Remote Desktop Access With VNC And SSH Tunnels

Reading time ~2 minutes

Remote Desktop Access With VNC And SSH Tunnels

Remote Desktop Access With VNC And SSH Tunnels

In this article we will discuss about how to access a Linux desktop remotely with VNC. We will use a VPS with Docker Scripts and sshtunnels as an intermediary between the VNC server and the VNC viewer, in order to enable a secure communication between them.

1 Share the desktop with a VNC server

Actually we want to use a VNC server that can share the current X11 display (numbered :0). The program x11vnc can do it, but its VNC traffic is not optimized and it is not efficient (the VNC connection is either slow or with bad quality).

TigerVNC provides a better option. You should install the package tigervnc-scraping-server which provides the command x0vncserver:

apt install tigervnc-scraping-server
which x0vncserver

To start sharing the desktop do:

x0vncserver -SecurityTypes=none -AlwaysShared=1

To test it, install also a VNC viewer and connect to localhost:5900, like this:

apt install tigervnc-viewer
vncviewer localhost:5900

2 Install sshtunnels in an intermediary VPS

The installation steps are listed here: https://gitlab.com/docker-scripts/sshtunnels#installation

  1. Install docker:
    curl -fsSL https://get.docker.com -o get-docker.sh
    sh get-docker.sh
    
  2. Install docker-scripts:
    apt install m4 git
    git clone https://gitlab.com/docker-scripts/ds /opt/docker-scripts/ds
    cd /opt/docker-scripts/ds/
    make install
    
  3. Install sshtunnels:
    ds pull sshtunnels
    ds init sshtunnels @sshtunnels
    cd /var/ds/sshtunnels/
    vim settings.sh
    ds make
    

3 Create and use a tunnel

  1. On the VPS server create a tunnel for the port 5900 on our VNC server machine:
    cd /var/ds/sshtunnels/
    ds tunnel-add desktop 5900
    

    This command will create the directory tunnels/desktop.5900/.

  2. Copy to the VNC server machine the script tunnels/desktop.5900/share-port-5900.sh, and run it like this:
    chmod 700 share-port-5900.sh
    ./share-port-5900.sh
    

    This will open a ssh tunnel for port 5900, from the VNC server machine to the VPS. It will also create the cron job /etc/cron.d/share-port-5900, to check and make sure periodically (each minute) that this tunnel is open.

  3. Copy on the VNC viewer computer the script tunnels/desktop.5900/connect-to-desktop-5900.sh and run it like this:
    chmod 700 connect-to-desktop-5900.sh
    ./connect-to-desktop-5900.sh 5900
    

    This will open a tunnel for the port 5900 from our VNC viewer computer to the VPS. The intermediary VPS will connect both tunnels (from the VNC server and from the VNC viewer), and the result will be that if we open localhost:5900 on the VNC viewer computer, we will actually be accessing the port 5900 on the VNC server computer.

  4. If we run the command ./connect-to-desktop-5900.sh 5901 on the VNC viewer computer, then instead of using localhost:5900 (on a VNC viewer), we should use localhost:5901 (and again it will access the port 5900 on the VNC server).

4 Close and destroy a tunnel

  • On VNC server computer run:
    ./share-port-5900.sh stop
    

    This will close the tunnel and also delete the cron job /etc/cron.d/share-port-5900.

  • On the VNC viewer computer run:
    ./connect-to-desktop-5900.sh stop
    
  • On the VPS server run:
    cd /var/ds/sshtunnels/
    ds tunnel-del desktop 5900
    

    This will delete the directory tunnels/desktop.5900/ and stop accepting connections from the VNC server and VNC viewer computers.

Date: 2020-03-27

Author: Dashamir Hoxha

Created: 2020-03-27 Fri 15:10

Emacs 25.2.2 (Org mode 8.2.10)

Validate

OpenPGP Web Key Directory

OpenPGP Web Key DirectoryOpenPGP Web Key DirectoryTable of Contents1. Introduction2. How WKD works3. Building a WKD3.1. Create the direct...… Continue reading

SMTP Server with LDAP Authentication

Published on April 17, 2021

Using WireGuard VPN

Published on November 09, 2020