Remote Desktop Access With VNC And SSH Tunnels
Table of Contents
In this article we will discuss about how to access a Linux desktop remotely with VNC. We will use a VPS with Docker Scripts and sshtunnels as an intermediary between the VNC server and the VNC viewer, in order to enable a secure communication between them.
1 Share the desktop with a VNC server
Actually we want to use a VNC server that can share the current X11
display (numbered :0). The program x11vnc
can do it, but its VNC
traffic is not optimized and it is not efficient (the VNC connection
is either slow or with bad quality).
TigerVNC provides a better option. You should install the package
tigervnc-scraping-server
which provides the command x0vncserver
:
apt install tigervnc-scraping-server which x0vncserver
To start sharing the desktop do:
x0vncserver -SecurityTypes=none -AlwaysShared=1
To test it, install also a VNC viewer and connect to localhost:5900
,
like this:
apt install tigervnc-viewer vncviewer localhost:5900
2 Install sshtunnels in an intermediary VPS
The installation steps are listed here: https://gitlab.com/docker-scripts/sshtunnels#installation
- Install docker:
curl -fsSL https://get.docker.com -o get-docker.sh sh get-docker.sh
- Install docker-scripts:
apt install m4 git git clone https://gitlab.com/docker-scripts/ds /opt/docker-scripts/ds cd /opt/docker-scripts/ds/ make install
- Install sshtunnels:
ds pull sshtunnels ds init sshtunnels @sshtunnels cd /var/ds/sshtunnels/ vim settings.sh ds make
3 Create and use a tunnel
- On the VPS server create a tunnel for the port
5900
on our VNC server machine:cd /var/ds/sshtunnels/ ds tunnel-add desktop 5900
This command will create the directory
tunnels/desktop.5900/
. - Copy to the VNC server machine the script
tunnels/desktop.5900/share-port-5900.sh
, and run it like this:chmod 700 share-port-5900.sh ./share-port-5900.sh
This will open a ssh tunnel for port
5900
, from the VNC server machine to the VPS. It will also create the cron job/etc/cron.d/share-port-5900
, to check and make sure periodically (each minute) that this tunnel is open. - Copy on the VNC viewer computer the script
tunnels/desktop.5900/connect-to-desktop-5900.sh
and run it like this:chmod 700 connect-to-desktop-5900.sh ./connect-to-desktop-5900.sh 5900
This will open a tunnel for the port
5900
from our VNC viewer computer to the VPS. The intermediary VPS will connect both tunnels (from the VNC server and from the VNC viewer), and the result will be that if we openlocalhost:5900
on the VNC viewer computer, we will actually be accessing the port5900
on the VNC server computer. - If we run the command
./connect-to-desktop-5900.sh 5901
on the VNC viewer computer, then instead of usinglocalhost:5900
(on a VNC viewer), we should uselocalhost:5901
(and again it will access the port5900
on the VNC server).
4 Close and destroy a tunnel
- On VNC server computer run:
./share-port-5900.sh stop
This will close the tunnel and also delete the cron job
/etc/cron.d/share-port-5900
. - On the VNC viewer computer run:
./connect-to-desktop-5900.sh stop
- On the VPS server run:
cd /var/ds/sshtunnels/ ds tunnel-del desktop 5900
This will delete the directory
tunnels/desktop.5900/
and stop accepting connections from the VNC server and VNC viewer computers.