원격제어 ; GUI 제어

MobaXterm 

MobaXterm is an all-in-one remote access tool for Windows that supports:

• SSH (Secure Shell)
• X11 Forwarding
• VNC (Virtual Network Computing) with built-in VNC viewer!
• RDP (Remote Desktop Protocol)
• FTP/SFTP (File Transfer Protocols)

맥북이면 Remote DestTop Manager

 

https://wscode.tistory.com/91

[MacOS] MobaXterm 대신 사용가능한 Remote Desktop Mananger

 

VNC (Virtual Network Computing)

• VNC (Virtual Network Computing) is a remote desktop sharing system that allows users to control a computer remotely by transmitting the screen display and keyboard/mouse input over a network.
  • X11 forwarding is for individual windows sharing whereas VNC creates a full desktop session that can be accessed remotely.
• Docker's Case
  • Since docker do not have a GUI by default, Before installing VNC, we need to install Virtual X Display setting
    • GUI applications  send rendering commands (like "draw a button here") to an X server, which handles the actual drawing. so we need middle man to receive GUI Command Before transfering GUI signal to outside
    • Some VNC such as TigerVNC create virtual display and VNC Session as well
• How does VNC Work?  
  • A VNC server the machine that you want to control run on local host
  • Create Port Forwarding between local machine and server to control
    
    • The ISP's gateway (public internet) is outside your control, but you can use VPN, or SSH tunneling to bypass this limitation.
  • Uses the RFB (Remote FrameBuffer) protocol to transmit screen updates.
    • In a real Linux desktop, DISPLAY=:0 represents the actual screen.
    • VNC Server (x11vnc) : Even though Xvfb lets GUI apps run, it doesn’t let you see them from outside Docker. A VNC server is needed to capture the virtual X display and send it over the network

 

Display Protocol

•   A display protocol is a system that defines how graphical applications (clients) communicate with the display server to render graphics and receive user input (keyboard, mouse, etc.)
• GUI applications need a standardized way to send graphics to the screen. The display server (like the X Server or Wayland) needs a protocol to receive drawing requests from apps.

Common Display System and Protocols

X11 (X Window System)

• Oldest and most widely used display protocol (1984). X11 is an OS-level application that enables GUI rendering.
• Apps (X Clients) send drawing requests to the X Server, which renders them. also Supports network-based GUI apps (run apps remotely over SSH).

 

X서버

• "그래픽 환경(GUI)을 위한 입출력 장치만을 통합적으로 관리하고 제공하는 서버
• 기본적으로 X 서버는 한 화면에 하나의 세션만 보여줍니다. 여러 사용자에게 각기 다른 GUI 화면을 제공하려면, 각 사용자당 X 서버 인스턴스를 따로 실행해야 합니다.
• 동작방식
  • X 서버가 시작되면서 랜덤한 토큰(cookie) 생성
  • ~/.Xauthority 파일에 이 쿠키가 저장됨
  • GUI 앱은 X 서버에 연결할 때, 이 쿠키를 보여주며 인증
  • 쿠키가 없으면 접속 거부

 

xhost 

• xhost는 X 서버에 딸려오는 "클라이언트 유틸리티 프로그램"입니다. 즉, X 서버의 접근 제어 기능을 설정하는 용도로 만들어진 GUI 환경용 도구입니다

xhost +local:

• X 서버의 접근 제어를 느슨하게 푸는 명령어로 이 로컬 시스템에서 실행되는 모든 사용자 프로세스에게 내 X 서버 접속을 허용하여 기본 보안(MIT 쿠키) 무시하고, "로컬에서 오는 요청은 전부 허용" 하게 만듦
  
  • Docker 컨테이너에서 DISPLAY=:0로 접근할 경우 (같은 머신)
  • 다른 로컬 계정에서 실행한 GUI 앱

 

 

Wayland (The Modern Replacement for X11)

• Designed as a replacement for X11 (simpler & more secure).

 

 

X display's Display Variable

• DISPLAY variable determines which screen session an application should render to.
  • hostname → (Optional) The machine running the X server.
  • display → The X display number, indicating an X session.
  • screen → The screen number (rarely used, default is 0).

