61

Is there a way to view (and control) a remote desktop through SSH? I will not have physical access to the remote host machine.

1

7 Answers 7

66

Method 1 :

This can be achieved with vino vnc server & remmina (both come default with ubuntu; if not install it by running sudo apt-get install remmina). Then Run Following commands from local computer in terminal prompt:

  1. ssh -Y gman@remote. Use trusted X11 forwarding, otherwise it wont work

  2. vino-preferences. It will open vino-preferences.

    vino-preference

  3. Also Click configure network automatically to accept connection. But don't enter any password, its base64 encoded. Then click close. Then run:

    sudo -s
    
    export DISPLAY=:0.0
    
    xhost +
    
    /usr/lib/vino/vino-server & 
    

    It will start the vino server.

  4. Logout from server:

    xhost -
    
    Press CTRL+C twice
    
    exit
    
    exit
    
  5. Then open remmina. Choose vnc under protocol.

    Under basic tab put server address in server field.

    On ssh tab click enable ssh tunnel. Under ssh authentication, it could be password or public key:

    remmina-preference

    Click save. And then double click connection-name(home-desktop as shown in the picture) to start browsing remote desktop.


Method 2:

x11vnc is a simple VNC server and you won't have to mess around with Gnome settings or 500 firewalls, just install x11vnc on all your computers (with puppet or whatever you're using for mass-control).

Then from your local computer run:

ssh user@host -L 5900:localhost:5900 "x11vnc -display :0 -noxdamage"

Obviously swapping user@host for the username and hostname/IP of the remote computer.

And then use a VNC client of your choice to connect to localhost:5900. The SSH command starts a vnc server on the remote computer and then tunnels back that port over SSH. You don't have to open up any ports (as long as you can already SSH).

If your computers have funny display settings, you might do better to leave off the -display :0 segment in the SSH command. x11vnc will then automatically try to find the right display.


Source: askubuntu

9
  • 3
    Your "Method 2" is perfect for a quick access to the physical display remotely without any special permanent settings. I needed to add the -auth parameter as explained in the error message when I executed the command but otherwise works perfectly. Thanks!
    – Pierre
    Feb 18, 2015 at 20:56
  • 1
    @gerky method 3 would be NoMachine, is currently the fastest and free (despite not opensource), and work on android too Aug 20, 2016 at 2:02
  • 1
    For method 2, I had to use -auth guess and run it as root. Very helpful, thanks! Nov 11, 2016 at 15:18
  • 2
    In my case I receive the error: Invalid MIT-MAGIC-COOKIE-1 keyxhost: unable to open display ":0.0" after executing xhost +. Any idea on how to correct this? Apr 15, 2018 at 17:08
  • 3
    According to the Arch wiki, vino-preferences was removed, and Vino is configured using gnome-control-center. Unfortunately, gnome-control-center does not work for me over SSH. Mar 22, 2020 at 20:26
11

Overview of Solution

Assuming you have already setup an OpenSSH Server on your host machine, you must first enable desktop control on your host machine. If you can first enable desktop control on your host machine locally, head to 1a. If you must first enable desktop control on your host machine remotely, head to 1b.

Next create a Remote Desktop Client profile on your client machine in order to connect to the host machine through an SSH tunnel and ultimately view and control the host machine's desktop through an SSH tunnel.

1a. Locally Enable Remote Control of Host Machine

Do the following on the host machine:

vino-preferences
  • vino-preferences also in Dash under Desktop Sharing

enter image description here

  1. Tick Allow other users to view your desktop
  2. Tick Allow other users to control your desktop
  3. Tick Require the user to enter this password
  4. Enter a difficult to guess passphrase
  5. Close

1b. Remotely Enable Remote Control of Host Machine

Do the following on the client machine, replacing 123.123.12.3 with your host machine's IP address:

ssh -Y 123.123.12.3
  • -Y, Enables trusted X11 forwarding. Trusted X11 forwardings are not subjected to the X11 SECURITY extension controls.
vino-preferences
  • vino-preferences also in Dash under Desktop Sharing

enter image description here

  1. Tick Allow other users to view your desktop
  2. Tick Allow other users to control your desktop
  3. Tick Require the user to enter this password
  4. Enter a difficult to guess passphrase
  5. Close

Create Remote Desktop Client profile on your Client Machine

Do the following on the client machine:

remmina
  • remmina also in Dash under Remmina Remote Desktop Client

Ctrl+N or Connection > New

enter image description here

  1. Fill in your IP address [123.123.12.3] where it says Server
  2. Switch to the SSH tab

enter image description here

  1. Tick Enable SSH Tunnel
  2. Point your Desktop Client to your non-standard SSH port
  3. Set your SSH Authentication <username> and mode
  4. Connect

View and Control Host Machine

On the client machine, when asked for <username>'s password, enter it to create the SSH tunnel. When asked for the VNC password, enter the passphrase you previously entered into the host machine.

