You are doing the right thing by using SSH to initiate the connection to your Linux machine. I would suggest the following:
- Install x11vnc on your Ubuntu machine: sudo apt install x11vnc
- Configure x11vnc password: x11vnc -storepasswd which keeps a copy of the password you choose in the user's ~/.vnc/passwd file in their home directory if you go with defaults
- You only start x11vnc after you connect via SSH. That way it's more secure than leaving it running as a service. (x11vnc can be set up as an auto-starting service but I personally don't recommend it.) But first of all, start x11vnc on the Ubuntu machine locally, i.e. while you are still in front of the Ubuntu machine, so you can check that it works. In a terminal: sudo x11vnc -auth guess -rfbauth /home/username/.vnc/passwd -display :0 and change "username" to the real user! Explanation: "Sudo" is needed for x11vnc to run properly with hardware access, "-auth guess" is to try to automatically find the XAUTHORITY info which can be in different locations depending on that machine's display manager, "rfbauth" tells it where to look for the previously saved password, and "-display :0" will use the primary screen of the Ubuntu machine.
- Close x11vnc by: Ctrl C.
- Close the terminal.
- Over on the Windows machine install a VNC tool such as TightVNC.
- On the Windows machine open a Command Prompt to use for SSH to the Ubuntu machine. Include the relevant port forwarding. Type: ssh -L 5900:localhost:5900 user@xxx.xxx.xxx.xxx using the correct IP address of course, then press Enter. Explanation: The -L option sends a local port number via the SSH connection (by default VNC traffic is over TCP port 5900), the hostname or IP address following the colon (:) is where the remote machine will send that port's traffic which in this case is the Ubuntu machine's localhost, and the port number after the second colon is the port number it translates that traffic to which in this case is just the same as the incoming connection.
- In the SSH session scroll up using keyboard arrows to find the "sudo x11vnc . . ." command we ran earlier, or type it again as per item 3 above, then press Enter. The subsequent terminal output will show if x11vnc is running.
- Still on the Windows machine, open your VNC Viewer installed earlier in point 6 above, and type "localhost" without quotes in the box, then run it. It should ask for the VNC password we set up earlier in point 2 above. Explanation: By default VNC viewers will try to use port 5900 and so when we use localhost as the address the Windows machine will try to connect to itself on port 5900, but we are already forwarding port 5900 traffic over the SSH connection in the terminal window as in point 7 above - that's how it reaches the Ubuntu machine.
You can now see and control the Ubuntu desktop that the Ubuntu user is seeing from the Windows machine. When the remote work is done and the support guy on Windows wants to disconnect, he can close his VNC viewer and this usually causes x11vnc to close on the Ubuntu machine. If so, the Windows man will see the remote SSH terminal in his command prompt sitting back at the default prompt. If x11vnc did not close when the Windows VNC viewer was closed then it can be stopped in the terminal by typing Ctrl C and then x11vnc will close. The Windows man then types exit and then he's totally disconnected from the Ubuntu machine and his Windows Command Prompt now looks "normal".
Points to note:
- When installing VNC on the Windows machine you may have options such as whether to install a viewer only or a full installation including VNC server service on the Windows machine. If you did a full install the new Windows VNC service may be running listening on port 5900 on the Windows machine, and depending on firewall settings etc., this may cause problems when using the SSH command in point 7 above. In this case we need to make a few small changes. Firstly, when connecting from Windows to Ubuntu in the Windows Command Prompt we can forward a different local port, so the command would look more like ssh -L 5910:localhost:5900 user@xxx.xxx.xxx.xxx before pressing Enter. Explanation: as before, -L forwards a local port number which we are now making 5910, the Ubuntu machine still sends it to its "localhost" and converts to port 5900 when it does so. After making the SSH connection with port 5910 being forwarded to the Ubuntu port 5900 we can start up the x11vnc session again as per point 8 above. Once x11vnc is running, we can start the Windows VNC Viewer, but this time the address we're connecting to will be localhost:5910 which forwards right through to the x11vnc port on the Ubuntu machine.
- If connecting over the Internet you do not want to use standard SSH ports through your firewall (SSH default is port 22). Either use a non-standard port so it's not too obvious what the open port is for, or better still, use a VPN connection to get into the network securely first and then use SSH at the Windows Command Prompt as if on the Ubuntu's network locally. So, if using SSH over the Internet on a non-standard port such as port 12345, your Windows Command Prompt SSH connection in point 7 above would look more line ssh -p 12345 -L 5904:localhost:5900 user@host.name. The explanation:
"-p 12345" runs the SSH connection over port 12345 rather than port
22.
- x11vnc running as above makes its local VNC port open to any machine on the LAN, or indeed bots or malware or the like. There is another option when running x11vnc that only allows the localhost to connect to it. But since we've connected to it over SSH first and forwarded the VNC ports over the SSH connection as in point 7 above we can still connect to x11vnc as a localhost connection. The x11vnc option for this is -localhost and so the terminal command, as per point 8 above would now look like: sudo x11vnc -localhost -auth guess -rfbauth /home/username/.vnc/passwd -display :0
There are many other configuration options as well as command switches and options, but the above information works for me. Of course there are many genius techies out there, so please reply if there's more efficient options I could be using. I'm all for maximising effectiveness for minimal work!
