diff --git a/common/rfb/SSecurityVncAuth.cxx b/common/rfb/SSecurityVncAuth.cxx
index 29a3b96..ca81bf3 100644
--- a/common/rfb/SSecurityVncAuth.cxx
+++ b/common/rfb/SSecurityVncAuth.cxx
@@ -40,9 +40,16 @@
 
 static LogWriter vlog("SVncAuth");
 
+StringParameter SSecurityVncAuth::vncAuthPasswdFile
+("PasswordFile", "Password file for VNC authentication", "", ConfServer);
+AliasParameter rfbauth("rfbauth", "Alias for PasswordFile",
+		       &SSecurityVncAuth::vncAuthPasswdFile, ConfServer);
+VncAuthPasswdParameter SSecurityVncAuth::vncAuthPasswd
+("Password", "Obfuscated binary encoding of the password which clients must supply to "
+ "access the server", &SSecurityVncAuth::vncAuthPasswdFile);
 
-SSecurityVncAuth::SSecurityVncAuth(VncAuthPasswdGetter* pg_)
-  : sentChallenge(false), responsePos(0), pg(pg_)
+SSecurityVncAuth::SSecurityVncAuth(void)
+  : sentChallenge(false), responsePos(0), pg(&vncAuthPasswd)
 {
 }
 
@@ -85,3 +92,45 @@
 
   return true;
 }
+
+VncAuthPasswdParameter::VncAuthPasswdParameter(const char* name,
+                                               const char* desc,
+                                               StringParameter* passwdFile_)
+: BinaryParameter(name, desc, 0, 0, ConfServer), passwdFile(passwdFile_) {
+}
+
+char* VncAuthPasswdParameter::getVncAuthPasswd() {
+  ObfuscatedPasswd obfuscated;
+  getData((void**)&obfuscated.buf, &obfuscated.length);
+
+  if (obfuscated.length == 0) {
+    if (passwdFile) {
+      CharArray fname(passwdFile->getData());
+      if (!fname.buf[0]) {
+        vlog.info("neither %s nor %s params set", getName(), passwdFile->getName());
+        return 0;
+      }
+
+      FILE* fp = fopen(fname.buf, "r");
+      if (!fp) {
+        vlog.error("opening password file '%s' failed",fname.buf);
+        return 0;
+      }
+
+      vlog.debug("reading password file");
+      obfuscated.buf = new char[128];
+      obfuscated.length = fread(obfuscated.buf, 1, 128, fp);
+      fclose(fp);
+    } else {
+      vlog.info("%s parameter not set", getName());
+    }
+  }
+
+  try {
+    PlainPasswd password(obfuscated);
+    return password.takeBuf();
+  } catch (...) {
+    return 0;
+  }
+}
+