Install and Configure TigerVNC Server on Ubuntu 26.04

Install TigerVNC on Ubuntu 26.04 to run a lightweight XFCE desktop you reach over SSH. The server listens on 127.0.0.1:5901 for display :1, so remote access goes through a tunnel instead of exposing VNC on the network.

When you finish, tigervncserver@:1.service starts an XFCE session for your Linux user using TigerVNC 1.15 paths under ~/.config/tigervnc/. You do not need a hand-written vncserver@.service unit on this release.

Quick answer

TigerVNC paths on Ubuntu 24.04 / 22.04 vs 26.04

Ubuntu 26.04 is not just a newer package version. TigerVNC 1.15 moves config, passwords, and session logs into XDG locations. If you follow a ~/.vnc/ tutorial on 26.04, vncpasswd and the service will look in the wrong place.

For the legacy layout, use TigerVNC on Ubuntu 24.04 & 22.04.

What this VNC setup creates

TigerVNC standalone mode starts a new virtual X desktop. It does not show the same GNOME session that might be on the machine’s physical monitor.

Ubuntu server (SSH)
┌──────────────────┐
│   TigerVNC       │
│   virtual XFCE   │
│   desktop :1     │
└────────┬─────────┘
          │
      TCP 5901
          │
    localhost only
          │
    SSH tunnel
          │
          ▼
    VNC viewer
    on your laptop

XFCE is a common choice for VNC because it is lighter than a full GNOME desktop and runs cleanly inside a virtual X session. For a broader XFCE install on the host, see install XFCE on Ubuntu. On Red Hat family systems, the packaging differs; use configure TigerVNC on RHEL there.

TigerVNC vs sharing your existing desktop

Wayland on Ubuntu

Ubuntu Desktop often runs GNOME on Wayland, but this workflow does not depend on mirroring that session. TigerVNC creates its own X11 virtual framebuffer and starts XFCE through the session entry in /usr/share/xsessions/. You do not need to disable Wayland on the host just to follow these steps.

Prerequisites

You need:

• Ubuntu 26.04 with network access to install packages from the archive.
• A normal Linux account that will own the VNC session (not root).
• SSH access to the server for tunneling.
• sudo for package installation and editing /etc/tigervnc/vncserver.users.

If the host is minimal, install XFCE components as shown below or follow install XFCE on Ubuntu first. Prefer RDP from Windows clients? Compare install XRDP with XFCE on Ubuntu.

Install TigerVNC and XFCE on Ubuntu 26.04

Refresh the package index:

sudo apt update

Install the standalone server, password tools, D-Bus helper, and a compact XFCE session stack:

sudo apt install -y tigervnc-standalone-server tigervnc-tools dbus-x11 xfce4-session xfce4-panel xfce4-settings xfdesktop4 xfwm4 xfce4-terminal

tigervnc-tools provides vncpasswd. Install it explicitly so the password utility is present on minimal images where only the server package was pulled in.

Check the versions Ubuntu 26.04 ships:

dpkg -l tigervnc-standalone-server tigervnc-tools | awk '/^ii/{print $2, $3}'

tigervnc-standalone-server 1.15.0+dfsg-2build1
tigervnc-tools 1.15.0+dfsg-2build1

For a fuller desktop with extra plugins, swap the XFCE list for xfce4 and xfce4-goodies. On a small VPS, the session packages above are usually enough.

Set the TigerVNC password

Run vncpasswd as the user who will own display :1. Create that user first if you need a dedicated account:

sudo adduser vncuser

Switch to the VNC user before setting the password:

su - vncuser

On the TigerVNC 1.15 package tested on Ubuntu 26.04, vncpasswd accepts 6–8 characters and rejects a longer entry. VncAuth itself uses only eight significant characters, so treat the password as 6–8 characters and rely on the SSH tunnel for transport security:

vncpasswd

TigerVNC stores the VNC password in ~/.config/tigervnc/passwd with owner-only permissions. That file is separate from the Linux account password and is not a substitute for locking down network access.

