RHEL 10 TigerVNC Alternative: Configure GNOME Remote Desktop

TigerVNC server was removed from RHEL 10. That is intentional, not a broken repository mirror. Red Hat replaced it with GNOME Remote Desktop using RDP. If you used TigerVNC so remote users could open separate graphical sessions, use GNOME Remote Desktop Remote Login mode — the workflow this guide covers.

The same change applies on Rocky Linux 10, AlmaLinux 10, Oracle Linux 10, and CentOS Stream 10. Windows Remote Desktop, Remmina, GNOME Connections, and FreeRDP connect over TCP 3389.

This guide focuses on Remote Login, the closest match for the common multi-user TigerVNC or XRDP pattern where remote users need a graphical login screen. TigerVNC also supported other workflows; GNOME Remote Desktop splits those into three modes (see below). Desktop Sharing appears later as a shorter alternative.

Why TigerVNC is not available on RHEL 10

If dnf install tigervnc-server returns No match for argument: tigervnc-server, that is expected on EL10 — not a repo sync problem. RHEL 10 removed TigerVNC along with xorg-x11-server as part of the move to Wayland. GNOME Remote Desktop with RDP is the supported replacement.

dnf info tigervnc-server

tigervnc-server returns:

Updating Subscription Management repositories.
Last metadata expiration check: 0:00:05 ago on Sat 05 Sep 2026 04:18:16 PM IST.
Error: No matching Packages to list

Check XRDP the same way:

dnf info xrdp

Updating Subscription Management repositories.
Last metadata expiration check: 0:00:08 ago on Sat 05 Sep 2026 04:18:16 PM IST.
Error: No matching Packages to list

XRDP gives the same result with the standard repositories used here.

xrdp may exist in third-party repos, but it is not in the standard EL10 workflow covered here. Do not force-install RHEL 9 TigerVNC RPMs on EL10.

gnome-connections can still act as a VNC client for older servers, but it does not provide a VNC server on RHEL 10.

Choose the correct GNOME Remote Desktop mode

What did you use VNC for?

That is why this article uses Remote Login: it matches the case where remote users sign in through GDM instead of sharing an existing console session.

Desktop sharing connects to whoever is already logged in at the console. Remote login presents the GNOME login screen so different users can sign in remotely. A single-user headless session is a separate workflow with its own TLS files and credentials; Red Hat also lists SELinux permissive mode as a prerequisite for that path.

Install GNOME Remote Desktop and GNOME

Install the remote desktop server, display manager, and FreeRDP. You need freerdp for winpr-makecert when you generate TLS files:

sudo dnf install gnome-remote-desktop gdm freerdp

DNF lists packages, dependencies, and the transaction summary. Confirm when prompted.

Confirm the RPMs are present:

rpm -q gnome-remote-desktop gdm freerdp

Installed versions:

gnome-remote-desktop-49.3-3.el10_2.x86_64
gdm-47.0-21.el10_2.x86_64
freerdp-3.10.3-12.el10_2.10.x86_64

If GNOME is not already installed, add a graphical environment. On a typical server:

sudo dnf group install "Server with GUI"

Workstation installs usually already include the GNOME session this workflow needs.

Red Hat requires a reboot after installing gnome-remote-desktop for multi-user Remote Login:

sudo reboot

After the system returns, set the boot target to graphical mode and continue with TLS and grdctl configuration:

sudo systemctl set-default graphical.target

Configure multi-user Remote Login with RDP

Remote Login ties GNOME Remote Desktop to GDM. Clients authenticate twice: first with an RDP gate user, then with a normal Linux account at the GNOME login screen.

Windows / Remmina / mstsc
        |
        |  TCP 3389
        v
 GNOME Remote Desktop
 RDP gate username/password
        |
        v
 GNOME / GDM login screen
        |
        |  Linux username/password
        v
 User's GNOME desktop

RDP gate user vs Linux login user

• RDP gate user — Stored by GNOME Remote Desktop, not in /etc/passwd. No useradd. Set it with grdctl --system rdp set-credentials. We used rdpadmin in testing.
• Linux login user — A normal account already on the server (student, golinuxcloud, and so on). The client picks that account only after the RDP gate accepts rdpadmin.

TigerVNC used a VNC password per display. Remote Login replaces that first hop with the RDP gate user, then keeps the GDM login you would use at the console.

