Free tools Windows power users keep installed
One-click scans. No signup required.
Install XFCE as the desktop session and TigerVNC as the virtual display server, then reach display :1 through an SSH tunnel. On Ubuntu 24.04, the working pattern is: install xfce4, xfce4-goodies, tigervnc-standalone-server, and tigervnc-tools; create the VNC password as the desktop owner; explicitly select the XFCE session; bind VNC to loopback; and forward local port 5901 over SSH. This creates a private, headless desktop rather than taking control of a physical monitor.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What this setup actually provides
There are two separate components. XFCE is the desktop environment: it supplies the panel, window manager, file manager, settings tools, and other graphical programs. TigerVNC supplies a virtual X display and speaks the VNC protocol so a viewer can draw that desktop on your computer.
As an Amazon Associate I earn from qualifying purchases.
A TigerVNC standalone server creates a new desktop session for each display you start. It does not need a monitor, keyboard, or an already logged-in graphical session on the VPS. That makes it the appropriate model for a headless server where you want a private desktop you can start and stop independently.
x11vnc solves a different problem. It exports an X11 display that already exists, commonly the physical display :0. Choose it when you need to see and control the same screen that is attached to a running Linux workstation. Installing x11vnc will not, by itself, create an XFCE desktop on a headless VPS.
#1 Best Overall
Requirements and decisions before installing
- An Ubuntu 24.04 VPS with SSH access.
- A sudo-capable account. The account that owns the desktop should be an ordinary user, not
root. - An SSH client on the computer from which you will view the desktop.
- A VNC viewer that can connect to a local host and TCP port.
- A decision about display size. The geometry in TigerVNC is the virtual screen size, so select one that fits the client window and the work you will do.
The commands below are verified for Ubuntu 24.04. Package names, service-unit names, configuration locations, and defaults can differ on another distribution or release, even though the TigerVNC concepts remain the same.
Install XFCE and TigerVNC on Ubuntu 24.04
1. Connect over SSH and refresh package metadata
ssh your_user@your_vps_address
sudo apt updateUse the account that will eventually own the graphical session whenever possible. You can use a separate sudo account for installation, but do not create the VNC password or run the desktop as root.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Install the desktop and server packages
sudo apt install xfce4 xfce4-goodies tigervnc-standalone-server tigervnc-toolsxfce4 provides the core desktop. xfce4-goodies adds commonly used XFCE utilities. tigervnc-standalone-server provides the virtual VNC server, while tigervnc-tools supplies utilities including tigervncpasswd.
Keep the SSH session open while testing. If the package manager asks you to choose a display manager or other desktop integration option, accept the option appropriate for this VPS; the VNC session itself will select XFCE explicitly in the next steps.
Create the VNC password as the desktop owner
Switch to the ordinary user who should own the desktop, then run:
tigervncpasswdDo not run this command with sudo. TigerVNC’s password must be created by the same user who starts the server. If you create it as root and later start the session as another account, that account will not have the expected credentials and password-file permissions.
Recommended Free Tools
The utility asks for a VNC password. VNC passwords have implementation-specific length limits, so use a strong, unique value within the limit accepted by the utility rather than reusing an SSH or VPS password. The password protects the VNC service; SSH keys and the SSH account still protect the tunnel endpoint.
Tell TigerVNC to start XFCE
Find the exact desktop-session name
TigerVNC needs the session identifier used by the desktop-file entry under /usr/share/xsessions. Inspect the directory as the VPS user:
ls /usr/share/xsessionsLook for the XFCE desktop entry. On Ubuntu it is commonly represented by xfce.desktop, whose session name is xfce. If your installation shows a different XFCE filename, use that entry’s name without the .desktop suffix. The important point is that the value must match an entry installed on this machine.
