X0tigervnc(1)

Okay bestie, this is the TigerVNC Manual page for X0tigervnc(1) 🦋 Let's get into it 💅

🌸 NAME 🌸

X0tigervnc — TigerVNC server for X displays ✨

🎀 SYNOPSIS 🎀

X0tigervnc [options]
X0tigervnc -version

💖 DESCRIPTION 💖

Okay so X0tigervnc is a TigerVNC server that makes any X display remotely accessible via VNC, TigerVNC, or compatible viewers 🔥 The main character move is that it does not create a virtual display like Xtigervnc(1) does 🙈 Instead it just shares an existing X server, typically the one connected to the physical screen 🖥️

XDamage gets used if the existing X server supports it. If it doesn't, X0tigervnc falls back to polling the screen for changes 💜

✨ OPTIONS ✨

X0tigervnc reads the command line as a list of parameters with optional values 💅 Running X0tigervnc -h shows you a list of every valid parameter with short descriptions 🧚 All parameters are optional, but ngl you'd normally have to use the PasswordFile parameter (see its description below) 🔑

There are a few ways to write parameters on the command line (we'll use SomeParameter as the example name) 🌈

• -SomeParameter — Enable the parameter and turn the feature on ✨ This works with parameters that simply switch a feature on or off.
• -SomeParameter=0 — Disable the parameter and turn the feature off 🙅
• -SomeParameter=value — Assign the value you specify to the parameter 🍓 The leading dash can be left off, or doubled if you want, just like GNU-style long options 💕

Parameter names are case-insensitive, and their order on the command line can be totally arbitrary 🦋

✨ PARAMETERS ✨

Okay bestie, these are the parameters, and they're basically the settings menu for X0tigervnc 💅 Each one comes with a default, so if you don't touch anything, you still get a glow-up.

• -AcceptKeyEvents — Lets clients send key press and release events. Default is on 🎀
• -AcceptPointerEvents — Lets clients move the pointer and press buttons. Default is on 🖱️
• -AcceptSetDesktopSize — Lets clients ask to resize the desktop. Default is on 🦋
• -AlwaysShared — Treats every incoming connection as shared, no matter what the client asks for. Default is off 🌸
• -BlacklistThreshold count — How many unauthenticated connection attempts a single host gets before it's blacklisted 🚫 Default is 5.
• -BlacklistTimeout seconds — The starting timeout when a host gets blacklisted. That host can't try to connect again until the timer runs out ⏳ Default is 10.
• -CompareFB mode — Compares pixels in the framebuffer so you skip pointless updates ✨ Pick 0 (off), 1 (always) or 2 (auto). Default is 2.
• -desktop desktop-name — Gives the desktop a name that the viewer can show 🏷️ If you don't set one, it defaults to "<user>@<hostname>".
• -DisconnectClients — Kicks out existing clients when a non-shared connection comes in 👋 Default is on. If it's false, the new non-shared connection gets refused while someone else is still active. Pair it with NeverShared and only one client is allowed at a time, which is very much a main character moment 👑
• -display display — The X display name. If you don't specify one, it grabs whatever the DISPLAY environment variable says 🖥️
• -FrameRate fps — The max number of updates per second sent to each client 🎞️ If the screen changes faster than that, the changes get bundled up and sent together. This only sets a ceiling though, so a client might get a lower rate when resources are tight. Default is 60.
• -Geometry geometry — Picks which part of the screen viewers can see 🔍 The format is widthxheight+xoffset+yoffset, and you can swap any + for a - to measure the offset from the right and/or bottom edge. Offsets are optional, and +0+0 (top left corner) is assumed. If the argument is empty, viewers get the full screen, which is the default 🌈
• -GnuTLSPriority priority — A GnuTLS priority string that controls which algorithms get used during the TLS handshake 🔐 Check the GnuTLS manual for the possible values. Default is NORMAL.
• -HostsFile filename — Lets you point to a file full of IP access control rules 📜 Each line gets one rule, and it has to look like one of these: +address/prefix (accept connections from that address group), -address/prefix (reject them) or ?address/prefix (ask the local user first). The first rule that matches an IP decides what happens. Rules with only an action sign (+, - or ?) match any IP. The prefix is optional and written as a number of bits, like /24. Default is to accept connections from any IP address 🌍
• -IdleTimeout seconds — How many seconds an idle VNC connection can sit there before it gets dropped 💤 Default is 0, which means idle connections never get dropped.
• -ImprovedHextile — Uses a better compression algorithm for Hextile encoding 🗜️ You get better compression ratios, but it costs a little more CPU time. Default is on.
• -interface IP address — Listens on a specific interface 📡 By default, X0tigervnc listens on all available interfaces.
• -localhost — Only lets in connections from the same machine 🏠 This is super useful if you're using SSH and want to block non-SSH connections from every other host 🔒
• -Log logname:dest:level[, ...] — Sets up the debug log 🪵 The dest can be stderr, stdout or syslog. The level runs from 0 to 100, and 100 is the most verbose. logname is usually *, which means all of them, but if you know the name of a source file's "LogWriter", you can target just that one. Default is *:stderr:30.
• -MaxConnectionTime seconds — Terminates the server once a client has been connected for N seconds ⏱️ Default is 0.
• -MaxDisconnectionTime seconds — Terminates the server if nobody has been connected for N seconds 🫥 Default is 0.
• -MaxIdleTime seconds — Terminates the server after N seconds of user inactivity 😴 Default is 0.
• -MaxProcessorUsage percent — The maximum percentage of CPU time that screen polling can eat 🔥 Default is 35.
• -NeverShared — Never treats incoming connections as shared, no matter what the client says 🙅 Default is off.
• -pam_service name, -PAMService name — The PAM service name used to authenticate users with any of the "Plain" security types 🛂 Default is vnc.
• -Password password — An obfuscated binary encoding of the password clients need to get in 🫣 Heads up bestie: this is insecure, so use the PasswordFile parameter instead 🚨
• -PasswordFile passwd-file, -rfbauth passwd-file — The password file for VNC authentication 🔑 There's no default, so you have to specify the file yourself. Make the file with the tigervncpasswd(1) utility. The file gets read every time a connection comes in, so you can change it on the fly 🪄
• -PlainUsers user-list — A comma separated list of usernames that are allowed to log in with any of the "Plain" security types (Plain, TLSPlain, etc.) 🧑‍🤝‍🧑 Use * to let any user in, or %u to let in the user running the server process. Default is to deny all users 🚪
• -PollingCycle milliseconds — How many milliseconds one polling cycle takes ⏲️ The actual interval can change on the fly to keep MaxProcessorUsage happy. Default is 30.
• -Protocol3.3 — Always uses protocol version 3.3 for backwards compatibility with badly-behaved clients 🙈 Default is off.
• -QueryConnect — Asks the desktop user to explicitly accept or reject incoming connections 🙋 Default is off.
• -QueryConnectTimeout seconds — How many seconds the Accept connection dialog stays up before the connection gets rejected ⌛ Default is 10.
• -RawKeyboard — Sends keyboard events straight through without mapping them to the current keyboard layout ⌨️ The keyboard then follows the layout set up on the server instead of the one on the client. Default is off.
• -AcceptCutText — Accepts clipboard updates from clients 📋 Default is on.
• -SetPrimary — Sets the PRIMARY selection as well as the CLIPBOARD selection 🖊️ Default is on.
• -MaxCutText bytes — The biggest incoming clipboard update that's allowed 📏 Default is 262144.
• -SendCutText — Sends clipboard changes out to clients 📤 Default is on.
• -SendPrimary — Sends the PRIMARY selection as well as the CLIPBOARD selection to clients 📨 Default is on.
• -RemapKeys mapping — Sets up a keyboard mapping 🔀 The mapping is a comma-separated string of character mappings. Each one looks like char->char or char<>char, and char is a hexadecimal keysym. For example, if you want to swap the " and @ symbols, you'd write this:

RemapKeys=0x22<>0x40

• -RequireUsername — Requires a username for the RSA-AES security types 🪪 Default is off.
• -rfbport port — The TCP port that X0tigervnc listens on for viewer connections 🔌 The protocol is called RFB, which stands for "remote framebuffer" 🖼️ Set it to -1 to turn off TCP listening. The default port is 5900 when you start it directly, and -1 when it's activated by a systemd socket.
• -rfbunixmode mode — The mode of the Unix domain socket 🗝️ Default is 0600.
• -rfbunixpath path — The path to a Unix domain socket that X0tigervnc listens on for viewers 🛣️ Default is to not listen on any Unix domain socket.
• -RSAKey path — The path to the RSA key used by the RSA-AES security types (RA2, RA2ne, RA2_256 and RA2ne_256), in PEM format 🔏
• -SecurityTypes sec-types — Picks which security schemes to use for incoming connections 🛡️ Valid values are a comma separated list of None, VncAuth, Plain, TLSNone, TLSVnc, TLSPlain, X509None, X509Vnc, X509Plain, RA2, RA2ne, RA2_256 and RA2ne_256. Default is TLSVnc,VncAuth.
• -UseBlacklist — Temporarily rejects connections from a host that keeps failing to authenticate 🚷 Default is on.
• -UseIPv4 — Uses IPv4 for incoming and outgoing connections 🌐 Default is on.
• -UseIPv6 — Uses IPv6 for incoming and outgoing connections 🛰️ Default is on.
• -UseSHM — Uses the MIT-SHM extension if it's available, which speeds up reading the screen 🚀 Default is on.
• -X509Cert path — The path to an X509 certificate in PEM format, used for all the X509-based security types (X509None, X509Vnc, etc.) 📃
• -X509Key path — The private key that goes with the certificate from X509Cert. It also has to be in PEM format 🗝️

---

✨ SEE ALSO ✨

Bestie, these are the sibling pages you should check out next 📚

• Xtigervnc(1)
• tigervncpasswd(1)
• https://www.tigervnc.org/

✨ AUTHOR ✨

Constantin Kaplinsky and others are the people behind this, and they're absolutely iconic 👑 VNC was first developed by the RealVNC team while they were at Olivetti Research Ltd / AT&T Laboratories Cambridge 🧠 Constantin Kaplinsky then added the TightVNC features. Lots of other people have helped with development, testing and support since then 🫶 This manual is part of the TigerVNC software suite 🐯

---

Source is TigerVNC and the page is X0tigervnc(1), so now you know where to find it 🧚💜