Hi, We had a break in on our visualization server, and one vector that was identified was an unpatched issue in the TigerVNC server since it was running as root. There isn't actually any reason to run the TigerVNC server as root though (it is just a glorified in memory framebuffer with an X11 protocol on one side and VNC on the other), so I put together a patch that optionally drop privileges when starting the VNC server. We have been running it on our server for over a month now with no issues. https://docs.computecanada.ca/wiki/VNC#VDI_Nodes It seems like something that others would appreciate as well. Not to mention something that might be useful to extend to starting Xorg at some point as apparently it can also be run without root now in some cases too. So I submitted a pull request (the CI failure is a false alarm -- if you click through there was some setup issue installing base packages under Debian) https://github.com/canonical/lightdm/pull/127 There has been no response though. Is there something more I need to do? Perhaps there is someone I should have CCed in the pull request? Thanks! -Tyson -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freedesktop.org/archives/lightdm/attachments/20200721/61099cea/attachment.htm>