Try   HackMD

Setting up a remote desktop from your work laptop to Aalto Ubuntu workstation

tags: tutorial

Goal

To have a comfortable way to run analyses on the workstation in your office from your laptop that may be anywhere in the world. While running terminal programs is best done through plain SSH, in this tutorial we will be looking at using VNC to create a full-fledged remote desktop.

Setup on your Aalto Ubuntu workstation

Install TigerVNC

Install TigerVNC on your workstation by running in a terminal: pkcon install tigervnc-standalone-server. You'll need to be the designated primary user of the workstation in order to be allowed to install packages (contact IT if you don't have this permission and feel you should have).

Setup a password

Run vncpasswd in a terminal to set the password you will use to connect to the remote desktop on your workstation. Obviously, if someone manages to connect they have full access to your machine, so make it a good password. The password you have created is stored by default in ~/.vnc/passwd.

Setup X on the remote desktop

Whenever you connect to the TigerVNC server, it will start a new X session with its own configuration. This is useful, because it allows us to set things up to suit your laptop instead of your workstation (the DPI setting is a good example of this). When the X server is started, the file ~/.vnc/xstartup is executed, so that file controls what desktop environment is started. You may have noticed that when you login to your workstation, you can choose from many different environments, where "Ubuntu" is the default. To make TigerVNC start the default Ubuntu desktop, place the following lines in your ~/.vnc/xstartup:





export DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/1000/bus"
export XKL_XMODMAP_DISABLE=1
env GNOME_SHELL_SESSION_MODE=ubuntu /usr/bin/gnome-session --systemd --session=ubuntu
dbus-launch --exit-with-session /usr/bin/gnome-shell

Start the TigerVNC server

By executing the command vncserver -geometry 1900x1080 -localhost yes in a terminal, TigerVNC will start in the background and start listening to incoming connections. For optimal graphics, replace 1900x1080 with the native resolution of your laptop screen. The -localhost yes is an important security consideration. It prevents anyone from outside to connect to the VNC server directly (although keep in mind anyone from your department can log into your workstation with their credentials to circumvent this). Instead, they need to go through an SSH tunnel (which we'll setup on the laptop side). Verify it is running by executing vncserver -list and take note of the RFB PORT # which tells you which port to connect to, which you will need later.

Setup on your laptop

Setup an SSH tunnel

Aalto's firewill will prevent anyone from outside the campus to connect to your workstation. This is probably a good thing, given the somewhat lax security of VNC servers. In order to connect, we will need to hop through one of Aalto's "shell servers" using SSH. Which server is your designated shell server depends on the department you are in:

CS: magi.cs.aalto.fi
NBE: amor.org.aalto.fi
Math: elliptic.aalto.fi or illposed.aalto.fi

You will also need the hostname of your workstation, which is written on a sticker on the machine itself, or can be obtained by executing hostname in a terminal. For example, I am in NBE, so my shell server is amor.org.aalto.fi and my workstation is d33-0042.

If your laptop is running Linux or MacOS, you already have SSH installed. If you are running Windows 10 or 11, SSH is installed but not necessarily enabled (try executing ssh in a terminal to find out). To enable it, execute this in a PowerShell with administrator privileges:

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

To configure the SSH tunnel, create a file ~/.ssh/config if it doesn't exist yet (/Users/your-username/.ssh/config on Windows) and add the following contents:

Host: tunnel
    Hostname d33-0042
    User name1
    ProxyJump amor.org.aalto.fi
    LocalForward 5901 localhost:5901

Replace d33-0042 with the hostname of your workstation, name1 with your Aalto username,amor.org.aalto.fi with your shell server and replace both instances of 5901 with the port number that TigerVNC is listening on. Activate the tunnel by executing ssh tunnel and leaving the terminal open.

Install a VNC client on your laptop

There are many VNC clients. For Windows, I found TightVNC to be a good client (better than the Windows version of TigerVNC). On Linux, Remmina is good. Install the VNC client of your choice and configure it to connect to localhost:5901 (replace 5901 with the port you setup the SSH tunnel for in the previous step). Insert the password you setup with passwd all the way in the beginning of the tutorial and hopefully you are now presented with a remote desktop!

[Optional] Setup alternative desktop environments, such as i3

I prefer i3 over the default Aalto Ubuntu desktop. Configuring this to work properly over VNC takes a bit of extra work, and this may be the case for other desktop environments as well.

