Installing a VNC server on Ubuntu gives you a stable graphical remote control session from any desktop or mobile device. This guide walks through secure setup on a standard Ubuntu server using TigerVNC.
Follow the structured steps below to deploy, configure, and maintain a reliable remote desktop that works across firewalls and integrates cleanly with your existing workflow.
| Package | Role in VNC Setup | Default Display | Typical Port |
|---|---|---|---|
| tigervnc-standalone-server | Provides the VNC server and xstartup logic | :1 | 5901 |
| tigervnc-common | Shared libraries and utilities | — | — |
| gnome-panel | Minimal panel for legacy GNOME sessions | — | — |
| xfce4 | Lightweight desktop environment for better performance | — | — |
Prerequisites and System Readiness
Start by updating packages and installing essentials so the system can compile and run the VNC stack without missing dependencies.
Update System Packages
Run a full upgrade and cleanup to avoid conflicts between old and new library versions during VNC server installation.
Install Base Utilities
Install tools like wget, curl, and unattended-upgrades so you can fetch configs and apply patches without manual intervention later.
Install TigerVNC Server Packages
Add the official TigerVNC packages and a lightweight desktop so the remote session has a consistent look and feel.
Install TigerVNC and Desktop Environment
Install tigervnc-standalone-server, tigervnc-common, and xfce4 to keep resource usage low while still providing a modern desktop experience.
Verify Installed Binaries
Check that vncserver and vncpasswd are available in PATH, confirming the VNC server binaries are correctly installed.
Configure VNC Service and Display Parameters
Set up user passwords, service files, and xstartup scripts so the display manager launches the right desktop over VNC.
Set VNC User Password
Run vncpasswd as the target user to create an encrypted password that the VNC server will prompt for at connection time.
Create Systemd Unit for Display :1
Write a dedicated systemd service file so the VNC server starts automatically on boot and restarts on failure.
Configure xstartup for Session Launch
Tailor xstartup to start xfce4-session or a custom window manager, ensuring the remote desktop behaves like a normal GUI session.
Firewall, Network, and Service Management
Open the correct ports, enable the service, and test connectivity so remote clients can reach the desktop reliably.
Open VNC Ports in UFW
Allow TCP 5901 and optionally 6001, then reload firewall rules to make the new service visible from other hosts.
Enable and Start the Service
Enable the systemd unit for automatic startup, start it immediately, and verify that the listener is bound on the expected port.
Test Local and Remote Connections
Use vncviewer or a remote client to connect to the server IP and display number, confirming that the desktop renders without errors.
Hardening, Maintenance, and Key Recommendations
- Use SSH tunnels or a VPN to avoid exposing VNC ports directly to the internet.
- Keep the system and VNC packages updated with regular unattended-upgrades.
- Assign strong passwords with vncpasswd and rotate them periodically.
- Restrict firewall rules to specific source networks and avoid wide-open rules.
- Monitor system logs and service status to catch authentication failures early.
- Consider using X11VNC for temporary support sessions and TigerVNC for persistent desktops.
FAQ
Reader questions
How do I change the resolution and color depth for a smoother remote experience?
Edit the systemd unit or wrapper script to include geometry and depth flags such as -geometry 1920x1080 -depth 24, then reload and restart the service.
What should I do if the VNC session starts but shows a blank or black screen?
Check xstartup for correct desktop launch commands, ensure the desktop environment packages are installed, and verify that the user’s .Xauthority file is readable by the VNC process.
Can I run multiple VNC displays on the same Ubuntu server for different users?
Yes, create separate systemd units and password files for each display number, choose unique ports, and make sure each user has an independent xstartup configuration.
How do I securely expose VNC over the internet without opening unnecessary risk?
Use SSH tunneling or a VPN for encryption, restrict source IPs with UFW, enforce strong passwords, and consider a reverse proxy with TLS termination to limit direct exposure of the VNC port.