Updated: 12 October 2026 · Applies to: RFB 3.8 (RFC 6143); TigerVNC 1.15.0 with Xfce 4.20 on Ubuntu 26.04 (tested) and TigerVNC 1.13.1 on Ubuntu 24.04 (password handling tested); OpenSSH 10.2
VNC (Virtual Network Computing) lets you see and control a computer’s desktop over the network. It uses the RFB protocol (Remote Framebuffer, RFC 6143): the server sends pictures of the screen, and the client sends back key presses and mouse movements. A VNC server listens on TCP port 5900 plus its display number, so display :1 is port 5901. Plain VNC is not encrypted and its password check is weak, so on a VPS you run the VNC server on localhost only and reach it through an SSH tunnel. This guide explains the protocol and then sets that up with TigerVNC and Xfce.
How the VNC protocol (RFB) works
- Framebuffer level: RFB transfers screen pixels, not drawing commands, so it works with any desktop and any operating system. The viewer only has to show pictures and send input.
- Handshake: server and client agree on a protocol version (for example
RFB 003.008), then on a security type, then the server sends the screen size, pixel format and desktop name. - Server to client: framebuffer updates (rectangles of the screen that changed), colour map entries, a bell and clipboard text.
- Client to server: pixel format, supported encodings, update requests, key events, pointer (mouse) events and clipboard text.
- Encodings: RFC 6143 defines Raw, CopyRect, RRE, Hextile, TRLE and ZRLE. Client and server pick ones they both support; compressed encodings such as ZRLE save bandwidth.
- Ports: IANA assigned TCP port 5900 to RFB. Servers with several displays use 5900 + N.
You can watch the start of the protocol yourself. Our lab script connected to a TigerVNC server on display :1 and printed what the server sent:
server version: b'RFB 003.008\n' security types offered: [2] VNC authentication challenge: 16 bytes: 4734da86a111b0db748dbf60a3f82cc2
VNC security types
- 1, None: no password at all.
- 2, VNC Authentication: the server sends a random 16-byte challenge and the client encrypts it with DES, using the password as the key. Only the first 8 characters of the password count, and RFC 6143 itself calls this method cryptographically weak. It also does not encrypt the session.
- 19, VeNCrypt: wraps the session in TLS. When we started TigerVNC with
-localhost no, it offered[19, 2](VeNCrypt and VNC Authentication).
An SSH tunnel solves both problems: SSH encrypts everything, and the VNC port is never reachable from the internet.
VNC, RDP or X11 forwarding?
- VNC: a whole desktop, any client, simple. Best over an SSH tunnel.
- RDP: Microsoft’s remote desktop protocol (port 3389); Windows has the client built in. On Ubuntu use xrdp: install xrdp on Ubuntu.
- X11 forwarding: single program windows over SSH with
ssh -X, no desktop needed: X11 forwarding over SSH.
1. Install a desktop and TigerVNC
sudo apt update sudo apt install xfce4 xfce4-goodies tigervnc-standalone-server tigervnc-tools dbus-x11
Xfce is a light desktop and ran without extra setup in our VNC test. The package names are the same on Debian 13, which also ships TigerVNC 1.15.0. More on choosing a desktop: install a GUI on Ubuntu Server.
2. Set the VNC password
Log in as your normal user (not root) and run:
vncpasswd
Use 6 to 8 characters. On Ubuntu 26.04 (TigerVNC 1.15), a longer password is refused:
Password should not be greater than 8 characters Because only 8 valid characters are used - try again
On Ubuntu 24.04 (TigerVNC 1.13.1) a longer password is accepted, but only its first 8 characters are used. Answer n when asked for a view-only password. The file is saved as ~/.config/tigervnc/passwd on 26.04 and ~/.vnc/passwd on 24.04.
3. Start the VNC server
$ vncserver :1 -geometry 1280x800 New Xtigervnc server 'vps.example.com:1 (demo)' on port 5901 for display :1. Use xtigervncviewer -SecurityTypes VncAuth -passwd /home/demo/.config/tigervnc/passwd :1 to connect to the VNC server.
Ubuntu’s TigerVNC listens only on localhost by default, which is what you want:
$ ss -ltn | grep 5901 LISTEN 0 5 127.0.0.1:5901 0.0.0.0:* LISTEN 0 5 [::1]:5901 [::]:*
No start script is needed: the Ubuntu package starts the default desktop session, and in our lab Xfce came up by itself (xfce4-session, xfwm4, xfdesktop and xfce4-panel were running). A note that .Xauthority does not exist on the first start is harmless. List and stop sessions with:
vncserver -list vncserver -kill :1
4. Connect through an SSH tunnel
On your own computer, open a tunnel from local port 5901 to port 5901 on the server (use your server’s IP and SSH user):
ssh -L 5901:localhost:5901 demo@203.0.113.10
Leave that SSH session open, then point your VNC viewer at localhost:5901 and enter the VNC password. If your SSH server uses another port, add -p PORT. On Windows you can set up the same tunnel in PuTTY; both ways are shown in how to create an SSH tunnel. Any VNC viewer works: TigerVNC Viewer for Windows, macOS and Linux is linked from the TigerVNC releases page, and Remmina is in the Ubuntu and Debian repositories.
The firewall needs only your SSH port open (open ports with UFW); do not open ports 5900 to 5910. Exposing VNC directly is not a good idea: even with -localhost no, TigerVNC still offered the weak VNC Authentication next to VeNCrypt in our test, and a client may choose it.
5. Start VNC at boot (optional)
The Ubuntu 26.04 package ships a systemd unit, tigervncserver@.service. Its instructions: map the display to your user in /etc/tigervnc/vncserver.users (a line such as :1=demo), then run:
sudo systemctl enable --now tigervncserver@:1.service
Stop any session you started by hand first, so display :1 is free.
The VNC console in your client area
A Ucartz KVM VPS also has a VNC console in the client area. That one is different: it shows the VPS’s own screen from the virtualisation host, so it works even when SSH or the network inside the VPS is down, and it needs no VNC server on the VPS. Use it for repairs and the desktop above for daily work. See access your VPS via VNC in Virtualizor and change the VNC password in Virtualizor.
Official documentation: RFC 6143: The Remote Framebuffer Protocol and the IANA RFB registry.