Create the per-user configuration
Create the TigerVNC configuration directory and edit the per-user file:
mkdir -p "$HOME/.config/tigervnc"
nano "$HOME/.config/tigervnc/config"Put an explicit session and a geometry in the file. For example:
session=xfce
geometry=1920x1080Replace xfce if your /usr/share/xsessions listing uses another exact name. Replace 1920x1080 with the resolution that suits your client. Explicitly setting session= matters: TigerVNC can otherwise choose the first desktop it discovers, which may be a different environment or may fail to start.
The configuration belongs to the desktop owner. Check that the file is readable by that user and is not accidentally owned by root after editing it with sudo.
Start a private display on :1
Display :1 conventionally maps to TCP port 5901 (the display number plus 5900). Start it from the ordinary desktop account and force a loopback listener:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchtigervncserver :1 -localhost yesThe exact startup output varies with the TigerVNC version, but it should report a new display and a process ID. The -localhost yes setting prevents the VNC socket from accepting direct connections from the public network. It is the correct default when SSH will carry the traffic.
To stop that session later, use the matching display:
tigervncserver -kill :1If display :1 is already occupied, stop the old process or choose another display such as :2. Display :2 uses port 5902, so the tunnel and viewer port must change together.
Reach the desktop through an SSH tunnel
Open the tunnel from your local computer
On your own computer, run:
ssh -N -L 5901:localhost:5901 your_user@your_vps_addressLeave this SSH process running. The first 5901 is a port on your local computer. The second is the VPS port, which is reachable because TigerVNC is listening on the VPS loopback interface. If local port 5901 is already in use, choose another local port, for example:
ssh -N -L 5905:localhost:5901 your_user@your_vps_addressIn that case, connect the viewer to local port 5905, not 5901. The remote side remains 5901.
Connect with the VNC viewer
Point the viewer at the local end of the tunnel. TigerVNC documentation commonly expresses this as localhost::5901; viewers that provide separate fields should use host localhost and port 5901. Enter the password created with tigervncpasswd.
Do not substitute the VPS public IP in the viewer when the server is loopback-only. The viewer should connect to your own computer, while SSH carries the encrypted connection to the VPS.
Rank #4
Make the session persistent with systemd
A manually started server ends when you kill it or when its process fails. For a desktop that should be available after a reboot, use the packaged TigerVNC systemd service supplied by your Ubuntu installation.
Identify the unit shipped by your package
Unit names vary between Ubuntu releases and TigerVNC packaging revisions. Discover the installed names instead of assuming a template:
systemctl list-unit-files '*vnc*'Inspect the candidate unit before enabling it:
systemctl cat name-of-the-installed-vnc-unitThe service must run as the same ordinary user who owns $HOME/.config/tigervnc/config and the password created earlier. Confirm the unit’s user, display argument, and any reference to the TigerVNC configuration directory. If the unit is a display template, its instance normally corresponds to a display such as :1; use the syntax shown by the installed unit rather than copying a unit name from another distribution.
Enable, start, and inspect it
After confirming the unit and its user, enable it for boot and start it immediately using the unit name reported on your VPS:
sudo systemctl enable --now name-of-the-installed-vnc-unit
sudo systemctl status name-of-the-installed-vnc-unitIf it fails, inspect the journal for that exact unit and then check the per-user TigerVNC log in the configuration directory:
sudo journalctl -u name-of-the-installed-vnc-unit
ls -la "$HOME/.config/tigervnc"TigerVNC keeps startup logs and PID files under its configuration area. Those files reveal the display number, authentication errors, session-launch failures, and whether a previous PID is stale. Keep the service loopback-only and continue to use SSH forwarding.
Security: why the SSH tunnel is the default
Do not expose an unprotected VNC listener directly to the Internet. Ubuntu guidance specifically warns against running VNC over an untrusted network without protection. A loopback listener plus SSH port forwarding limits the VNC protocol to the authenticated SSH connection and avoids opening a public VNC port in the VPS firewall.
