Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInstall XFCE as the desktop session, run TigerVNC as the virtual display server, and reach it through an SSH tunnel. On Ubuntu 24.04, the working pattern is: install xfce4 and TigerVNC, create the VNC password as the ordinary desktop user, set session=xfce, start display :1 on loopback, and forward local port 5901 over SSH. The viewer then connects to localhost::5901 without exposing VNC to the Internet.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What this setup provides
A headless VPS has no physical monitor, keyboard, or graphical login. XFCE supplies the desktop environment; TigerVNC supplies a separate virtual X display and speaks the VNC protocol to your viewer. They solve different parts of the problem: installing XFCE alone does not create a remotely reachable desktop, and installing a VNC server alone does not provide a desktop session.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This guide uses Ubuntu 24.04 package names and commands. Service-unit names and configuration locations can differ on other distributions or older TigerVNC packages, but the important concepts—per-user credentials, an explicit XFCE session, display-to-port mapping, and a protected transport—remain the same.
Choose the right VNC model first
“Remote desktop” can mean either a new virtual desktop created for a remote connection or control of an X11 display that already exists. Select the server that matches that requirement.
#1 Best Overall
| Requirement | Use | What the connection shows | Security and persistence considerations |
|---|---|---|---|
| A desktop on a headless VPS | TigerVNC standalone server | A new virtual XFCE session, independent of a physical monitor | Run it as the desktop owner, bind it to loopback, and forward it through SSH. A systemd unit can start it at boot. |
| Control of an existing X11 display | x11vnc |
The already-running display, commonly :0, including its local applications |
It exports an existing session rather than creating a new one. Its display and SSL options are configured around that existing X server. |
For a normal Ubuntu VPS with no physical graphical session, TigerVNC is the appropriate choice. Use x11vnc only when an X11 display is already running and you specifically need to see and control that display.
Prerequisites and a safe network design
- An Ubuntu 24.04 VPS with a sudo-capable account.
- An SSH client on your workstation and a VNC viewer that accepts a host and port.
- A server account that will own the XFCE session. Do not run the desktop or create its VNC password as root.
- A firewall policy that allows SSH but does not publish TCP ports 5901 and higher to the public Internet.
TigerVNC display :1 listens on TCP port 5901 by convention: add 5900 to the display number. Display :2 would normally use 5902. The examples keep display :1 on the VPS loopback interface and carry it inside an SSH connection.
Install XFCE and TigerVNC on Ubuntu 24.04
Log in to the VPS over SSH as the account that has sudo access, then update package metadata and install the desktop and server packages:
sudo apt update
sudo apt install xfce4 xfce4-goodies tigervnc-standalone-server tigervnc-toolsxfce4 is the core desktop. xfce4-goodies adds commonly used panel plugins and utilities. tigervnc-standalone-server provides the virtual VNC/X server, while tigervnc-tools includes the password utility used in the next step.
During installation, Ubuntu may ask which display manager to use. A display manager is not required for a headless TigerVNC session; the VNC server starts XFCE directly. If you are prompted and the VPS has no local graphical login, keep the existing choice unless you have a separate reason to change it.
Create the VNC password as the desktop user
Switch to the ordinary account that will own the session (replace alice with that account name), or log in directly as that user:
Recommended Free Tools
sudo -iu alice
tigervncpasswdEnter the password when prompted. TigerVNC may offer a view-only password; enable one only if you need a user who can observe the desktop without controlling it. The password file belongs in the user’s TigerVNC configuration area. Creating it with sudo tigervncpasswd would place credentials under root and can cause permission or authentication failures when the unprivileged server starts.
Return to your normal shell with exit if you changed users. The password is for VNC authentication; it is not your SSH password and should not be reused for other services.
Tell TigerVNC to start XFCE
Modern TigerVNC packages support a per-user configuration file at $HOME/.config/tigervnc/config. As the desktop user, create the directory and edit the file:
mkdir -p ~/.config/tigervnc
nano ~/.config/tigervnc/configUse a session name that exactly matches an XFCE desktop entry installed on the server:
session=xfce
geometry=1600x900
localhost=yesThe session=xfce line is important. TigerVNC’s documented behavior when session= is omitted is to choose the first desktop session it discovers. On a machine with more than one desktop entry, that can start the wrong environment or fail before a usable desktop appears.
Verify the exact desktop-file names if xfce does not work:
ls /usr/share/xsessionsLook for the XFCE entry and use its desktop-session name without the .desktop suffix. Distribution packaging can use a slightly different name, so the installed file—not a copied example—is authoritative. Keep geometry appropriate for your viewer and connection. A smaller size reduces drawing work and bandwidth; you can change it later without reinstalling anything. localhost=yes ensures the server accepts connections only from the VPS itself, which is what makes the SSH-tunnel design safe.
Older packages may read a per-user file under ~/.vnc instead. If your package’s man page specifies that legacy location, follow it, but preserve the same explicit session and loopback settings.
Start display :1 and connect through SSH
As the desktop user, start the first virtual display. The command-line option makes the loopback requirement explicit even when the configuration file already contains it:
tigervncserver :1 -localhost yesThe server should report display :1. On the VPS, that corresponds to TCP port 5901. Do not open that port in a cloud security group or firewall for general Internet access.
Leave the VNC server running, open a terminal on your workstation, and create an SSH local port forward:
ssh -L 5901:localhost:5901 [email protected]Keep this SSH session open while using the desktop. The first 5901 is the workstation’s local listening port; the second is the VPS port reached through the VPS loopback interface. If local port 5901 is already occupied, choose another local port, such as:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →ssh -L 6901:localhost:5901 [email protected]In that case, point the VNC viewer at local port 6901 instead. The VNC address syntax used by many viewers is localhost::5901; the double colon explicitly denotes a TCP port. Some viewers present separate Host and Port fields, in which case enter localhost and 5901.
Authenticate with the VNC password created earlier. The desktop should open as a new XFCE session, not as the VPS’s SSH shell and not as another user’s graphical session. Multiple users can run separate displays if each has a separate account, password, and display number.
Manage the session safely
Check that the server is running
tigervncserver -list
ps -ef | grep '[t]igervnc'Use the process list only as a quick diagnostic; the packaged log and PID files are more useful when investigating startup errors.
Rank #4
Stop and restart display :1
tigervncserver -kill :1
tigervncserver :1 -localhost yesStopping the display ends programs running inside that virtual desktop. Save work in graphical applications before using -kill. If the server refuses to stop, inspect its PID file and log rather than deleting files blindly.
Find logs and PID files
TigerVNC stores per-user logs and PID files below its VNC configuration directory. On current Ubuntu packages this is commonly ~/.config/tigervnc; older layouts may use ~/.vnc. List the directory and open the log corresponding to display 1:
ls -la ~/.config/tigervnc
less ~/.config/tigervnc/*.logThe log identifies the selected session, listening address, authentication failures, and desktop-start errors. A stale PID file after an unclean shutdown can make a later start appear to fail; confirm with ps that no real server uses the recorded PID before removing a stale file.
Make TigerVNC persistent with systemd
A manually started process normally ends when it is killed or when the VPS reboots. Ubuntu’s TigerVNC packages include a systemd service mechanism, but the exact unit and mapping file can vary by package revision. First inspect what your installation provides:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemssystemctl list-unit-files | grep -i tigervnc
man tigervncserverOn packages that use the standard per-display mapping, create or edit /etc/tigervnc/vncserver.users with sudo and map display :1 to the unprivileged account:
sudoedit /etc/tigervnc/vncserver.users:1=aliceThen enable the corresponding template unit. A commonly packaged name is tigervncserver@:1.service:
sudo systemctl daemon-reload
sudo systemctl enable --now tigervncserver@:1.service
systemctl status tigervncserver@:1.service
journalctl -u tigervncserver@:1.serviceIf your distribution lists a different unit, use that unit’s documented name rather than forcing this example. The service must run as the same desktop user whose password and configuration you created. Confirm that its environment can read ~/.config/tigervnc/config and that the service still uses localhost. A successful systemd start does not make public exposure safe; continue to use the SSH tunnel.
Best Value
Security: never publish an unaudited VNC port
Ubuntu guidance warns against running VNC directly over an untrusted network such as the Internet. VNC authentication alone is not a substitute for a protected transport. The loopback-plus-SSH arrangement provides encryption through SSH and keeps the VNC listener unreachable from outside the VPS.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Allow SSH only from networks you trust where practical, and use SSH keys rather than a weak password.
- Keep
localhost=yesin the TigerVNC configuration and verify the listener withss -ltnp | grep 5901. A loopback bind should show a local address rather than0.0.0.0:5901. - Do not add a public firewall rule for 5901 merely because a viewer cannot connect; fix the tunnel or local port instead.
- Use a separate, strong VNC password. It protects the VNC protocol but does not replace SSH authentication.
TigerVNC also supports TLS/X.509 security types. Its security documentation explains the identity benefit plainly: “Certificates prove the identity of the computer you are viewing.” Certificates can keep communication private and help authenticate the server, but they require certificate and key management. For a single VPS, an SSH tunnel is usually the simpler operational choice; use TLS when your policy requires direct VNC transport with managed certificates. The TigerVNC documentation describes Debian/Ubuntu OpenSSL commands for creating a self-signed certificate, but a self-signed certificate still requires a deliberate trust decision on each client.
Troubleshoot the common failure modes
| Symptom | Likely cause | What to check or change |
|---|---|---|
| Authentication fails immediately | Password created for the wrong account, wrong file ownership, or a mistyped password | Run tigervncpasswd as the desktop user, verify that the user owns the TigerVNC configuration directory, and create a new password if necessary. |
Connection refused on localhost::5901 |
The server is stopped, the SSH forward uses the wrong remote port, or display numbering differs | Run tigervncserver -list, inspect the log, and confirm that display :1 maps to 5901. Keep the SSH command running. |
| Viewer connects but shows a gray or empty screen | XFCE was not selected, the session name is wrong, or the desktop failed during startup | Check session=xfce, compare it with /usr/share/xsessions, and read the per-user TigerVNC log. Do not leave the session unspecified when multiple desktops are installed. |
| XFCE opens and then closes | Startup process exited, configuration is unreadable, or the service runs as a different user | Start manually as the desktop user to isolate the problem, verify ownership of $HOME/.config/tigervnc, and inspect systemd’s journal when using the packaged service. |
| Remote connection is slow or unusable | Geometry or visual workload is too large for the available path | Reduce geometry, close unnecessary applications, and avoid running heavy graphical workloads. No universal speed or memory figure applies; the result depends on the VPS, viewer, and network. |
| Port 5901 is already in use | Another VNC display or process owns the port | Use tigervncserver -list and ss -ltnp to identify it. Stop the unused display or choose another display number and forward its matching port. |
| Systemd starts the wrong desktop or cannot find the password | The unit runs under a different account or reads a different configuration location | Check the user mapping, home directory, and package man page. The service user must own the password and config files. |
When x11vnc is the better choice
x11vnc exports an existing X11 display rather than creating the isolated virtual desktop that TigerVNC standalone provides. If a local workstation session is already running on display :0 and the goal is to control that exact screen, x11vnc’s documented examples use a display argument such as -display :0. Its SSL options can protect that exported display, but the same network rule applies: do not expose an unprotected VNC listener to the Internet.
An x11vnc process cannot manufacture a desktop on a truly headless VPS. Installing XFCE and then launching x11vnc without an existing X11 session usually leaves nothing useful to export. For a fresh server-side desktop, keep the TigerVNC configuration described above.
Portability notes for other distributions
- Package names are distribution-specific. Ubuntu 24.04 uses
xfce4,xfce4-goodies,tigervnc-standalone-server, andtigervnc-toolsin this workflow. - The per-user configuration may be under
~/.config/tigervncon current releases or~/.vncon older releases. - Desktop session names come from the files installed in
/usr/share/xsessions; use the exact XFCE entry on the target system. - Systemd template names and user-mapping files vary. Enumerate installed units and read the local
tigervncserverman page before enabling a service. - Display numbering remains the useful mental model: add 5900 to
:Nto find the conventional TCP port, then forward that port over SSH.
Remove the setup
To stop an enabled service, disable the unit name installed on your system, then stop any manually launched display:
sudo systemctl disable --now tigervncserver@:1.service
tigervncserver -kill :1Remove the desktop and server packages only if the VPS no longer needs them:
sudo apt remove tigervnc-standalone-server tigervnc-tools xfce4 xfce4-goodies
sudo apt autoremovePackage removal does not necessarily delete per-user configuration and password files. Remove those files deliberately, after confirming that no other desktop session uses them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