The desktop environment that TigerVNC is running is controlled by the ~/.vnc/xstartup script. In order to find out what to put in there to run your favorite environment, take a look at the .desktop files in the /usr/share/xsessions folder on your workstation, which contain the commands needed to start the session. Look for any Exec and TryExec lines. You want to prefix the final command that launches the window manager with dbus-launch --exit-with-session.

i3 specific tweaks

I found that my favority window manager, i3, needed some more tweaking to work properly. These tweaks may also be useful for other desktop environments.

In order to get i3 to start at all, these two lines are needed in ~/.vnc/xstartup:

unset I3SOCK
unset SESSION_manager

and you probably also want to set:

export DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/1000/bus"
# Fix to make GNOME work
export XKL_XMODMAP_DISABLE=1

Fix scaling

If your laptop has a high resolution screen, like most modern laptops do, things may look way too tiny because i3 does not do any interface scaling itself. To control the scaling of everything, we need to set the DPI setting in ~/.Xresources. However, if we would change it in that file, we would also change it for the workstation itself, which we don't want to do. Instead, make a file named ~/.Xresources_vnc with the line Xft.dpi: 180. You can replace 180 with your own preferred DPI setting if things end up looking too big or small. Then, add this to ~/.vnc/xstartup:

[ -r $HOME/.Xresources_vnc ] && xrdb $HOME/.Xresources_vnc`

Custom config for workspaces and such

I also wanted a custom configuration of i3, because rather than having two large screen, my laptop only has a single screen. For this, I copied over the i3 config to ~/.config/i3/config_vnc, made my customizations there and passed on the -c $HOME/.config/i3/config_vnc command line option to i3.

My final ~/.vnc/startup










#!/bin/sh

unset I3SOCK
unset SESSION_MANAGER
export DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/1000/bus"
[ -r $HOME/.Xresources_vnc ] && xrdb $HOME/.Xresources_vnc
# Fix to make GNOME work
export XKL_XMODMAP_DISABLE=1
dbus-launch --exit-with-session i3 -c $HOME/.config
Last changed by 
 
Marijn van Vliet
Research Software Engineer at Aalto University
0
506

Read more

Invitation for participants You 2024

Why are we sometimes able to recognize misspelled words and sometimes not? Come to be a subject in a brain study to help figure it out from the perspective of the neural mechanism!

Sep 12, 2023
Converting from LaTeX to DOCX (and everything else): Pandoc and working around its limitations

LaTeX is the best tool for writing scientific papers.Microsoft Word is the best tool for commenting on manuscripts.Hence, ideally, you would write your paper in LaTeX, and send a .docx version to your co-authors for comments.

Jul 16, 2023
Proof of concept: text chain of trust

The term "chain of trust" comes from the domain of computer security, where it is one of the core principles behind verifying digital signatures. To know whether a signature is valid, a list of endorsing signatures is added to the original signature. These endorsing signatures can in turn have endorsing signatures themselves to help verify them, and so forth. When one or more signatures along this chain comes from an entity you explicitly trust (a family member, friend or trustworthy institution), the original signature can be trust implicitly. This document outlines an experiment to see what it would take to create a chain of trust for sentences in a text article. The idea is to track down articles that support the claim made in the sentence, then track down articles that support the supporting articles, and so forth, until articles from explicitly trusted sources are reached (mainly peer reviewed journal articles). Moreover, we want to visualize this chain of trust so we get an overview of the origins of a claim, including which articles support and refute it, and how trustworthy those articles are in turn. While with digital signatures, we can deal in absolutes (either a signature endorses another signature or not), with text we will probably have to settle for a score indicating the degree of trust. A simple scenario In academic articles, the idea of a "chain of trust" is explicitly encoded in the usage of citations. Hence, with these sorts of articles it should be considerably easier to get a basic system going to visualize this chain of trust than for example an article in a newspaper. The main difficulty here is that a citation usually does not mention the specific sentence in the article that directly supports the claim.

Feb 2, 2023
A Dutch perspective on bicycles

You don't know what you have until it's gone. As a Dutch citizen living abroad, it has become painfully clear not only how wonderful the Dutch cycling culture really is, but also how misunderstood by the rest of the world.

Feb 2, 2023
Read more from Marijn van Vliet
Published on HackMD