Create TLS files for the system service

Red Hat's multi-user procedure stores TLS material under certificates/ as rdp-tls.crt and rdp-tls.key. Create that directory as the gnome-remote-desktop user:

sudo -u gnome-remote-desktop mkdir -p \
  ~gnome-remote-desktop/.local/share/gnome-remote-desktop/certificates

Generate the self-signed certificate. Run this only after freerdp is installed:

sudo -u gnome-remote-desktop /usr/bin/winpr-makecert -silent -rdp \
  -path ~gnome-remote-desktop/.local/share/gnome-remote-desktop/certificates \
  rdp-tls

Confirm the two TLS files exist — nothing else should appear yet:

ls -la /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop/certificates/

total 8
drwxr-xr-x. 2 gnome-remote-desktop gnome-remote-desktop   44 Sep  5 17:27 .
drwxr-xr-x. 3 gnome-remote-desktop gnome-remote-desktop   79 Sep  5 17:27 ..
-rw-r--r--. 1 gnome-remote-desktop gnome-remote-desktop 1026 Sep  5 17:27 rdp-tls.crt
-rw-r--r--. 1 gnome-remote-desktop gnome-remote-desktop 1705 Sep  5 17:27 rdp-tls.key

credentials.ini appears only after you run grdctl --system rdp set-credentials later.

Register TLS material and the RDP gate user

Point the system daemon at the Red Hat certificate paths:

sudo grdctl --system rdp set-tls-key \
  /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop/certificates/rdp-tls.key

sudo grdctl --system rdp set-tls-cert \
  /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop/certificates/rdp-tls.crt

On a VM without a virtual TPM, grdctl may print Init TPM credentials failed because No TPM device found, using GKeyFile as fallback. Credentials still save to GKeyFile; the warning is normal.

Create the RDP gate user — not a Linux account, not created with useradd:

sudo grdctl --system rdp set-credentials rdpadmin 'YourRdpGatePassword'

Or run sudo grdctl --system rdp set-credentials without arguments and enter the values when prompted.

Turn on the system-wide RDP backend:

sudo grdctl --system rdp enable

Enable GDM and the remote desktop service

sudo systemctl enable --now gdm

sudo systemctl enable --now gnome-remote-desktop.service

Confirm the daemon is running:

systemctl status gnome-remote-desktop.service

Look for Active: active (running) and RDP server started:

● gnome-remote-desktop.service - GNOME Remote Desktop
     Loaded: loaded (/usr/lib/systemd/system/gnome-remote-desktop.service; enabled; preset: disabled)
     Active: active (running) since Sat 2026-09-05 16:19:16 IST; 1h 1min ago
   Main PID: 6539 (gnome-remote-de)
             └─6539 /usr/libexec/gnome-remote-desktop-daemon --system

Sep 05 16:19:16 vm1.lab.example gnome-remote-de[6539]: RDP server started

Open firewalld for RDP

Open the port before you test from a client. Find the active zone:

sudo firewall-cmd --get-active-zones

Note the zone tied to your server interface:

public (default)
  interfaces: enp0s3 enp0s8

Allow TCP 3389 permanently in that zone. Replace public if your interface uses a different zone:

sudo firewall-cmd \
  --permanent \
  --zone=public \
  --add-port=3389/tcp

Apply the change:

sudo firewall-cmd --reload

success

Confirm the port is open:

sudo firewall-cmd --zone=public --query-port=3389/tcp

yes

Port notes:

• Remote Login uses TCP 3389
• Desktop Sharing also uses 3389 unless Remote Login is enabled at the same time, when sharing moves to 3390

Restrict RDP to a trusted management network or VPN instead of exposing port 3389 on the public internet. See the firewalld cheat sheet for zone management.

Verify Remote Login is ready

Review the RDP configuration:

sudo grdctl --system status --show-credentials

Expect Username: rdpadmin, RDP enabled, and port 3389:

Init TPM credentials failed because No TPM device found, using GKeyFile as fallback.
Overall:
	Unit status: active
RDP:
	Status: enabled
	Port: 3389
	TLS certificate: /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop/certificates/rdp-tls.crt
	TLS fingerprint: ed:e8:69:ed:09:c2:24:42:6a:6f:e1:6a:24:09:2d:21:8c:53:66:ce:04:de:76:e0:0d:72:e0:7f:93:eb:17:31
	TLS key: /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop/certificates/rdp-tls.key
	Username: rdpadmin
	Password: (hidden)

Confirm something is listening on port 3389:

sudo ss -lntp | grep ':3389'

LISTEN 0      5                  *:3389             *:*    users:(("gnome-remote-de",pid=6539,fd=9))

The TLS fingerprint changes when you regenerate rdp-tls.crt and rdp-tls.key. Match the client certificate prompt against the current sudo grdctl --system status output.

If gnome-remote-desktop.service is not active after the reboot, inspect sudo journalctl -u gnome-remote-desktop.service -b before connecting from a client.

Connect from Windows, Linux, or macOS

Every client goes through the same two logins shown in the diagram above: RDP gate first, then a Linux user at the GNOME screen.

Connect from Windows

Open Remote Desktop Connection (mstsc) or Windows App and enter the server IP on port 3389.

1. Accept the self-signed certificate after checking the fingerprint from sudo grdctl --system status.
2. Enter the RDP gate user from grdctl --system rdp set-credentials (for example rdpadmin). This prompt appears before any GNOME desktop loads — the same step shown in the Remmina screenshot below.
3. At the GNOME login screen, pick an existing Linux user and enter that account's password.

