Introduction
VNC (Virtual Network Computing) is a system that enables users to connect and interact with graphical desktops of remote computers. It can transmit screen updates, and keyboard and mouse events, over the network.
VNC is useful when you need a graphical desktop environment for your server.
XFCE is a lightweight desktop environment. Because it has low system resource requirements, and because many VNC users are familiar with it, we will use XFCE in this tutorial. However, you can also use your favorite desktop environment, such as Gnome or KDE, instead.
In this tutorial we will set up a Debian 8 server, install the XFCE desktop environment on it, and connect it to via VNC. Additionally, we will create a startup script for VNC Server and secure it over SSH.
Prerequisities
Please complete the following prerequisites.
Debian 8 (or 8.1) Droplet with root access. 512 MB of RAM is enough to run VNC and XFCE, but you might need a bigger Droplet depending on what you plan to do with the graphical interface
VNC viewer (client) on your computer to connect to your server. In this tutorial, we will use UltraVNC on Windows, but you can use other VNC clients. You can download UltraVNC here. OS X comes with a built in VNC client called Screen Sharing
SSH client to establish a secure connection over SSH. We will use PuTTY for Windows. You can download PuTTY here. On OS X, just use the built in Terminal application
Step 1 — Installing VNC and XFCE
In this step, we will install VNC Server and the XFCE desktop environment, with additional software and an icon pack.
Update your server’s package lists:
apt-get update
Upgrade the packages themselves:
apt-get -y upgrade
Then, we will install tightvncserver and XFCE4 with some useful add-ons, and an icon theme:
apt-get install xfce4 xfce4-goodies gnome-icon-theme tightvncserver
By default there is no browser installed. You can install iceweasel (which is a rebranded version of Mozilla Firefox for Debian) if you want to access the web from your VNC connection:
apt-get install iceweasel
Step 2 — Creating a VNC User
We will create a separate user for VNC connections, to keep things secure and tidy. Using sudo is highly recommended, instead of using the root user directly for your VNC server.
You can add a user named vnc to your Debian Droplet by using this command:
adduser vnc
Give a password to your new user. You can skip all other questions by simply pressing ENTER.
Install sudo by executing this command:
apt-get install sudo
Add your new vnc user to the sudo group, which will give permissions to that user to execute root commands.
gpasswd -a vnc sudo
Let’s switch to the vnc user:
su - vnc
Step 3 — Starting and Stopping Your VNC Server
As our newly created vnc user, we can start VNC Server and test our connection.
Start VNC Server:
vncserver
As it is your first time running the server, you will be asked to set a password that clients will use to connect. Keep this password in mind for later! You can also set a view-only password, which will allow users to see the screen but not interact with it. Passwords should be 6-8 characters.
You will get a notice about your display number when the server is started.
xauth: file /home/vnc/.Xauthority does not exist
New 'X' desktop is vnc:1
Creating default startup script /home/vnc/.vnc/xstartup
Starting applications specified in /home/vnc/.vnc/xstartup
Log file is /home/vnc/.vnc/vnc:1.log
By default, VNC connections are served on ports starting at 5901 for the first display. Your second display will be served on port 5902, etc.
Don’t stop the server now, but we’re including the stop command for reference.
Use this command to stop your VNC server on Display 1 (and port 5901):
vncserver -kill :1
:1 is the display number you want to kill.
You can start VNC Server manually when you want to connect again. We’ll create a service for VNC Server in a later step.
Step 4 — Connecting from a VNC Client
You can now connect to your VNC server. Open your local VNC client, which will vary depending on your operating system.
On Windows, you can use UltraVNC here.
On OS X, you can use the built-in Screen Sharing app or access this app through Safari. In Safari, you can enter vnc://your_server_ip:5901
For your VNC Server address, enter your_server_ip:5901 and use the password you just set for your VNC connection.
You can select the Use default config button on the XFCE welcome screen to get started easily:
Now you can use your remote desktop!
Step 5 — Creating a systemd Service to Start VNC Server Automatically
In this section we’ll add VNC Server to systemd. Using a service can be useful to start and stop your VNC server, and also to start it automatically when your Droplet is rebooted.
First, let’s kill the current instance:
vncserver -kill :1
Create a simple script to manage and configure our VNC server easily:
As the vnc or other sudo user, create a script file by using your favorite text editor.
sudo nano /usr/local/bin/myvncserver
Add these contents exactly. This script provides VNC with a few parameters for startup.
/usr/local/bin/myvncserver
#!/bin/bash
PATH="$PATH:/usr/bin/"
DISPLAY="1"
DEPTH="16"
GEOMETRY="1024x768"
OPTIONS="-depth ${DEPTH} -geometry ${GEOMETRY} :${DISPLAY}"
case "$1" in
start)
/usr/bin/vncserver ${OPTIONS}
;;
stop)
/usr/bin/vncserver -kill :${DISPLAY}
;;
restart)
$0 stop
$0 start
;;
esac
exit 0
You can modify the script to change the color depth or resolution of your VNC connection.
If you are using nano, you can save the file via CTRL+O and exit via CTRL+X.
Make the file executable:
sudo chmod +x /usr/local/bin/myvncserver
Our script will help us to modify settings and start/stop VNC Server easily.
If you’d like, you can call the script manually to start/stop VNC Server on port 5901 with your desired configuration.
sudo /usr/local/bin/myvncserver start
sudo /usr/local/bin/myvncserver stop
sudo /usr/local/bin/myvncserver restart
We can now create a unit file for our service. Unit files are used to describe services and tell the computer what to do to start/stop or restart the service.
sudo nano /lib/systemd/system/myvncserver.service
Copy these commands to the service file. Our service will simply call the startup script above with the user vnc.
/lib/systemd/system/myvncserver.service
[Unit]
Description=Manage VNC Server on this droplet
[Service]
Type=forking
ExecStart=/usr/local/bin/myvncserver start
ExecStop=/usr/local/bin/myvncserver stop
ExecReload=/usr/local/bin/myvncserver restart
User=vnc
[Install]
WantedBy=multi-user.target
Now we can reload systemctl and enable our service:
sudo systemctl daemon-reload
sudo systemctl enable myvncserver.service
You’ve enabled your new service now. Use these commands to start, stop or restart the service using the systemctl command:
sudo systemctl start myvncserver.service
sudo systemctl stop myvncserver.service
sudo systemctl restart myvncserver.service
Now you can run VNC Server as a service on your Droplet.
Step 6 — Securing Your VNC Server with SSH Tunneling
By default VNC connections don’t use encryption, so it is recommended to use an SSH Tunnel to secure your session.
To do that, we will only let our VNC server serve on localhost.
You can do that by adding -localhost to the OPTIONS line in the startup script created in the previous step.
First, stop the VNC server:
sudo systemctl stop myvncserver.service
Edit your configuration script:
sudo nano /usr/local/bin/myvncserver
Change this line:
/usr/local/bin/myvncserver
. . .
OPTIONS="-depth ${DEPTH} -geometry ${GEOMETRY} :${DISPLAY}"
. . .
Replace it with:
/usr/local/bin/myvncserver
. . .
OPTIONS="-depth ${DEPTH} -geometry ${GEOMETRY} :${DISPLAY} -localhost"
. . .
Restart the VNC server:
sudo systemctl start myvncserver.service
Now you can’t directly connect to your VNC server from your remote computer.
Windows:
We will use PuTTY to create an SSH Tunnel and then connect through the tunnel we have created.
Open PuTTY.
From the left menu, go to the Connection->SSH->Tunnels section.
In the Add New Forwarded Port section, enter 5901 as Source port and localhost:5901 as Destination.
Click the Add button.
You can now go to the Session section in the left menu.
Enter your Droplet’s IP address in the Host Name (or IP address) field.
Click the Open button to connect. You can also save these options for later use.
Log in with your vnc user.
Keep the PuTTY window open while you make your VNC connection.
Now you can use your VNC viewer as usual. Just enter localhost::5901 as the address, and keep your SSH connection live in the background.
OS X:
To establish an SSH tunnel, use the following line in Terminal:
ssh vnc@your_server_ip -L 5901:localhost:5901
Authenticate as normal for the vnc user for SSH. Then, in the Screen Sharing app, use localhost:5901.
Conclusion
Now you can use a shared remote desktop on your Debian 8 server.
Use it to configure your server, or share your screen with others.
