VNC Timeout / LC_PVE_TICKET not set, VNC proxy without password is forbidden

Ne00n

Well-Known Member
Apr 30, 2017
32
3
48
32
Hey,

When I request a VNC session from Proxmox using the API, the timeout is pretty short with less than 5 seconds.
Anybody got an idea if its possible to adjust it? So far I didn't find any way yet....

Regards,
Ne00n
 
Hey,

Oh sorry, I should have mention that.
I am using as per documentation: https://pve.proxmox.com/pve-docs/api-viewer/#/nodes/{node}/qemu/{vmid}/vncproxy

However, the code also appends ?websocket=1, using this since Proxmox 5.x.
Removing websocket=1, despite not using websockets at all, just a regular vnc client, makes the vnc proxy not reachable, given my testing right now on Proxmox 7.3-4.

Something is wrong, I would expect it to work without websocket set to true, my guess this is the actual reason why it does timeout after 5 seconds.
 
It seems like I did implement it wrongly, since it was behaving buggy.

I ended up passing websocket=1 to
https://pve.proxmox.com/pve-docs/api-viewer/#/nodes/{node}/qemu/{vmid}/vncproxy

Which made the vncproxy work.
However, I never intended to use websocks, I just wanted the VNC to work.

Which explains why it did timeout so fast, since I was expecting me to call shortly after.
https://pve.proxmox.com/pve-docs/api-viewer/#/nodes/{node}/qemu/{vmid}/vncwebsocket

So I just left the websocket=1 out, breaks vncproxy again.
I ended up getting.

LC_PVE_TICKET not set, VNC proxy without password is forbidden
TASK ERROR: Failed to run vncproxy.

So obviously, I googled that.
https://forum.proxmox.com/threads/l...iddentask-error-failed-to-run-vncproxy.98192/

The fix that suggested modding the ssh(d)_config isn't working for me either.
I actually found ONE node where the vncproxy just works out of the box, compared to 4, including my local dev proxmox where its not working at all.

I checked everything, sshd_config, ssh_config, /etc/ssh/ssh_config.d, even pveversion.
All of them are up to date, so they did return the same results, except libqb0 but that is also installed on my non working dev vm.

So nada, any ideas?
 
Same issue with pvesh. @Moayad
Code:
pvesh create /nodes/prox/qemu/100/vncproxy

Runs fine, however when connecting, it results in the same error.
Code:
Feb  4 08:31:51 prox pvesh[8575]: <root@pam> starting task UPID:prox:00002180:0005B88F:63DE5E47:vncproxy:100:root@pam:
Feb  4 08:31:51 prox pvesh[8576]: starting vnc proxy UPID:prox:00002180:0005B88F:63DE5E47:vncproxy:100:root@pam:
Feb  4 08:31:53 prox pvesh[8576]: Failed to run vncproxy.
 
I forgot to mention, that a noVNC session via the WebUI works without issues as it has been before.
pveversion -v output

Code:
proxmox-ve: 7.3-1 (running kernel: 5.15.83-1-pve)
pve-manager: 7.3-4 (running version: 7.3-4/d69b70d4)
pve-kernel-5.15: 7.3-1
pve-kernel-helper: 7.3-1
pve-kernel-5.13: 7.1-9
pve-kernel-5.4: 6.4-1
pve-kernel-5.15.83-1-pve: 5.15.83-1
pve-kernel-5.13.19-6-pve: 5.13.19-15
pve-kernel-5.13.19-4-pve: 5.13.19-9
pve-kernel-5.4.106-1-pve: 5.4.106-1
pve-kernel-5.4.101-1-pve: 5.4.101-1
ceph-fuse: 14.2.21-1
corosync: 3.1.7-pve1
criu: 3.15-1+pve-1
glusterfs-client: 9.2-1
ifupdown: 0.8.36+pve2
libjs-extjs: 7.0.0-1
libknet1: 1.24-pve2
libproxmox-acme-perl: 1.4.3
libproxmox-backup-qemu0: 1.3.1-1
libpve-access-control: 7.3-1
libpve-apiclient-perl: 3.2-1
libpve-common-perl: 7.3-1
libpve-guest-common-perl: 4.2-3
libpve-http-server-perl: 4.1-5
libpve-storage-perl: 7.3-1
libqb0: 1.0.5-1
libspice-server1: 0.14.3-2.1
lvm2: 2.03.11-2.1
lxc-pve: 5.0.0-3
lxcfs: 4.0.12-pve1
novnc-pve: 1.3.0-3
proxmox-backup-client: 2.3.1-1
proxmox-backup-file-restore: 2.3.1-1
proxmox-mini-journalreader: 1.3-1
proxmox-offline-mirror-helper: 0.5.0-1
proxmox-widget-toolkit: 3.5.3
pve-cluster: 7.3-1
pve-container: 4.4-2
pve-docs: 7.3-1
pve-edk2-firmware: 3.20220526-1
pve-firewall: 4.2-7
pve-firmware: 3.6-2
pve-ha-manager: 3.5.1
pve-i18n: 2.8-1
pve-qemu-kvm: 7.1.0-4
pve-xtermjs: 4.16.0-1
qemu-server: 7.3-2
smartmontools: 7.2-pve3
spiceterm: 3.2-2
swtpm: 0.8.0~bpo11+2
vncterm: 1.7-1
zfsutils-linux: 2.1.7-pve1
 