Windows does not label the first prompt clearly as a separate “gate” login, which catches many people migrating from TigerVNC. Treat the first username/password dialog as the RDP gate credential, not your Linux password.

Connect from Linux

GUI clients such as GNOME Connections and Remmina work when you choose RDP, not VNC. Point the connection at your server IP on port 3389 (for example 192.168.56.116:3389) and use the RDP gate user rdpadmin.

Remmina shows a self-signed certificate on the first connect. Check the SHA-256 fingerprint against sudo grdctl --system status before you click Yes:

The fingerprint in the screenshot may differ from yours if TLS was regenerated. Use whatever grdctl --system status reports on your host.

Next, Remmina asks for the RDP gate user — not a Linux account, not the Linux password. Enter the values from grdctl --system rdp set-credentials (rdpadmin in our tests):

After the gate login, you get the GDM screen. Pick an existing Linux user and enter that account's password:

Windows and macOS clients follow the same three steps: certificate, RDP gate, then Linux user at the GNOME screen.

From the command line with FreeRDP, locate the client binary:

command -v xfreerdp || command -v xfreerdp3

The client path on our test host:

/usr/bin/xfreerdp

Connect with the RDP gate user:

xfreerdp /v:192.168.56.116 /u:rdpadmin /cert:tofu

FreeRDP prompts for the RDP gate password. /cert:tofu trusts the certificate on first connect. Omit it if you want to verify the fingerprint manually against sudo grdctl --system status first.

Replace the IP and gate username with your values. After the gate, sign in with a Linux account at the GNOME screen.

Connect from macOS

Use Windows App or another RDP-compatible client. Select RDP in multi-protocol clients; VNC mode does not apply to GNOME Remote Desktop on EL10.

Enable Desktop Sharing instead of Remote Login

Desktop Sharing is shorter to configure but solves a different problem:

• Shares the GNOME desktop of the currently logged-in user
• Does not present a new multi-user login screen
• Requires an active local GNOME graphical session
• Uses credentials configured in GNOME Settings
• Can allow remote control instead of view-only access when enabled

Open Desktop Sharing from the GNOME settings path:

Settings → System → Remote Desktop → Desktop Sharing

Enable Desktop Sharing, configure Login Details, open TCP 3389, and enable Remote Control when required. If Remote Login is also enabled, Desktop Sharing listens on TCP 3390 instead.

Verify and troubleshoot GNOME Remote Desktop

Run these checks when something fails. They cover packages, RDP status, services, listeners, firewall, and recent logs:

rpm -q gnome-remote-desktop gdm freerdp
sudo grdctl --system status
systemctl status gnome-remote-desktop.service
systemctl status gdm
systemctl get-default
sudo ss -lntp | grep -E ':3389|:3390'
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=public --list-all
sudo journalctl -u gnome-remote-desktop.service -b
sudo journalctl -u gdm -b

Replace public in the firewall command with the zone tied to your server interface. systemctl get-default should report graphical.target when remote login is meant to survive a reboot.

Migrating an old TigerVNC configuration to RHEL 10

TigerVNC settings do not carry over automatically. Map your old setup to one of the three GNOME Remote Desktop modes before you reconfigure access.

These items do not migrate directly:

• vncserver.users
• vncserver-config-defaults
• ~/.vnc/passwd
• ~/.config/tigervnc/config
• vncserver@:<display>.service
• VNC display numbers such as :2
• Firewall ports such as 5902

Migration checklist:

1. Record existing VNC users and what each one needed (shared console, independent session, or headless desktop)
2. Choose Desktop Sharing, Remote Login, or the headless single-user workflow for each case
3. Disable any leftover TigerVNC unit files from an upgraded system — there is nothing to uninstall from standard EL10 repos
4. Install GNOME Remote Desktop and GDM
5. Configure TLS and the RDP gate user with grdctl
6. Replace VNC firewall rules with TCP 3389
7. Test one existing Linux user through the RDP gate
8. Archive old VNC password files only after RDP access is confirmed

Summary

TigerVNC server is gone from EL10. GNOME Remote Desktop with RDP is the supported replacement, and Remote Login covers the common case where remote users need a graphical login screen.

• Remote Login — multi-user access through GDM (this guide)
• Desktop Sharing — control the console session already logged in locally
• Headless single-user — separate Red Hat procedure; not covered here

For TigerVNC on RHEL 8 or 9, see the TigerVNC server guide. For firewall rules, see the firewalld cheat sheet.

References

• Red Hat Enterprise Linux 10 — Remotely accessing the desktop — Desktop Sharing, Remote Login, and multi-user RDP
• Red Hat Enterprise Linux 10 — Removed functionalities — TigerVNC and X.Org removals

Check the installed grdctl options on your host:

man grdctl

grdctl --help

The manual lists RDP subcommands such as set-credentials and set-tls-cert.