The term Virtual Network Computing (VNC) refers to a system for remote access to a computer’s desktop environment. It allows users to interact with the interface, access files on storage, run applications, and modify operating system settings. A similar approach is used for managing virtual machines rented from providers like Hostman.
This guide will walk you through setting up a VNC server on a VPS/VDS running Debian, with a secure connection established over SSH. For this example, we’ll use the TightVNC utility, known for its reliable performance even over low-speed connections and seamless file transfers in both directions (to and from the server).
Before starting, ensure you have a prepared Debian server, either in the cloud or locally. Apart from having the operating system ready, it's recommended to configure both a root user and a sudo user (the former without privileges and the latter with them). Additionally, you must allow SSH connections through the firewall.
You will need the following:
By default, a Debian server doesn’t have a graphical interface for easier management, nor does it include a remote management tool. Therefore, the first step is to install both. In this example, we’ll use the Xfce desktop environment and TightVNC, both of which are available in Debian’s official repository.
Update the Package List
First, update the list of available packages on the host system by running:
sudo apt update
Install the Xfce Desktop Environment
Next, install the Xfce desktop environment along with additional utilities:
sudo apt install xfce4 xfce4-goodies
During the installation, the system will prompt you to select a keyboard layout from the provided list. Choose the desired option and press Enter to continue. Once the installation is completed, proceed to install the VNC server.
Install the TightVNC Server
Use the following command to install TightVNC:
sudo apt install tightvncserver
After the installation, you need to configure TightVNC by setting a security password and generating configuration files where connection parameters will be stored.
Initial VNC Configuration
Run the following command to start configuring the VNC server:
vncserver
The program will prompt you to set a password for connecting to the remote system:
You will require a password to access your desktops.
Password:
Verify:
The password must be between 6 and 8 characters long. If a longer password is entered, it will be automatically truncated. Additionally, you can set up a view-only mode, where the connected user can only observe the desktop without being able to control the keyboard or mouse. This mode is useful for demonstrations.
After entering both passwords, the utility will generate a configuration file:
Would you like to enter a view-only password (y/n)? n
xauth: file /home/username/.Xauthority does not exist
New 'X' desktop is your_hostname:1
Creating default startup script /home/username/.vnc/xstartup
Starting applications specified in /home/username/.vnc/xstartup
Log file is /home/username/.vnc/your_hostname:1.log
The VNC server needs to be configured so that it knows what commands to execute upon startup—for example, specifying the desktop environment to be launched when a connection is established. These startup instructions are located in the xstartup
file, which resides in the .vnc
subdirectory of the home directory. This file is automatically created when you launch the vncserver for the first time.
In this guide, we’ll modify the configuration to launch the Xfce graphical interface upon startup. By default, VNC communicates with remote hosts using port 5901, also known as the display port for "display 1". Additional instances can be started on ports 5902, 5903, etc.
Stop the VNC Server
Before configuring VNC on Debian, stop the currently running instance with the following command:
vncserver -kill :1
The output will look something like this:
Killing Xtightvnc process ID 17648
Backup the Original Configuration File
It’s a good practice to create a backup of the original xstartup file, so you can easily revert the settings if anything goes wrong:
mv ~/.vnc/xstartup ~/.vnc/xstartup.bak
Create and Edit a New xstartup File
Now, generate a new xstartup
file and open it for editing using a text editor (in this case, nano):
nano ~/.vnc/xstartup
The commands you add to this file will be automatically executed when the VNC server starts or restarts. Add the following lines to launch the Xfce desktop environment:
#!/bin/bash
xrdb $HOME/.Xresources
startxfce4 &
Here:
xrdb
loads the .Xresources
file, which defines terminal colors, cursor themes, font rendering, and other desktop appearance settings.startxfce4 &
launches the Xfce graphical interface.Make the xstartup File Executable
After editing the configuration file, make it executable by running:
sudo chmod +x ~/.vnc/xstartup
Restart the VNC Server
Finally, restart the VNC server:
vncserver
You’ll see the following output on the screen:
New 'X' desktop is your_hostname:1
Starting applications specified in /home/username/.vnc/xstartup
Log file is /home/username/.vnc/your_hostname:1.log
By default, TightVNC establishes a connection without encryption. However, for our purposes, we require a secure tunnel using the SSH protocol. This involves creating a secure connection on the client side, which forwards data to localhost for handling by the VNC utility.
You can achieve this by running the following command in the terminal (Linux or macOS):
ssh -L 5901:127.0.0.1:5901 -C -N -l user your_server_ip
The -L
option specifies port forwarding. The default configuration uses port 5901 on both the remote and local hosts.
The -C
option enables compression, which reduces the size of data sent between the client and server.
The -N
option tells the SSH protocol that no remote commands will be executed and that it is only being used for port forwarding.
The -l
option specifies the username for the remote connection.
In the above command, replace user
with the username (typically a non-privileged root user) and your_server_ip
with the actual IP address of the remote host.
If you are using Windows, you can create the SSH tunnel using PuTTY, a popular SSH client with a graphical interface. In PuTTY, you need to:
Once you initiate the connection, the system will prompt you to enter the password you set during the initial VNC server configuration. The tunnel will only be activated after successful user authentication. Once connected, you will see the Xfce graphical interface as configured in the .Xresources
file.
You can finalize the desktop setup by selecting "Use default configuration" in the menu. To end the SSH session, press the key combination Ctrl+C. This will close the tunnel and terminate the remote session.
In the final step, we will configure VNC Server as a system service on Debian, enabling you to start, stop, and restart it just like other system services. This ensures that the utility starts automatically with the server. To do this, we'll edit the configuration file /etc/systemd/system/[email protected]
:
sudo nano /etc/systemd/system/[email protected]
The @
symbol is used as an argument to modify the service parameters. It is applied when you need to specify the display port used by the VNC utility. Add the following lines to the file (replace user, group, workingdirectory, and username with your own values):
[Unit]
Description=Start TightVNC server at startup
After=syslog.target network.target
[Service]
Type=forking
User=username
Group=username
WorkingDirectory=/home/username
PIDFile=/home/username/.vnc/%H:%i.pid
ExecStartPre=-/usr/bin/vncserver -kill :%i > /dev/null 2>&1
ExecStart=/usr/bin/vncserver -depth 24 -geometry 1280x800 :%i
ExecStop=/usr/bin/vncserver -kill :%i
[Install]
WantedBy=multi-user.target
The ExecStartPre
command allows you to stop the VNC server if it is already running. The ExecStart
command will restart the server and set the resolution to 1280x800 with 24-bit color.
After editing the file, apply the changes and inform the system about the new file:
sudo systemctl daemon-reload
Next, enable the service:
sudo systemctl enable [email protected]
The 1
after the @
represents the display number where the service should be activated. It will always be "1" unless you change the default configuration, but you can specify another number if needed.
Now, stop the active instance of the VNC server and start the new service:
vncserver -kill :1
sudo systemctl start vncserver@1
You can check if the VNC server is running with:
sudo systemctl status vncserver@1
The result will look like this:
[email protected] - Start TightVNC server at startup
Loaded: loaded (/etc/systemd/system/[email protected]; enabled; vendor preset: enabled)
Active: active (running) since Wed 2018-09-05 16:47:40 UTC; 3s ago
Process: 4977 ExecStart=/usr/bin/vncserver -depth 24 -geometry 1280x800 :1 (code=exited, status=0/SUCCESS)
Process: 4971 ExecStartPre=/usr/bin/vncserver -kill :1 > /dev/null 2>&1 (code=exited, status=0/SUCCESS)
Main PID: 4987 (Xtightvnc)
...
After these steps, the VNC server will be available after the system restarts. Now, initiate the SSH tunnel again:
ssh -L 5901:127.0.0.1:5901 -C -N -l username your_server_ip
This command will create a connection using the client application that forwards the connection from localhost:5901
to your local machine.
We have completed configuring and launching a secure VNC server on a Debian system. Now, you can perform all usual operations: installing and uninstalling software, configuring programs, managing files, surfing the web, etc.