Securing VNC with SSH

VNC is a free client/server system which provides similar functionality as Windows Remote Desktop. VNC allows you to view a graphical desktop on a remote computer, from another computer which can use a different OS or machine type. VNC is typically used when connecting to non-Windows servers, but can be used on Windows if Remote Desktop is not available. A variety of VNC servers and clients are available for different operating systems.

You can combine VNC with an SSH port forwarding client and server to form a secure solution for remote GUI login. You can use Bitvise SSH Client, and an SSH server suitable for the computer where the VNC server is running.

The VNC server and the SSH server can be installed on the same computer, or on different computers. The SSH client and the VNC viewer can also be on the same computer, or different computers.

It is most secure if the SSH server is on the same computer as the VNC server, and the SSH client is on the same computer as the VNC viewer. SSH port forwarding secures only the connection between the SSH client and the SSH server. If the connection involves additional network hops, for example between VNC viewer and the SSH client; or between the SSH server and the VNC server; then the extra network hops are not secured.

To securely access the VNC server from a client computer:

  • Equip the client computer with an SSH port forwarding client. Configure the SSH client to connect to the SSH server, ideally running on the same computer as the VNC server. Configure a client-to-server port forwarding rule, or "local" forwarding, to forward connections that come to port 5900 on the SSH client, to reach port 5900 on the network interface where the VNC server is accepting connections. To use a VNC display other than 0, change the port numbers appropriately. The VNC port number is 5900 plus the display number. For example, use 5905 for display 5.

  • If the SSH client is on the same computer as the VNC viewer, the SSH client's port forwarding rule should be configured to accept connections on listening interface 127.0.0.1, or another "localhost" interface.

  • If the SSH server is on the same computer as the VNC server, the port forwarding rule should configure the destination as 127.0.0.1 (the server's "localhost" interface). Otherwise, it needs to be an IP address which the SSH server, not client, can use to reach the VNC server.

    Some VNC servers may require that you allow local loopback connections in order to accept port forwarded connections from an SSH server running on the same computer. If such a setting is required, it must be configured in settings for the VNC server.

    If the SSH server is on a different computer than the VNC server, it is common that a setting needs to be enabled in the SSH server to allow port forwarding to other computers (other than "localhost"). If such a setting is required, it must be configured in settings for the SSH server.

Once this is in place, configure the VNC viewer to connect to the interface where the SSH client's port forwarding rule is accepting connections; for example, 127.0.0.1 or "localhost". If you configured the port forwarding rule to accept connections on a port other than 5900, you also need to specify the display number. For example: specify "localhost:5" if the SSH client is listening on port 5905.

The VNC viewer's connection should then reach the SSH client, which should already be connected to the SSH server. The SSH client will port forward the connection to the SSH server, and the SSH server will make the final connection to the VNC server. The portion of the network connection between the SSH client and the SSH server will be encrypted and authenticated using SSH.