Pluggable Authentication Modules (PAM) to validate
		a username and password received from a VNC viewer via the "Unix login"
		authentication scheme (see below.)  The username and password received
		from the VNC viewer need not necessarily be validated against Unix login
		credentials.  Generally, the server can be configured to use any
		user/password authentication credentials that can be accessed through PAM.
		Since the "Unix login" authentication scheme sends the password as
		plain text, it is strongly recommended that this authentication method be
		enabled only if the server is restricted to only allow loopback (SSH)
		connections and to disallow reverse connections (see
		{ref prefix="Section ": Secure_TurboVNC_Usage}.)

The TurboVNC Viewer supports three "authentication schemes", which are
protocols used to validate authentication credentials with a VNC server:

	None :: {:}
		No authentication credentials are sent to the server.

	Standard VNC Authentication :: {:}
		A password is sent to the server using a DES-encrypted
		challenge-response scheme.  The password can be up to 8 characters long,
		so the DES key length is 56 bits.  This is not a particularly strong form
		of encryption by today's standards (56-bit DES was broken by brute force
		attack in the late 90's.)

	Unix Login Authentication :: {:}
		Both the username and password are sent to the server as plain text.
		Thus, it is __strongly__ recommended that this authentication scheme
		be used only with an SSH-encrypted TurboVNC connection (see
		{ref prefix="Section ": Secure_TurboVNC_Usage}.)

** Enabling Authentication Methods

The default behavior of the TurboVNC Server is for all authentication methods
to be enabled and for VNC password authentication and OTP to be preferred over
PAM user/password authentication.  However, the system administrator can
disable one or more of the authentication methods or set the preferred order of
the authentication methods by editing the server's authentication configuration
file.  See the ''Xvnc'' man page for more details.

If the server allows multiple authentication methods that support multiple
authentication schemes, then the client's default authentication
scheme will be determined by the preferred authentication method on the
server.  In this case, the user can override the default by passing
command-line arguments to ''vncviewer''.  If the server prefers an
authentication method that supports standard VNC authentication, then the user
can force the use of Unix login authentication by passing an argument of
''-user ''__''{user_name}''__ to ''vncviewer'' when connecting to the TurboVNC
session.  Similarly, if the server prefers an authentication method that
supports Unix login authentication, then the user can force the use of standard
VNC authentication by passing an argument of ''-nounixlogin'' to ''vncviewer''.
Both of these command-line options work with both the Unix and Windows versions
of ''vncviewer''.  Note that if using the Java TurboVNC Viewer, the same thing
can be accomplished by setting the ''USER'' parameter or setting the
''No Unix Login'' parameter to ''Yes'' in
''/opt/TurboVNC/vnc/classes/index.vnc''.

	!!! Because of the way that the Windows TurboVNC Viewer caches settings for
	each connection, the ''-user'' and ''-nounixlogin'' options may not work
	properly unless you also specify the connection name on the command line
	(example:  ''vncviewer -nounixlogin my_server:1'').

If the system administrator has not restricted any of the authentication
methods on a system-wide basis, then the user can choose to disable some or
all of them for a single TurboVNC session by passing command-line arguments to
''vncserver''.  See the ''vncserver'' man page for more details.

** Further Reading

For more detailed information about the TurboVNC authentication extensions,
refer to the TurboVNC man pages:

	#Verb: <<---
	man -M /opt/TurboVNC/man {vncserver | Xvnc | vncviewer | vncpasswd}
	---
