How to Install and Configure VNC on Debian 11: Secure Remote Desktop Access

Virtual Network Computing, or VNC, is a connection system that allows you to use your keyboard and mouse to interact with a graphical desktop environment on a remote server. It helps users who are not yet comfortable with the command line with managing files, software, and settings on a remote server.

In this guide, you’ll set up a VNC server with TightVNC on a Debian 11 server and connect to it securely through an SSH tunnel. Then, you’ll use a VNC client program on your local machine to interact with your server through a graphical desktop environment.

Prerequisites

To follow this tutorial, you’ll need:

• One Debian 11 server set up, including a non-root user with sudo access and a firewall.
• A local computer with a VNC client installed that supports VNC connections over SSH tunnels.

On Windows, you can use TightVNC, RealVNC, or UltraVNC.

On macOS, you can use the built-in Screen Sharing program, or can use a cross-platform app like RealVNC.

On Linux, you can choose from many options, including vinagre, krdc, RealVNC, or TightVNC.

Once you have everything set up, you can proceed to the first step.

Step 1 — Installing the Desktop Environment and VNC Server

By default, a Debian 11 server does not come with a graphical desktop environment or a VNC server installed, so you’ll begin by installing those.

You have many options when it comes to which VNC server and desktop environment you choose. In this tutorial, you will install packages for the latest Xfce desktop environment and the TightVNC package available from the official Ubuntu repository. Both Xfce and TightVNC are known for being lightweight and fast, which will help ensure that the VNC connection will be smooth and stable even on slower internet connections.

After connecting to your server with SSH, update your list of packages:

sudo apt update  

Now install the Xfce desktop environment, along with the xfce4-goodies package, on your server:

sudo apt install xfce4 xfce4-goodies  

Once the installation completes, install the TightVNC server:

sudo apt install tightvncserver  

Next, install the dbus-x11 dependency to ensure a proper connection to your VNC server:

sudo apt install dbus-x11  

To complete the VNC server’s initial configuration after installation, use the vncserver command to set up a secure password and create the initial configuration files:

vncserver  

Step 2 — Configuring the VNC Server

The VNC server needs to know what commands to execute when it starts up. Specifically, VNC needs to know which graphical desktop it should connect to.

Stop the running VNC server:

vncserver -kill :1  

Create the startup script:

nano ~/.vnc/xstartup  

Add the following content:

#!/bin/bash  
xrdb $HOME/.Xresources  
startxfce4 &  

Step 3 — Connecting the VNC Desktop Securely

VNC itself doesn’t use secure protocols when connecting. To connect securely, you’ll use an SSH tunnel to connect to your server, and then tell your VNC client to use that tunnel rather than making a direct connection.

Run the following command to create an SSH tunnel:

ssh -L 5901:127.0.0.1:5901 -C -N -l sammy your_server_ip

Step 4 — Running VNC as a System Service

Create a systemd service file to manage the VNC server:

[Unit]
Description=Start TightVNC server at startup
After=syslog.target network.target

[Service]
Type=forking
User=sammy
Group=sammy
WorkingDirectory=/home/sammy

PIDFile=/home/sammy/.vnc/%H:%i.pid
ExecStartPre=-/usr/bin/vncserver -kill :%i > /dev/null 2>&1
ExecStart=/usr/bin/vncserver -depth 24 -geometry 1280x800 :%i
ExecStop=/usr/bin/vncserver -kill :%i

[Install]
WantedBy=multi-user.target

Step 4 — Running VNC as a System Service

Create a systemd service file to manage the VNC server:

[Unit]
Description=Start TightVNC server at startup
After=syslog.target network.target

[Service]
Type=forking
User=sammy
Group=sammy
WorkingDirectory=/home/sammy

PIDFile=/home/sammy/.vnc/%H:%i.pid
ExecStartPre=-/usr/bin/vncserver -kill :%i > /dev/null 2>&1
ExecStart=/usr/bin/vncserver -depth 24 -geometry 1280x800 :%i
ExecStop=/usr/bin/vncserver -kill :%i

[Install]
WantedBy=multi-user.target

Conclusion

You now have a secured VNC server up and running on your Debian 11 server. Now you’re able to manage your files, software, and settings with a user-friendly and familiar graphical interface. You can also run graphical software like web browsers remotely.