# VNC Connections

## Overview

KeeperPAM enables zero-trust privileged session management for target infrastructure using the VNC protocol. This guide explains how to set up VNC connections on your PAM Machine Records in the Keeper Vault. Secure VNC sessions are established from the Vault, through the Keeper Gateway, and directly to target devices.

## Prerequisites

Prior to following this guide, familiarize yourself with the prerequisites on the Connection's [Getting Started page](https://docs.keeper.io/en/keeperpam/privileged-access-manager/connections/getting-started).

The following PAM records are needed in order to successfully setup this protocol:

<table><thead><tr><th width="211">PAM Record</th><th>Definition</th></tr></thead><tbody><tr><td>PAM Configuration</td><td>The PAM Configuration contains information of your target infrastructure</td></tr><tr><td>PAM Machine Record</td><td>The PAM Machine record contains information of the endpoint you want to establish an VNC protocol connection to.</td></tr><tr><td>PAM User Record</td><td>The PAM User record contains the VNC credentials that will be used to connect to the machine</td></tr></tbody></table>

This guide will use a **Azure VM**. For more details on how this is setup on the PAM Machine Record, visit the following page:

{% content-ref url="<https://github.com/Keeper-Security/gitbook-secrets-manager/blob/master/privileged-access-manager/getting-started/pam-resources/pam-machine/example-azure-virtual-machine/README.md>" %}
<https://github.com/Keeper-Security/gitbook-secrets-manager/blob/master/privileged-access-manager/getting-started/pam-resources/pam-machine/example-azure-virtual-machine/README.md>
{% endcontent-ref %}

## PAM Settings - Configuring VNC Protocol

### **Accessing Connection Settings**

After creating a PAM Record Type (PAM Machine, PAM Database, or PAM Directory) with your target endpoint, navigate to the Connection Section on the PAM Settings screen by:

1. Editing the PAM Record
2. Clicking on "Set Up" in the PAM Settings section
3. Navigate to the "Connection" section in the prompted window

### Configuring Connection Settings

Prior to configuring the VNC protocol settings on the PAM Settings screen, the following fields are all **required** and need to be configured:

<table><thead><tr><th width="293">Field</th><th>Description</th></tr></thead><tbody><tr><td>PAM Configuration</td><td>This is the PAM Configuration that contains the details of your target infrastructure and provides access to the target configured on the PAM Record.</td></tr><tr><td>Administrative Credential Record</td><td>This is the linked <a href="https://docs.keeper.io/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-user">PAM User</a> that will be used to authenticate to the target and perform administrative operations on it.</td></tr></tbody></table>

The following table lists all the configurable settings for the VNC protocol on the PAM Settings:

<table><thead><tr><th width="295">Field</th><th>Definition</th></tr></thead><tbody><tr><td>Protocol</td><td><p><strong>Required</strong></p><p>The protocol to be configured on the record. The protocol settings will be populated based on the selected protocol. In this guide, the VNC protocol should be selected</p></td></tr><tr><td>Enable Connection</td><td><p><strong>Required</strong></p><p>To enable connection for this record, this toggle needs to be enabled</p></td></tr><tr><td>Graphical Session Recording</td><td>When enabled, graphical session recordings will be enabled for this record</td></tr><tr><td>Include Key Events</td><td>When enabled, the individual keystroke data will be included in the session playback. Note: This will include any secrets potentially typed by the user.</td></tr><tr><td>Connection Port</td><td>The port used to establish the selected protocol connection. By Default, this will be the port value defined on the PAM Machine record. The port specified here will override the default port.<br><br>For VNC the port is 5900</td></tr><tr><td>Launch Credentials</td><td>When configured, these credentials will be used to authenticate the connection. More details <a href="#connection-authentication-methods">here</a></td></tr><tr><td>Allow users to select credentials from their vault</td><td>When enabled, allow users to use their own personal/private credentials to authenticate the connection. More details <a href="#connection-authentication-methods">here</a></td></tr><tr><td>Rotate launch credentials upon session termination</td><td>When enabled, the configured launch credentials will be automatically rotated when the session is closed</td></tr><tr><td>Destination Host</td><td><p><strong>Required</strong> if using a VNC Repeater such as UltraVNC Repeater</p><p>The destination host to request when connecting to a VNC proxy such as UltraVNC Repeater</p></td></tr><tr><td>Destination Port</td><td><p><strong>Required</strong> if using a VNC Repeater such as UltraVNC Repeater</p><p>The destination port to request when connecting to a VNC proxy such as UltraVNC Repeater</p></td></tr><tr><td>Can copy to clipboard</td><td>If enabled, text copied within the connected protocol session will be accessible by the user</td></tr><tr><td>Can paste from clipboard</td><td>If enabled, user can paste text from clipboard within the connected protocol session</td></tr><tr><td>Read-only</td><td>Whether this connection should be read-only. If set to "true", no input will be accepted on the connection at all. Users will only see the desktop and whatever other users using that same desktop are doing.</td></tr><tr><td>Swap red/blue components</td><td>If the colors of your display appear wrong (blues appear orange or red, etc.), it may be that your VNC server is sending image data incorrectly, and the red and blue components of each color are swapped. If this is the case, set this parameter to "true" to work around the problem.</td></tr><tr><td>Force lossless compression</td><td>Whether this connection should use lossless compression only. If set to "true", all graphical updates will use lossless compression algorithms. By default, lossy compression will automatically be used when Keeper detects that doing so would likely outperform lossless compression.</td></tr><tr><td>Encoding</td><td><p>The encoding to assume for the VNC clipboard. By default, the standard encoding ISO 8859-1 will be used. <strong>Only use this parameter if you are sure your VNC server expects a different, non-standard encoding.</strong></p><p>Possible values are:</p><ul><li>"<code>ISO8859-1</code>" - The clipboard encoding mandated by the VNC standard.</li><li>"<code>UTF-8</code>"</li><li>"<code>UTF-16</code>"</li><li>"<code>CP1252</code>" - Code page 1252, a Windows-specific encoding for Latin characters which is mostly a superset of ISO 8859-1.</li></ul></td></tr><tr><td>Cursor</td><td>If set to "remote", the mouse pointer will be rendered remotely, and the local position of the mouse pointer will be indicated by a small dot. A remote mouse cursor will feel slower than a local cursor, but may be necessary if the VNC server does not support sending the cursor image to the client.</td></tr><tr><td>Color depth</td><td>The color depth to request, in bits per pixel. Legal values are 8, 16, 24, or 32. Note that, regardless of what value is chosen here, Keeper will always attempt to optimize image transmission, automatically using fewer bits per pixel if doing so will not visibly alter image quality.</td></tr><tr><td>Enable audio</td><td>If set to "true", audio support will be enabled, and a second connection for PulseAudio will be made in addition to the VNC connection. By default, audio support within VNC is disabled.</td></tr><tr><td>Destination host</td><td>The destination host to request when connecting to a VNC proxy such as UltraVNC Repeater. This is only necessary if the VNC proxy in use requires the connecting user to specify which VNC server to connect to. If the VNC proxy automatically connects to a specific server, this parameter is not necessary.</td></tr><tr><td>Destination port</td><td>The destination port to request when connecting to a VNC proxy such as UltraVNC Repeater. This is only necessary if the VNC proxy in use requires the connecting user to specify which VNC server to connect to. If the VNC proxy automatically connects to a specific server, this parameter is not necessary.</td></tr></tbody></table>

## Connection Authentication Methods

Keeper Connections can be authenticated using one of the following methods:

* [**Launch Credential**](https://docs.keeper.io/en/keeperpam/privileged-access-manager/authentication-methods#launch-credential)\
  The session to the target is authenticated using the "Launch Credentials" configured directly on the PAM Machine, PAM Database, or PAM Directory record types. The user does not need access to the credentials in order to launch the connection.
* [**Personal/Private Credential**](https://docs.keeper.io/en/keeperpam/privileged-access-manager/authentication-methods#personal-private-credentials)\
  When "Allow users to select credentials from the vault" is enabled, users can choose to authenticate the session to the target using a personal/private credential stored securely in their own Keeper Vault.
* [**Ephemeral Accounts**](https://docs.keeper.io/en/keeperpam/privileged-access-manager/authentication-methods#ephemeral-account)\
  When the ephemeral account feature is enabled on the PAM Machine or PAM database resources, a system-generated, time-limited privileged account is created specifically for the session. This account is deleted automatically after the session ends, eliminating standing privilege. This method is used for [Just-In-Time access](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/just-in-time-access-jit) with no persistent account on the target system.

## Session Recordings - VNC Protocol

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fe3uCXEZO7iUuITKSNU21%2FScreenshot%202025-01-21%20at%2012.35.50%E2%80%AFPM.png?alt=media&#x26;token=b88e8ce5-78ac-4bce-b40f-1c8331249eaf" alt=""><figcaption><p>VNC Session Recordings</p></figcaption></figure>

For this protocol, graphical data, including timing information, is recorded. For more details on the recordings and how to access them, see the [Session Recording & Playback](https://docs.keeper.io/en/keeperpam/privileged-access-manager/session-recording-and-playback) docs.

## Connection Templates

The PAM record type with your target system can also be configured as a Connection template. These templates serve as reusable record types for launching sessions to target systems without needing to predefine a specific hostname or credential. For more information, visit the following:

{% content-ref url="<https://github.com/Keeper-Security/gitbook-secrets-manager/blob/master/privileged-access-manager/connections/connection-templates/README.md>" %}
<https://github.com/Keeper-Security/gitbook-secrets-manager/blob/master/privileged-access-manager/connections/connection-templates/README.md>
{% endcontent-ref %}