DISPLAY=[hostname]:[display].[screen]

• Common DISPLAY Values
  • DISPLAY=:0 → The Physical Display
    • This is the default X display used by the main GUI session.
  • DISPLAY=:1, :2, etc. → Virtual Displays (Used by VNC & Xvfb)
    • If you start a VNC session, it creates a new virtual X display, like :1, :2, etc.
    • This allows multiple GUI sessions to run independently of the main display (:0).
  • When we access to VNC session, we should check if DISPLAY variable matched with VNC server so the gui application that we will launch show on the right virtual screen

 

VNC Session Setting 

• Run VNC Server on Remote Computer
• Port forward to Local computer for VNC Server
• Access to VNC Server using client
• Check $Display Varible if its matching VNC Server's number(Virtual Display Number)
• Run GUI Application you want

VPN설정

VPN은 "가상의 사설 네트워크"를 만들어서 보안이 강화된 네트워크 환경을 제공하는 기술이야.
✅ 외부에서도 내부 네트워크에 안전하게 접속할 수 있도록 해 줌.
✅ 기업이나 조직에서는 개발자가 VPN을 통해 내부 서버에 접근하도록 설정하는 경우가 많음.

📌 VPN의 주요 개념

• 🔹 가상 사설 네트워크(VPN): 인터넷을 통해 안전한 연결을 생성하여 내부 네트워크에 접속 가능
• 🔹 IP 주소 변경: VPN을 사용하면 외부에서 접근할 때 VPN 서버의 IP로 보이게 됨
• 🔹 암호화된 통신: 모든 트래픽이 암호화되므로 해킹이나 패킷 가로채기 공격을 방지
• 🔹 내부 리소스 접근 가능: 회사 내부의 DB, API, 파일 서버 등에 안전하게 접속

 

 

포트 포워딩 (터널링, X11 Forwarding)

• Port forwarding is used to tunnel traffic securely between two machines. 
  • Accessing services running on a private network (NAT traversal)
  •  Bypass network restrictions by tunneling all traffic through an SSH server (like a VPN).  Hosting servers behind a firewall (e.g., web, gaming, VNC, RDP)
    • ISP's Internet gatway cannot be controlled by individual so we need bypassing way
• Local Port Forwarding (-L)
  • Syntax  : ssh -L [local-port]:[destination-ip]:[destination-port] -N -f -l user remote-server.com
  • As Client of Service, turnel a local port that forwards request traffic to the remote machine to access a remote service from your local machine
    • A database is running on remote-server.com:5432 (PostgreSQL).
    • You want to access this database locally as if it were running on localhost:5432.
    • After running the command, Even though the database is on remote-server.com, it appears as if it's running locally on your machine (127.0.0.1:5432).
• How Remote Port Forwarding (-R) Works
  • Syntax : ssh -R [remote-port]:[local-ip]:[local-port] -N -f -l user remote-server.com
  • As a client, you create a secure SSH tunnel that opens a port on the remote machine, forwarding request traffic from remote port to your local machine, allowing the remote machine to access your locally hosted service.
    • Your local machine has a web server running on 127.0.0.1:8000
    • The remote machine (remote-server.com) is instructed to forward incoming traffic on 8080 to your local web server (127.0.0.1:8000).
    • After running this command, someone on remote-server.com can access your local web server by visiting: http://localhost:8080
• Command Execution Option
  • -N (No Remote Command Execution) : set up port forwarding (tunneling) without running an interactive shell or executing commands on the remote server.
  • -f (Fork to Background) : tells SSH to run in the background after authentication.
  • - l (Specify Remote Username) : This option specifies the remote username for authentication. Without -l, SSH will use the current logged-in user's name.

 

 

 

 

 

 

AWS 보안 그룹 설정

• AWS 사용 : AWS EC2에 접속하여 서버를 관리하는 가장 기본적인 사용법입니다.
• EC2 인스턴스를 생성할 때 보안 그룹(Security Group)은 기본적으로 모든 포트가 닫혀 있습니다. 즉, 인바운드 트래픽은 허용되지 않으며, 아웃바운드 트래픽은 기본적으로 모두 허용됩니다.
• SSH 접속을 위해 AWS 보안 그룹에서 TCP 포트 22를 열어야 합니다. 일반적으로 접속 가능한 IP를 제한하여 보안을 강화합니다
• AWS 사용 :보안 그룹 설정: 포트 22 열기 및 접속 IP 제한. 기본설정은 포트 22번 열려있으며 ip제한 없음.