Skip to main content
To get a graphical desktop on an Ubuntu or Debian VPS, install the lightweight Xfce desktop and xrdp with sudo apt install xfce4 xfce4-goodies xrdp, run sudo adduser xrdp ssl-cert, set Xfce as your session with echo xfce4-session > ~/.xsession, and restart xrdp. Then connect with any Remote Desktop (RDP) client, ideally through an SSH tunnel so port 3389 is never exposed to the internet.

​
Before you start

  • A server doesn’t need a desktop. Most tasks are faster over SSH. A desktop is useful for GUI-only tools or a remote browser, and it uses extra memory and disk.
  • Log in as a normal user with sudo, not root. xrdp logs you in with that user’s password. See create a sudo user.
  • Update the server first.
  • xrdp (an open-source RDP server) lets Windows’ Remote Desktop Connection, Windows App on Mac or Remmina on Linux connect to Linux.

​
Which desktop should I install?

This guide uses Xfce.

​
How to install Xfce and xrdp

1

Install the packages

xorgxrdp is the Xorg backend xrdp uses for the Xorg session. apt normally installs it with xrdp; naming it makes sure it is there.
2

Let xrdp read its certificate

xrdp runs as the xrdp user and uses a certificate that only members of the ssl-cert group can read:
3

Choose Xfce as your session

Run this as the user who will log in (not with sudo):
4

Make xrdp listen on localhost only (recommended)

Open the config file:
In the [Globals] section, change port=3389 to:
xrdp now only accepts connections from the server itself, which you reach through an SSH tunnel in the next section.
5

Restart xrdp

​
How to connect through an SSH tunnel

An SSH tunnel carries the Remote Desktop connection inside your encrypted SSH login, so nothing new is exposed to the internet.
1

Open the tunnel

On your own computer (PowerShell, macOS Terminal or Linux), run:
Leave this window open. Local port 13389 now leads to xrdp on the server.
2

Connect your RDP client to localhost

  • Windows: run mstsc and connect to localhost:13389.
  • Mac, iPhone, Android: in Windows App, add a PC called localhost:13389.
  • Linux: xfreerdp3 /v:localhost:13389 /u:alex or Remmina with server localhost:13389.
3

Log in

At the xrdp login screen keep session Xorg, enter your Linux username and password and click OK. The Xfce desktop appears.
If you skip the localhost step and open port 3389 to the internet, bots will try to guess your Linux password through xrdp. If you must allow direct access, limit it to your own IP, for example sudo ufw allow from 198.51.100.25 to any port 3389 proto tcp, and use a strong password.

​
How to check it worked

Check that xrdp is running and where it listens:
127.0.0.1:3389 means xrdp only accepts local (tunnelled) connections. 0.0.0.0:3389 or *:3389 means it is open on every address.

​
Frequently asked questions

​
I get a black or blank screen after logging in. How do I fix it?

First check that ~/.xsession exists in the home folder of the user you log in as and contains xfce4-session. Then look at ~/.xsession-errors and sudo journalctl -u xrdp-sesman -n 50 for the error.

​
The login window closes immediately. Why?

Check sudo journalctl -u xrdp -u xrdp-sesman -n 50. A certificate permission error means the adduser xrdp ssl-cert step is missing; run it and restart xrdp.

​
Can I install xrdp on AlmaLinux or Rocky Linux?

xrdp is packaged in the EPEL repository for version 9. This guide covers Ubuntu and Debian, where the packages come from the main repositories.

​
How much RAM does a desktop need?

It depends on what you run. Xfce itself is light, but a web browser on the desktop can use more memory than everything else together. Check usage with htop.

VPS and dedicated server guides

Every guide in this section.

SSH into a server

Needed for the tunnel.

RDP from Mac, Linux and mobile

RDP clients for every device.

Set up UFW

Restrict port 3389 to your IP.

Create a sudo user

Log in as a normal user.
Checked against the official xrdp project and the Ubuntu 24.04 xrdp package on 4 November 2026; on Ubuntu 24.04 LTS we confirmed the package names, that the xrdp service runs as user xrdp without ssl-cert membership, and that port=tcp://.:3389 makes xrdp listen on 127.0.0.1 only. A full graphical login was not tested.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026