If successful at this step, you should now be viewing and controlling the host machine's desktop from your client machine through an SSH tunnel.

2
  • 1
    This seems quite comprehensive, but where is the custom port 12345 defined on the host?
    – John T
    Jun 26, 2015 at 10:08
  • I'm guessing you need an ssh command run from the client somewhere, something like: ssh -L 12345:localhost:5900 user@server_ip before using the remote client as described.
    – John T
    Jun 26, 2015 at 10:19
3

I was able to set a fresh Ubuntu 16.04 install from a remote ssh connection with the following script:

#!/bin/bash
export DISPLAY=:0
read -e -p "VNC Password: " -i "ubuntu" password
dconf write /org/gnome/desktop/remote-access/enabled true
dconf write /org/gnome/desktop/remote-access/prompt-enabled false
dconf write /org/gnome/desktop/remote-access/authentication-methods "['vnc']"
dconf write /org/gnome/desktop/remote-access/require-encryption false
dconf write /org/gnome/desktop/remote-access/vnc-password \"\'$(echo -n $password | base64)\'\"
dconf dump /org/gnome/desktop/remote-access/
sudo service lightdm restart

The quoting is important for any of the string settings (single ticks inside quotes). For dconf to be able to write it needs access to XWindows, so that's why the export DISPLAY part is needed. I think you still need to be logged in to the desktop on the actual Ubuntu machine to connect with VNC after this. The dump command is just there to confirm all the settings took hold, you don't really need that.

Optionally you may want to do this if you want to keep the display up all the time:

dconf write /org/gnome/desktop/screensaver/lock-enabled false
dconf write /org/gnome/desktop/screensaver/ubuntu-lock-on-suspend false
dconf write /org/gnome/desktop/session/idle-delay "uint32 0"
2
  1. You could use ssh to start a vnc session
  2. Use Xnest with X11 forwording to remotely start a session and forward it to your current computer. (I do this from time to time with my pi) man page

I use Xnest like so:

  • Xnest :1 -ac &
  • then DISPLAY=:1 . /etc/X11/Xsession
1
  • 1
    Unfortunately, xnest is also too slow to work over SSH a decade later.
    – alamar
    Jul 24, 2023 at 22:24
1

How to start Vino server remotely without forwarding X (command line-only)

Log on the remote computer as the user who will share their desktop and forward port 5900 to the same port on localhost. With PuTTY, the redirection is set in Connection/SSH/Tunnels. With a command line, use:

 ssh -L 5900:localhost:5900 user@remote-computer

Install vino-server if it is not already installed. For example:

sudo apt install vino

Enable desktop sharing (matching the display number on 1st and 2nd lines):

echo $DISPLAY
export DISPLAY=:0
dbus-launch --exit-with-session gsettings set org.gnome.Vino enabled true
dbus-launch --exit-with-session gsettings set org.gnome.Vino prompt-enabled false
dbus-launch --exit-with-session gsettings set org.gnome.Vino require-encryption false
/usr/lib/vino/vino-server

Start a VNC viewer and connect to localhost for the VNC server address.

1
  • 2
    Got the following . Seems like this all assumes you are already logged in to a GUI console? No protocol specified Failed to connect to Mir: Failed to connect to server socket: No such file or directory Unable to init server: Could not connect: Connection refused Cannot open display: Run 'vino-server --help' to see a full list of available command line options
    – algal
    May 25, 2018 at 21:11
1

In the server PC.

  • Open 'vino-preferences' from the terminal or 'Desktop Sharing' using dash.

vino-preferences

In the client PC (from where you want to control the server UI).

  • Keep the settings as shown in the images below (with changes at the place of username and IP).

*Basic* tab *Advanced* tab *SSH* tab

Pitfalls.

  • When I tried to set the vino-preferences in the server from a remote PC using SSH, it got changed, but the connection did not happen. I had to do it in the server machine directly (not remotely). I don't' know the reason for this behaviour.
0

based on @Khurshid Alam answer I present the following snippet:

ssh $TARGETHOST -L 5900:localhost:5900 "x11vnc -localhost -display :0 -noxdamage" &; sleep 10 && vinagre localhost

  • It is one command that does not require any interaction

  • It creates the SSH tunnel with port forwarding, starts x11vnc in a reasonably safe way and launches and connects the VNC viewer

  • It requires x11vnc on the target host, but no further configuration

  • It requires vinagre on your PC, but you can trivially change it for another VNC viewer
3
  • mnagel's method is working for me, but I have to open a second terminal to open vinagre (sorry can't add comment because of silly reputation-rule)
    – andrey
    Nov 21, 2021 at 19:59
  • It seems to require X to be running on remote. This is not something to take for granted.
    – alamar
    Jul 24, 2023 at 22:35
  • (sleep 10 && vinagre localhost) & ssh 192.168.1.106 -L 5900:localhost:5900 "vncserver :0; cat" is what I ended up with, when it doesn't
    – alamar
    Jul 25, 2023 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .