How to Install & Securely Connect Using VNC on Ubuntu

· >
How to Install & Securely Connect Using VNCto

Virtual Network Computing (VNC) is a graphical desktop sharing system that allows you to use your keyboard and mouse to control another computer remotely. It is an open-source alternative to the Microsoft remote desktop
protocol (RDP).

This article explains how to install and configure a VNC server on Ubuntu 20.04. We will also show you how to securely connect to the VNC server through an SSH tunnel.

Installing Desktop Environment 

Ubuntu servers are managed from the command line and do not have a desktop environment installed by default. If you run the desktop version of Ubuntu, skip this step.

There are various desktop environments available in Ubuntu repositories. One option is to install Gnome, which is the default desktop environment in Ubuntu 20.04. Another option is to install Xfce. It is a fast, stable, and lightweight desktop environment, which makes it ideal for usage on a remote server.

In this guide, we will install Xfce. Enter the following commands as a user with sudo privileges:

sudo apt updatesudo apt install xfce4 xfce4-goodies

Depending on your system, downloading and installing Xfce packages may take some time.

Installing VNC Server 

There are several different VNC servers available in Ubuntu repositories, such as TightVNCTigerVNC, and x11vnc. Each VNC server has different strengths and weaknesses in terms of speed and security.

We’ll be installing TigerVNC. It is an actively maintained high-performance VNC server. Type the following command to install the package:

sudo apt install tigervnc-standalone-server

Configuring VNC Access 

Once the VNC server is installed, the next step is to create the initial user configuration and set up the password.

Set the user password using the vncpasswd command. Do not use sudo when running the command below:


You will be prompted to enter and confirm the password and whether to set it as a view-only password. If you choose to set up a view-only password, the user will not be able to interact with the VNC instance with the mouse and the keyboard.

Would you like to enter a view-only password (y/n)? n

The password file is stored in the ~/.vnc directory, which is created if not present. Next, we need to configure TigerVNC to use Xfce. To do so, create the following file:

nano ~/.vnc/xstartup
exec startxfce4 

Save and close the file. The commands above are automatically executed whenever you start or restart the TigerVNC server.

The ~/.vnc/xstartup file also needs to have execute permissions. Use the chmod command to set the file permissions:

chmod u+x ~/.vnc/xstartup

If you need to pass additional options to the VNC server, create a file named config (~/.vnc/config) and add one option per line. Here is an example:


You can now start the VNC server using the vncserver command:

New 'server2.techacad.com:1 (techacad)' desktop at :1 on machine server2.techacad.com

Starting applications specified in /home/techacad/.vnc/xstartup
Log file is /home/techacad/.vnc/server2.techacad.com:1.log

Use xtigervncviewer -SecurityTypes VncAuth -passwd /home/techacad/.vnc/passwd :1 to connect to the VNC server.

Note the :1 after the hostname in the output above. This indicates the number of the display port on which the vnc server is running. In this example, the server is running on TCP port 5901 (5900+1). If you create a second instance with vncserver it will run on the next free port i.e :2, which means that the server is running on port 5902 (5900+2).

What is important to remember is that when working with VNC servers, :X is a display port that refers to 5900+X.

You can get a list of all the currently running VNC sessions by typing:

vncserver -list
TigerVNC server sessions:

:1		      5901		    5710

Before continuing with the next step, stop the VNC instance using the vncserver command with a -kill option and the server number as an argument. In this example, the server is running in port 5901 (:1), so we’ll stop it with:

vncserver -kill :1
Killing Xtigervnc process ID 5710... success!


Creating Systemd unit file for VNC

Instead of manually starting the VNC session, let us create a systemd unit file so that you start, stop, and restart the VNC service as needed.

Open your text editor and copy and paste the following configuration into it. Make sure to change the username on line 7 to match your username.

sudo nano /etc/systemd/system/[email protected]

Description=Remote desktop service (VNC)
After=syslog.target network.target

ExecStartPre=/bin/sh -c '/usr/bin/vncserver -kill :%i > /dev/null 2>&1 || :'
ExecStart=/usr/bin/vncserver :%i -geometry 1440x900 -alwaysshared -fg
ExecStop=/usr/bin/vncserver -kill :%i


Save and close the file. Notify systemd that a new unit file is created:

sudo systemctl daemon-reload

Enable the service to start on boot:

sudo systemctl enable [email protected]

The number 1 after the @ sign defines the display port on which the VNC service will run. This means that the VNC server will listen on port 5901, as we discussed in the previous section. Start the VNC service by executing:

sudo systemctl start [email protected]

Connecting to VNC server 

VNC is not an encrypted protocol and can be subject to packet sniffing. The recommended approach is to create an SSH tunnel and securely forward traffic from your local machine on port 5901 to the server on the same port.

Set-Up SSH Tunneling on Linux and macOS 

If you run Linux, macOS, or any other Unix-based operating system on your machine, you can easily create an SSH tunnel with the following command:

ssh -L 5901: -N -f -l vagrant

You will be prompted to enter the user password.

Make sure to replace username and server_ip_address with your username and the IP address of your server.

Set Up SSH Tunneling on Windows 

If you run Windows, you can set up SSH Tunneling using the PuTTY SSH client. Open Putty and enter your server IP Address in the Host name or IP address field.

Under the Connection menu, box, expand SSH, and select Tunnels. Enter the VNC server port (5901) in the Source Port field and enter server_ip_address:5901 in the Destination field and click on the Add button.

Go back to the Session page to save the settings, so you do not need to enter them each time. To the remote server, select the saved session and click on the Open button.

Connecting using Vncviewer 

Now that the SSH tunnel is created, it is time to open your Vncviewer and to connect to the VNC Server at localhost:5901.

You can use any VNC viewer such as TigerVNC, TightVNC, RealVNC, UltraVNC, Vinagre, and VNC Viewer for Google Chrome. We’ll be using TigerVNC. Open the viewer, enter localhost:5901, and click on the Connect button

Enter your user password when prompted, and you should see the default Xfce desktop. You can start interacting with the remote XFCE desktop from your local machine using your keyboard and mouse.


We have shown you how to install and configure a VNC server up and running, on Ubuntu 20.04.

To configure your VNC server to start a display for more than one user, create the initial configuration and set up the password using the vncpasswd command. You will also need to create a new service file using a different port.

Notify of
Inline Feedbacks
View all comments