Best Value
TigerVNC also supports TLS/X.509 security types. Its security documentation summarizes the purpose clearly: “Certificates prove the identity of the computer you are viewing.” Certificates can keep communication private and authenticate the server, but they require certificate generation, deployment, and viewer support. For a single administrator connecting to one VPS, an SSH tunnel is usually simpler to operate. If you choose TLS instead, follow the security settings supported by the TigerVNC version installed on the VPS and configure the certificate paths consistently for the server and client.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- Use SSH keys and disable password SSH login where that matches your operational policy.
- Keep
-localhost yes(or the equivalent configuration option) enabled when SSH is the transport. - Do not publish port 5901 in a cloud firewall merely because the VNC server uses that port internally.
- Use a separate VNC password rather than reusing the VPS login password.
- Stop unused display sessions and remove stale service instances.
TigerVNC standalone versus x11vnc
| Question | TigerVNC standalone | x11vnc |
|---|---|---|
| What it exports | A new virtual desktop session. | An already-running X11 display. |
| Typical display | :1, :2, and other virtual displays. |
Often an existing physical session such as :0. |
| Headless VPS use | Well suited: XFCE can start without a monitor. | Requires an X11 display to exist first. |
| Multiple users or isolated sessions | Each display can provide a separate desktop session. | Connections see the same exported display. |
| Transport choices | SSH forwarding, or TigerVNC TLS/X.509 security types. | Can be protected with SSH forwarding and supports SSL-related options, but it still exports the existing display. |
| Best choice when | You need a fresh, independent desktop on a server. | You need to observe or control the screen already visible on an X11 workstation. |
The choice is about session model before it is about protocol preference. Installing x11vnc on a headless VPS will not replace the XFCE-plus-TigerVNC setup described here.
Troubleshooting by symptom
The VNC client says “connection refused”
- Confirm the server is running for the intended display with the service status or TigerVNC process list.
- Verify the display-to-port mapping:
:1is 5901,:2is 5902. - Check that the SSH tunnel is still open and that its local and remote ports match.
- Because the server is loopback-only, test through the tunnel rather than attempting the VPS address directly.
The password is rejected
Run tigervncpasswd again as the desktop owner, not as root. Make sure the service and the manual startup command use that same account and configuration directory. A service running under a different user will look for a different password file.
The session exits immediately or shows a gray/empty desktop
Check the per-user log and compare the configured session with the files in /usr/share/xsessions. Set session= to the exact XFCE entry rather than relying on automatic desktop discovery. Also verify that the service starts the session as the user who owns the XFCE configuration.
The wrong desktop starts
Automatic selection can pick the first discovered desktop. Edit $HOME/.config/tigervnc/config and set the explicit XFCE session name, then stop and restart the display.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Display :1 is already in use
Inspect the PID and log files under the TigerVNC configuration directory. If an old process is still valid, connect to its port. If it is stale, stop it cleanly or remove the stale process after confirming it is no longer running. Alternatively start :2 and forward port 5902.
The systemd service works manually but not after reboot
Inspect the installed unit with systemctl cat. The service may be running as the wrong user, pointing at a different home directory, or using a display instance that does not match the SSH tunnel. Correct the unit’s user and display configuration, then reload, enable, and start the unit again using the package’s documented unit syntax.
Quick Recap
Operating checklist
- Install the four Ubuntu packages with sudo.
- Run
tigervncpasswdas the ordinary desktop user. - Confirm the XFCE desktop-file name under
/usr/share/xsessions. - Set
session=and a suitablegeometry=in$HOME/.config/tigervnc/config. - Start display
:1with loopback enabled. - Forward local port 5901 to VPS port 5901 over SSH.
- Connect the viewer to
localhostthrough that tunnel. - For reboot persistence, configure the packaged systemd service to run as the same user.
- Use logs and PID files in the TigerVNC configuration directory when diagnosing failures.
- Choose x11vnc only when the requirement is to export an existing X11 display.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
