Remote Desktop

Remote Desktop

syn-remote puts this desktop on a VNC viewer somewhere else — including when nobody is sitting at it.

syn-remote on                # start it now, and at every login
syn-remote address           # how to connect to it
syn-remote password          # the password a viewer is asked for
syn-remote status            # what it is doing
syn-remote off               # stop it, and stop it starting at login

Settings ▸ Remote Desktop is the same thing in a window.

---

It is a wrapper, and wayvnc is the server

wayvnc is the wlroots-native VNC server. It captures the screen through zwlr_screencopy_manager_v1 and drives the seat through zwp_virtual_pointer_manager_v1 and zwp_virtual_keyboard_manager_v1. synui implements all three and hands them to any native client, so nothing here goes through a desktop portal and nothing prompts.

"Wayland can't do remote desktop" does not apply here. All three reasons that is said are about other stacks:

• GNOME and KDE gate capture behind a portal that asks a human, per session. That is a policy, and it makes unattended access impossible by design.
• xdg-desktop-portal-wlr implements ScreenCast but not RemoteDesktop, so there is no input injection through the portal. That is why portal-based tools can watch a wlroots desktop and cannot touch it — going native sidesteps it.
• Nothing exists to connect to before somebody logs in. That one is true here, on any Wayland system, and syn-remote status says so rather than failing with an error that reads like a bug.

---

Waking a screen that has gone dark

A blanked output cannot be captured at all. Once synui's idle blank stage has fired, screencopy answers failed to copy output — a viewer gets nothing, and there is no frame to click on to get out of it. power_blank_timeout defaults to 600 seconds, so an unattended machine would go dark to a viewer ten minutes after the last keypress and stay dark.

That is what the wrapper is for. When somebody connects it turns the outputs back on and holds a real idle inhibitor; when the last viewer leaves it releases it, so the machine goes back to sleeping normally. Two viewers is one screen: the wake happens once, and the release waits for the last one.

---

Where it listens

This machine only (default)	Bound to 127.0.0.1. Reach it from elsewhere over an SSH tunnel.
The network	syn-remote listen lan — every device on the LAN can reach it.

⛔ The firewall does not stand behind this. synnet's base policy is default-drop on input and accepts everything from 10/8, 172.16/12 and 192.168/16. A port bound to 0.0.0.0 is therefore not "open but firewalled" — it is reachable by every device on the network, and there is no second door to unlock afterwards. The certificate and the password are what stand in the way.

From another machine, with the default loopback binding:

ssh -N -L 5900:localhost:5900 you@your-machine

then point a VNC viewer at localhost:5900. syn-remote address prints that line with the right names in it.

---

Who may connect

The connection always carries TLS: wayvnc's enable_auth requires a certificate, a key and a password together, so there is no password-without-encryption — which is the right way round, given VNC's own authentication is DES with an eight-character key. The certificate is self-signed, made once, and lives in ~/.config/syn-remote/.

A generated password (default)	Twenty characters from /dev/urandom. syn-remote password prints it, syn-remote password new rolls it.
Your account password	syn-remote auth pam — the same three-try lockout as any other login on the machine.

---

Waking the machine itself

Three different problems wear the same word:

1. The screen is asleep. Handled above — the wrapper wakes it.
2. The machine is suspended. That needs Wake-on-LAN: a magic packet to a NIC that is configured to listen for one. Many NICs drop the setting across a reboot, so it wants ethtool -s <iface> wol g from a boot-time unit.
3. Nobody has logged in. There is no compositor, so there is nothing to capture. A machine meant to be reached this way wants autologin.

---

What it is not

syn-remote owns no part of the VNC protocol, the encryption or the credentials — wayvnc does all of it. What the wrapper adds is the screen wake, the idle inhibitor, the loopback default, the generated certificate and password, and one place to read the state from.

See also: The-Desktop, Settings, Commands.