XFCE desktop and TigerVNC on a Linux VPS

Some tasks are easier with a graphical desktop: running a browser, a GUI tool or a desktop application on a remote machine. XFCE is light enough for a small server, and TigerVNC lets you see it from your own computer. This guide sets it up on a VPS Linux Infrawire so that the VNC port is never exposed to the Internet: you reach it only through an SSH tunnel.

📋 Prerequisites

A VPS running Ubuntu 24.04 or Debian 12 with root SSH access (from your customer area you will find the VPS IP and the root password).
At least 2 GB of RAM for a comfortable desktop.
An SSH client on your computer and a VNC viewer (RealVNC Viewer or TigerVNC Viewer).
A regular user account: do not run the desktop as root.

📦 Install XFCE and TigerVNC

Update the system, then install the desktop and the server. dbus-x11 avoids a frequent grey-screen problem.

Bash
1apt update && apt upgrade -y
2apt install -y xfce4 xfce4-goodies tigervnc-standalone-server tigervnc-common dbus-x11

Create a dedicated user if you do not have one yet:

Bash
1adduser USER
2usermod -aG sudo USER

🔑 Set the VNC password and the session

Switch to that user and set the VNC password (8 characters are significant at most):

Bash
1su - USER
2vncpasswd

Answer n to the read-only password question. Then tell TigerVNC to start XFCE:

Bash
1mkdir -p ~/.vnc
2cat > ~/.vnc/xstartup <<'EOF'
3#!/bin/sh
4unset SESSION_MANAGER
5unset DBUS_SESSION_BUS_ADDRESS
6exec startxfce4
7EOF
8chmod +x ~/.vnc/xstartup

Test it by hand, listening on localhost only:

Bash
1vncserver :1 -localhost yes -geometry 1920x1080 -depth 24
2vncserver -list
3vncserver -kill :1

⚙️ Start it automatically with systemd

Back as root, create a unit that runs the session for your user. Display :1 maps to TCP port 5901.

INI
1# /etc/systemd/system/vncserver@.service
2[Unit]
3Description=TigerVNC server on display %i
4After=network.target
5
6[Service]
7Type=forking
8User=USER
9Group=USER
10WorkingDirectory=/home/USER
11PIDFile=/home/USER/.vnc/%H:%i.pid
12ExecStartPre=-/usr/bin/vncserver -kill :%i
13ExecStart=/usr/bin/vncserver :%i -localhost yes -geometry 1920x1080 -depth 24
14ExecStop=/usr/bin/vncserver -kill :%i
15
16[Install]
17WantedBy=multi-user.target

Bash
1systemctl daemon-reload
2systemctl enable --now vncserver@1.service
3systemctl status vncserver@1.service

For a second user, copy the unit under another name with that user and display :2 (port 5902).

🔒 Connect through an SSH tunnel

The -localhost yes option makes VNC listen on 127.0.0.1 only, so nothing is reachable from outside. From your own computer, open a tunnel:

Bash
1ssh -N -L 5901:localhost:5901 USER@VPS_IP

Leave that window open. In your VNC viewer, connect to localhost:5901 and enter the VNC password. The same command works in Windows PowerShell and macOS Terminal. Do not open port 5901 in any firewall.

✅ Verification

On the VPS, confirm that VNC listens on the loopback address only:

Bash
1ss -tlnp | grep 5901
2systemctl is-active vncserver@1.service

You should see 127.0.0.1:5901 and not 0.0.0.0:5901. From your computer, the viewer should show the XFCE desktop after the tunnel is up.

🛠️ Troubleshooting

Grey screen or no desktop. Check that ~/.vnc/xstartup is executable, that dbus-x11 is installed and read the log with cat ~/.vnc/*.log. A missing exec startxfce4 line is the most common cause.

"A VNC server is already running as :1". A stale lock remains. Run vncserver -kill :1, then remove /tmp/.X1-lock and /tmp/.X11-unix/X1 if they persist, and restart the service.

The tunnel refuses the connection. The service is probably stopped: check systemctl status vncserver@1.service. Also make sure the local port 5901 is not already used on your computer, or pick another one such as -L 5999:localhost:5901.

🎉 Your VPS now offers a private XFCE desktop, reachable only through your SSH tunnel.