The illustration below shows where TigerVNC 1.15 keeps config, password, and session logs on Ubuntu 26.04:

Password:
Verify:
Would you like to enter a view-only password (y/n)? n

Plan to connect through SSH tunneling. The VNC password still matters on localhost, but you should not expose port 5901 on untrusted networks and rely on VNC auth alone.

Configure the XFCE VNC session

TigerVNC 1.15 on Ubuntu reads per-user options from ~/.config/tigervnc/config. Create the directory and file as the VNC user:

mkdir -p ~/.config/tigervnc
nano ~/.config/tigervnc/config

Use these lines to start the XFCE session, bind to localhost, and set the virtual screen size:

session=xfce
localhost
geometry=1280x800
depth=24

session=xfce must match a .desktop name under /usr/share/xsessions/:

ls /usr/share/xsessions/

lightdm-xsession.desktop
xfce.desktop

The value xfce corresponds to xfce.desktop. localhost keeps Xtigervnc on loopback so clients reach it through SSH forwarding or from the same host.

If you switched to vncuser with su - vncuser, return to your original sudo-capable account before the next section. A user created with adduser is not in the sudo group, so sudo nano and sudo systemctl will fail until you exit:

exit

Map the Ubuntu user to VNC display :1

The packaged service reads /etc/tigervnc/vncserver.users. As a sudo-capable user on the server (not necessarily vncuser), add one line that ties display :1 to the Linux account that owns the VNC session (example uses vncuser):

sudo nano /etc/tigervnc/vncserver.users

:1=vncuser

Display :1 maps to TCP port 5901 (display number plus 5900). Pick another display only if :1 is already assigned.

Start the TigerVNC systemd service

Ubuntu ships the packaged tigervncserver@.service unit. You do not need to create your own template under /etc/systemd/system/. Enable and start display :1:

sudo systemctl enable --now tigervncserver@:1.service

To inspect the unit file systemd actually uses:

systemctl cat tigervncserver@.service

Check that systemd considers the display :1 instance active:

systemctl status tigervncserver@:1.service --no-pager

● tigervncserver@:1.service - Remote desktop service (VNC)
     Loaded: loaded (...; enabled; preset: enabled)
     Active: active (running)

The active (running) line is what you want. Timestamps and process IDs differ on every host.

Verify VNC is listening on port 5901

With localhost in the user config, the listener should be on loopback, not 0.0.0.0:

ss -ltnp | grep 5901

LISTEN 0 5 127.0.0.1:5901 0.0.0.0:*
LISTEN 0 5     [::1]:5901    [::]:*

Session logs land under ~/.local/state/tigervnc/ on TigerVNC 1.15:

ls ~/.local/state/tigervnc/

myserver:1.log

To inspect other listening ports, see ss command and check open ports in Linux.

Connect securely through an SSH tunnel

From your laptop, forward local port 5901 to the server’s loopback VNC port. Replace ssh_user and server_ip with values you already use for SSH:

ssh -N -L 5901:127.0.0.1:5901 ssh_user@server_ip

ssh_user is any account that can log in over SSH. It does not have to be vncuser, the account that owns display :1. A dedicated vncuser created only for the desktop may not have SSH keys or password login enabled.

-N skips a remote shell so the session exists only for port forwarding. Leave that terminal open while you use the desktop. Because TigerVNC listens on 127.0.0.1 when localhost is set in the user config, you do not need to open TCP 5901 in UFW for this SSH-tunnel setup. Only SSH must be reachable from your client.

The ssh command covers -L syntax; SSH port forwarding walks through more tunnel layouts. For repeated connections, store host and key settings in an SSH config file.

Connect from a VNC viewer

Install a VNC viewer on the computer where you run the SSH tunnel. On Ubuntu:

sudo apt install tigervnc-viewer

On Windows or macOS, install TigerVNC Viewer or another client that speaks RFB.

With the tunnel running, point your viewer at the local end of the forward:

127.0.0.1::5901

The double colon is the documented TigerVNC syntax for an explicit TCP port. Because your SSH forward maps local port 5901 to the server’s loopback VNC listener, 127.0.0.1::5901 is the clearest address to enter.