The thing that is even more wired, is for some VM's on the same Node, VNC works via
Make sure you have NOT removed the "AcceptEnv LANG LC_*" from /etc/ssh/sshd_config - that causes this problem. (Or limited it in any way)
As said above, I already checked them.
I did not find any difference within these configs when I compared the machine that doesn't have the error and these who do.
 
Code:
root@bender:~# export LC_THIS_IS_A_TEST=success
root@bender:~# echo $LC_THIS_IS_A_TEST
success
root@bender:~# ssh fry
Last login: Thu Feb  2 01:13:50 2023
root@fry:~# echo $LC_THIS_IS_A_TEST
success
root@fry:~#
 
Code:
root@bender:~# export LC_THIS_IS_A_TEST=success
root@bender:~# echo $LC_THIS_IS_A_TEST
success
root@bender:~# ssh fry
Last login: Thu Feb  2 01:13:50 2023
root@fry:~# echo $LC_THIS_IS_A_TEST
success
root@fry:~#
I don't run a Proxmox Cluster, these are all single instances.
However, I tried it anyway.

Code:
Last login: Tue Feb  7 13:10:26 2023 from ::1
root@prox:~# export LC_THIS_IS_A_TEST=success
root@prox:~#  echo $LC_THIS_IS_A_TEST
success
root@prox:~# ssh root@localhost
Linux prox.bla.rocks 5.15.83-1-pve #1 SMP PVE 5.15.83-1 (2022-12-15T00:00Z) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Feb  7 13:10:34 2023 from .......
root@prox:~# echo $LC_THIS_IS_A_TEST
success
root@prox:~# exit
 
It seems like I did implement it wrongly, since it was behaving buggy.

I ended up passing websocket=1 to
https://pve.proxmox.com/pve-docs/api-viewer/#/nodes/{node}/qemu/{vmid}/vncproxy

Which made the vncproxy work.
However, I never intended to use websocks, I just wanted the VNC to work.

The environment variable is only set when websocket is used, but because of changes in QEMU, not passing a password via the variable was disallowed.

Feel free to open a bug report on our bugtracker: https://bugzilla.proxmox.com/
 
Okay, but do you got any explanation why I sometimes get connection refused using this "workaround" ?
Despite it seems to be running.

edit:

Code:
tcp        0      0 127.0.0.1:5900          0.0.0.0:*               LISTEN      0          905292292  3753452/vncterm     
tcp6       0      0 :::5900                 :::*                    LISTEN      0          905292293  3753452/vncterm

It seems to be listening only on IPv6, but why?
 
Last edited:
Okay, but do you got any explanation why I sometimes get connection refused using this "workaround" ?
Despite it seems to be running.
What is the exact error message you get? What are the requests and how do you submit them? From a quick look, the timeout seems to hard-coded to 10 seconds.

Maybe also have a look at https://pve.proxmox.com/wiki/VNC_Client_Access as an alternative.

Code:
tcp        0      0 127.0.0.1:5900          0.0.0.0:*               LISTEN      0          905292292  3753452/vncterm    
tcp6       0      0 :::5900                 :::*                    LISTEN      0          905292293  3753452/vncterm

It seems to be listening only on IPv6, but why?
As indicated by the first line, it should also be listening on 127.0.0.1?
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!