University Observatory Munich

Faculty of Physics at the Ludwig-Maximilians-University

Using ssh tunneling for VNC

0. Prepare the configuration

Add a line consisting of localhost to your ~/.vnc/config file on the remote machine. (If the file does not exist, create it. If the file exists and already has such a line, but commented out, then uncomment it.) This will ensure that the VNC server will only answer requests originating on the host on which it is running, and will not advertise its services on the internet.

1. Start the VNC server

ssh to the remote machine and do vncserver -list to verify that no VNC server of yours is already running. (Terminate any old ones that had been started before your configuration change.) If none are, do vncserver to start one. Note the display number assigned to your VNC server (:1, :2, etc.). You can then log out again from the remote machine. The VNC server will keep on running.

If you have not yet set a password for the VNC session, vncserver will ask you for one. When asked if you want to enter a view-only password, answer n.
To unset the password if you have forgotten it, or if want to set a new password, remove the file ~/.vnc/passwd after you have terminated all your running VNC servers.

2. Work with VNC

From your local machine (e.g., your laptop) do ssh -L localhost:xxxx:localhost:yyyy remoteuser@remotemachine where xxxx is an unused port number (such as 7777 or 9876 or 12345 or 5901) on your local machine and yyyy is 5901 if your VNC display number is :1, 5902 if it is :2, etc.
[The first localhost refers to your local machine (e.g., your laptop), the second localhost refers to localhost as seen from the remote machine (i.e., it refers to the remote host).]

You do not have to do anything in this ssh, it is running merely to forward your VNC traffic (although you can certainly use it also for regular work). However, as long as you’re working with the remote VNC desktop, this ssh connection must be kept open. On your local machine then do vncviewer localhost:xxxx where xxxx is the port number you chose above; if you’re using the GUI, start the VNC viewer and connect to localhost:xxxx.

If you wish to interrupt your work, leaving the programs in your remote VNC desktop session running so that you can resume your work later on, then simply terminate the VNC viewer and the forwarding ssh connection. They can be started again in order to reconnect to your running VNC server. This is also true if your internet connection gets interrupted for any reason.

3. Terminate the VNC server

ssh to the remote machine and do vncserver -kill display where display is the display number of your VNC server (:1, :2, etc.). If you’re unsure, you can always do vncserver -list to show your running VNC servers. To conserve resources on the remote machine, do this whenever you don’t need to keep any work open on the remote desktop anymore. You can always start a VNC server again if necessary.