You can also use 127.0.0.1:1, because display :1 maps to TCP port 5901. Current TigerVNC Viewer builds often accept 127.0.0.1:5901 in the connection field as well, but the single-colon form is ambiguous between display and port in the manual; prefer ::5901 when you mean the forwarded TCP port.

In TigerVNC Viewer, the address field should target the local end of the tunnel, not the server’s public IP:

The highlighted server field is what you enter on the laptop after ssh -L is active.

Enter the VNC password you set with vncpasswd, not your Linux login password. A successful login opens a separate XFCE session with its own panel and desktop shortcuts:

That screen is the virtual desktop on the server, not the GNOME session on the physical monitor.

Start TigerVNC automatically at boot

Because you started the unit with enable --now, it is already scheduled for multi-user boot. Confirm with:

systemctl is-enabled tigervncserver@:1.service

enabled

If the unit is failed after a reboot, read the session log in ~/.local/state/tigervnc/ and journalctl -u tigervncserver@:1.service before retrying. For a related systemd resource-limit failure on older custom units, see VNC server service failed resource limit exceeded.

Optional: direct VNC access on a trusted LAN

SSH tunneling remains the recommended setup. If you deliberately need direct access on a private network, set localhost=no explicitly. Commenting out or deleting the localhost line is not enough on TigerVNC 1.15; the wrapper still defaults to loopback-only when VncAuth is in use.

Edit ~/.config/tigervnc/config as the VNC user and use TLS for the session instead of plain VncAuth on the wire:

session=xfce
localhost=no
securitytypes=TLSVnc
geometry=1280x800
depth=24

Restart the service and confirm the listener is no longer bound only to loopback:

sudo systemctl restart tigervncserver@:1.service

After the restart, the socket should listen on all interfaces instead of only 127.0.0.1:

ss -ltnp | grep 5901

LISTEN 0      5            0.0.0.0:5901       0.0.0.0:*

On UFW, allow SSH first, then limit VNC to one source:

sudo ufw allow OpenSSH
sudo ufw allow from CLIENT_IP to any port 5901 proto tcp

Your VNC client must negotiate TLS (TigerVNC Viewer enables this when the server offers TLSVnc). Do not expose port 5901 on the public internet; keep SSH tunneling as the default pattern.

Uninstall TigerVNC

Stop and disable the VNC display when you no longer need it:

sudo systemctl disable --now tigervncserver@:1.service

Remove the TigerVNC packages if nothing else on the host depends on them:

sudo apt purge tigervnc-standalone-server tigervnc-tools

Delete the :1=youruser line from /etc/tigervnc/vncserver.users when that display will not return. You can leave files under ~/.config/tigervnc/ if you might reinstall TigerVNC later. Do not purge XFCE session packages automatically; other users or jobs may still need the desktop stack.

Troubleshooting

List active TigerVNC sessions and their display numbers:

tigervncserver -list

TigerVNC server sessions:

X DISPLAY #     RFB PORT #     PROCESS ID #
:1              5901           3075

Inspect service logs when the unit fails but the display mapping looks correct:

journalctl -u tigervncserver@:1.service -n 50 --no-pager

For journald filters, see journalctl.

Summary

Ubuntu 26.04 ships TigerVNC 1.15 with XDG paths under ~/.config/tigervnc/ and a ready-made tigervncserver@:1.service unit. Install tigervnc-standalone-server and tigervnc-tools, add a compact XFCE stack, set vncpasswd, point session=xfce in the user config with localhost enabled, and map :1=youruser in /etc/tigervnc/vncserver.users.

That combination gives you a separate XFCE desktop on port 5901 without copying an old xstartup plus custom systemd template from pre-1.14 guides. Connect with ssh -N -L 5901:127.0.0.1:5901 and open your viewer to 127.0.0.1::5901 so VNC never has to listen on the public interface.

On Ubuntu 24.04 or 22.04, use TigerVNC on Ubuntu 24.04 & 22.04 so password and config paths stay under ~/.vnc/. If your clients primarily use RDP, compare XRDP with XFCE before you choose VNC.

References

• TigerVNC
• tigervncsession(8) man page
• tigervncpasswd(1) man page
• Ubuntu packages: tigervnc-standalone-server (resolute)