Can I connect with the normal Windows Remote Desktop app?

Yes. xrdp speaks the RDP protocol, so the built-in Remote Desktop Connection on Windows, the Windows App on macOS and Remmina or xfreerdp on Linux all work. You connect to localhost through an SSH tunnel instead of to the server's address.

Does this work on a NAT plan?

Yes. The RDP connection travels inside SSH, and SSH is the one port a NAT plan forwards to your server. That's the setup this guide recommends on every plan anyway, because port 3389 stays closed to the internet.

How much RAM does the desktop use?

On our test server one XFCE session added about 360 MB, taking the whole server from 388 MB to 747 MB used. The 2 GB Micro plan is enough for the desktop and light tools. If you'll run a web browser in the session, 4 GB is more comfortable.

I get a black screen or "Oh no! Something has gone wrong". What's wrong?

xrdp started GNOME instead of XFCE. The packages from step 1 also pull in GNOME's session manager, and Ubuntu makes it the system default. Create ~/.xsession containing xfce4-session for the user who logs in, then connect again.

Can I log in over RDP as root?

xrdp allows it by default (AllowRootLogin=true in /etc/xrdp/sesman.ini), but use a normal user with sudo instead. If you want to block root, set AllowRootLogin=false and restart xrdp.

Linux VPS with a desktop: XFCE and xrdp on Ubuntu

Give an Ubuntu 24.04 VPS a graphical desktop you open with the ordinary Remote Desktop app: XFCE and xrdp, the two defaults that break it (wrong session, no TLS), and a setup where port 3389 never faces the internet. Measured install size and RAM per session.

A Linux server has no screen, and most of the time it doesn't need one. Sometimes it does: a browser that has to run from the server's own address, a GUI-only tool, or a desktop you can leave running and come back to from any computer. This guide adds the lightweight XFCE desktop and xrdp to Ubuntu 24.04, so you can open it with the same Remote Desktop app you'd use for a Windows server.

We tested every step on our Ubuntu 24.04 image. Two defaults broke the first attempt, and we fix both below. You'll need a normal user with sudo; the Ubuntu setup guide creates one. The examples call it deploy.

1. Install XFCE and xrdp

sudo apt update
sudo apt install -y xfce4 xfce4-goodies xrdp

On our 2 GB server this took about four and a half minutes and used 1.7 GB of disk (2.7 GB used before, 4.4 GB after). It installs xrdp 0.9.24 and starts it right away, listening on port 3389.

2. Make xrdp start XFCE, not GNOME

echo xfce4-session > ~/.xsession

Without this file our first login started GNOME instead of XFCE, and the session died at once with "Oh no! Something has gone wrong". The packages from step 1 also pull in GNOME's session manager, and Ubuntu makes it the default. With ~/.xsession in place, xrdp starts XFCE.

3. Let xrdp use TLS

xrdp runs as its own xrdp user, and that user can't read the server's private key. Our first connection worked, but /var/log/xrdp.log showed why it shouldn't be trusted:

Cannot read private key file /etc/xrdp/key.pem: Permission denied
Non-TLS connection established from ::ffff:127.0.0.1

Without the key, xrdp falls back to the old RDP encryption instead of TLS. Give it access and restart:

sudo adduser xrdp ssl-cert
sudo systemctl restart xrdp

The next connection in our log read TLS connection established ... TLSv1.3. You can check yours the same way:

sudo grep -E "TLS connection|Non-TLS" /var/log/xrdp.log | tail -2

4. Keep port 3389 off the internet

Once xrdp is installed it listens on every address. