To add a graphical desktop to a minimal Ubuntu VPS, install XFCE and xrdp, select XFCE for the RDP user, open TCP 3389 in both the VPS provider firewall and the guest firewall, then connect with an RDP client. The procedure below is written for Ubuntu 24.04 and keeps SSH available as a recovery channel. It also explains the common timeout, certificate, login-loop and black-screen failures.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you are installing
A minimal VPS usually has no graphical desktop. xrdp is an RDP server: it accepts a Remote Desktop Protocol connection and starts a Linux graphical session for the account that logs in. On Ubuntu, its main configuration file is /etc/xrdp/xrdp.ini, and its primary log is /var/log/xrdp.log. The Ubuntu Noble manpage lists package version 0.9.24-4ubuntu0.1; that number identifies the package documented by that manpage, not a timeless version requirement.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The lightweight XFCE desktop is a practical match for a small VPS. Installing xrdp without a desktop environment may produce a successful network connection but no useful desktop session. The commands below install XFCE, configure xrdp to start it, and enable the service at boot.
Prerequisites and decisions
- An Ubuntu VPS: The documented command sequence targets Ubuntu 24.04. Package names and service behavior can differ on other releases.
- SSH access: Perform the installation over SSH first. Leave SSH enabled until RDP is tested so a failed graphical login cannot lock you out.
- A regular Linux account with a password: Use that account for RDP. An SSH key supplied by a cloud provider is not, by itself, an xrdp password credential. Do not assume the provider’s root or key-only login will work at the xrdp screen.
- Administrative privileges: The account running the commands needs
sudo, or you must use the provider’s console to perform equivalent administrative actions. - A network path to the VPS: You need the VPS public IP (or a reachable private address) and permission to add a TCP 3389 rule in the provider’s security group, network ACL or equivalent control.
Decide who should be able to reach RDP before opening the port. A rule limited to a known office, home or VPN address is safer than allowing every source on the internet.
#1 Best Overall
Install XFCE and xrdp over SSH
1. Update package metadata and install the desktop and server
SSH to the VPS with your normal administrative account, then run:
sudo apt update
sudo apt install xfce4 xfce4-session xrdp
sudo systemctl enable xrdpxfce4 supplies the desktop, xfce4-session provides the session startup component, and xrdp supplies the RDP service. The installation can download a substantial set of desktop packages, so allow time and disk space for the transaction to finish. If apt asks you to confirm, review the package list and continue only when the VPS has enough storage.
2. Apply the Ubuntu 24 certificate-group step when needed
The Ubuntu 24 procedure documents adding the xrdp service account to the certificate group:
sudo adduser xrdp ssl-certRun this when the installed package and service require certificate access, particularly if the service log reports certificate or permission errors. Adding the group does not replace restarting the service; group membership is used by new service processes.
3. Select XFCE for the RDP user
Run the next command as the Linux user who will sign in through RDP, not as a different administrator account:
echo xfce4-session >~/.xsession
sudo systemctl restart xrdpThe .xsession file tells xrdp to start XFCE for that user. If several people will use the VPS, each account needs its own correctly owned ~/.xsession file. Restarting xrdp applies the session selection and reloads the service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Check that the service is running
Before testing from another computer, inspect the service locally:
sudo systemctl status xrdp --no-pagerA running service should report an active state. If it is failed, read the error and then inspect /var/log/xrdp.log. The status check does not test the provider firewall; a healthy local service can still be unreachable from the internet.
Open the RDP network path without exposing more than necessary
Provider-side rule
VPS platforms commonly filter traffic before it reaches Ubuntu. Add an inbound rule in the provider’s security group, firewall or network ACL for TCP port 3389. Set the source to the public address range that actually needs access. If the provider has separate IPv4 and IPv6 controls, configure only the address families you intend to use.
A provider rule alone is not sufficient when Ubuntu’s own firewall blocks the connection, and a UFW rule alone cannot bypass a provider-level deny.
Guest firewall rule
If UFW is active, Ubuntu’s remote-desktop documentation shows this range command for its documented remote-desktop modes:
sudo ufw allow 3389:3390/tcp
sudo ufw reloadAn xrdp-only VPS normally needs only 3389, so a narrower rule is preferable. For example, the following permits one illustrative trusted public address; replace that example address with the address or CIDR range you control:
sudo ufw allow from 198.51.100.24 to any port 3389 proto tcp
sudo ufw reloadDo not use the broad 3389–3390 range simply because it is convenient if no service uses 3390. Ubuntu documents 3390 for a different remote-desktop combination; xrdp’s standard listener is TCP 3389.
Confirm the effective policy
After changing UFW, check its status and verify that the rule is present:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →sudo ufw statusIf the provider firewall allows 3389 but a connection still times out, compare the source address seen by the provider with the address in your UFW rule. Home and office connections can change public IPs, and a VPN can make the VPS see a different source range than expected.
Connect from Windows, Ubuntu or another RDP client
Windows
- Open Remote Desktop Connection by running
mstsc, or open the Microsoft Remote Desktop client. - Enter the VPS IP address as the computer name. Use a DNS name only when it resolves to the intended VPS address.
- Start the connection and accept the certificate warning only after verifying that the address is your server.
- At the xrdp login screen, choose the default Xorg session when that option is offered.
- Enter the regular Linux username and its local password. These are not necessarily the same credentials used by an SSH key.
Ubuntu and other systems
Remmina on Ubuntu is a compatible graphical option. Other clients can work when they support standard RDP and the xrdp project supports their protocol behavior. Client labels vary by operating system, but the essential values remain the VPS address, TCP 3389 and the Linux account credentials.
What a successful first login looks like
A successful session should open an XFCE desktop rather than return immediately to the client. Open a terminal in that desktop and confirm that you are the expected user. Disconnect from the client normally instead of terminating the VPS; the SSH session remains available if you need to inspect logs or change the configuration.
Troubleshoot by symptom
Connection refused or connection timeout
Work from the outside inward:
- Confirm that the client is using the current public IP and TCP 3389.
- Check the VPS provider’s inbound security rule and its source range.
- Check UFW with
sudo ufw statusand make sure an allow rule covers your actual source address. - Over SSH, check
sudo systemctl status xrdp --no-pager. A stopped or failed service cannot accept a connection. - Review
/var/log/xrdp.logfor startup or listener errors.
A refusal usually means the host was reached but no service accepted the connection; a timeout more often indicates filtering or an incorrect address. Both symptoms can have several causes, so verify each layer rather than changing the xrdp configuration first.
Black screen, immediate disconnect or login returns to the client
These symptoms commonly indicate that the desktop session did not start:
- Confirm XFCE installation completed, including both
xfce4andxfce4-session. - As the affected login user, check that
~/.xsessioncontainsxfce4-sessionand belongs to that user. - Do not create the file only in the administrator’s home directory if another account is logging in.
- Restart xrdp after correcting the file:
sudo systemctl restart xrdp. - Read
/var/log/xrdp.logand inspect/etc/xrdp/xrdp.inifor errors or an unexpected session configuration.
If the client offers multiple session types, select the default Xorg session. A different selection can fail even when the service itself is running.
Certificate, permission or startup errors on Ubuntu 24
Check whether the xrdp service account is in the ssl-cert group:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →getent group ssl-certIf xrdp is absent and the package requires the group, run:
sudo adduser xrdp ssl-cert
sudo systemctl restart xrdpThen read the service status and /var/log/xrdp.log again. Group changes affect newly started processes, which is why the restart matters.
One user works but another does not
xrdp starts a session per account. Compare the working and failing users’ home-directory permissions and ~/.xsession files. The file must be in the home directory of the user signing in and must contain the XFCE session command. Re-run the command as that user rather than writing it with sudo into the wrong home directory.
The desktop is usable but feels slow
RDP over the public internet adds input latency. Microsoft notes that the delay depends on network speed and the distance between you and the VM’s datacenter. Choose a VPS region geographically close to the people using it, avoid unnecessary visual effects in the desktop, and test from the same network where the work will occur. No authoritative performance figure establishes a universal latency or bandwidth threshold for this setup, so treat responsiveness as a property of your route, client and VPS location.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteSecurity and maintenance practices
Limit who can reach 3389
RDP is an interactive login service, so avoid an unrestricted internet rule when a fixed source range is available. Keep the provider rule and UFW rule aligned, and remove temporary broad rules after testing. If your users’ addresses change frequently, use the narrowest practical network boundary rather than leaving the port open to every source.
Use a non-root account
Sign in with a regular Linux account and grant administrative access through sudo only when required. Keeping SSH available gives you a separate recovery path for changing the account password, repairing XFCE or disabling xrdp.
Patch through SSH or the provider console
Desktop packages add more software than a headless server. Keep Ubuntu packages maintained, but perform changes from SSH or the provider console so an RDP failure does not interrupt administration. Test a reboot only after confirming that xrdp is enabled and that your provider firewall rule persists.
Know the important files
| Item | Purpose |
|---|---|
/etc/xrdp/xrdp.ini |
Main xrdp configuration file documented by the Ubuntu Noble manpage. |
/var/log/xrdp.log |
Main xrdp log for listener, startup and session diagnostics. |
~/.xsession |
Per-user session selector containing xfce4-session for this setup. |
| TCP 3389 | Standard xrdp RDP port that must pass both provider and guest firewall controls. |
xrdp versus other ways to administer an Ubuntu VPS
There is no single best access method. Choose based on whether you need a graphical application, how much software you want installed, and how much network exposure you can accept.
| Approach | Best fit | Desktop and resource profile | Client support | Network considerations |
|---|---|---|---|---|
| Headless SSH | Administration, automation and command-line workloads | No graphical desktop; lowest desktop overhead | SSH clients on all major platforms | Uses SSH rather than RDP; keep it as the recovery path |
| XFCE with xrdp | A lightweight graphical session on a minimal VPS | Installs XFCE and its session packages; exact memory and disk requirements are not stated in the cited documentation | RDP clients such as Windows Remote Desktop and Remmina | Requires TCP 3389 through the provider and guest firewalls; restrict the source range |
| Ubuntu GNOME Remote Login | Users who want Ubuntu’s built-in GNOME remote-desktop modes | Uses the GNOME desktop stack; exact resource requirements are not stated here | Depends on the GNOME remote-desktop mode and a compatible client | Ubuntu documents separate Desktop Sharing and Remote Login modes, with TCP 3389 and, when both modes are enabled, 3390 |
xrdp is an independent RDP server, while Ubuntu’s GNOME documentation describes remote access modes integrated with the GNOME desktop. On a minimal VPS where you specifically want a separate RDP service and a lighter desktop, XFCE with xrdp is the more direct workflow. If you only need commands, installing any desktop is unnecessary overhead; use SSH instead.
Removal or rollback
If you decide the graphical service is not needed, first remove the network exposure, then disable xrdp while keeping SSH available:
sudo ufw delete allow 3389:3390/tcp
sudo systemctl disable --now xrdpDelete the matching provider-side rule as well. Removing the service does not automatically remove every XFCE package, so review the packages apt proposes before attempting a desktop cleanup. Keeping the desktop installed but disabling xrdp is a valid rollback when you may need the files later.
Practical decision
For Ubuntu 24.04, the dependable sequence is: SSH in, install xfce4, xfce4-session and xrdp, enable xrdp, add the ssl-cert membership when required, write xfce4-session to the RDP user’s ~/.xsession, restart the service, and allow only TCP 3389 from trusted sources. Connect with an RDP client using the Linux user’s password, and use the documented configuration and log paths when a session fails. If the VPS does not need a GUI, staying with SSH avoids the desktop installation and the additional RDP exposure altogether.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
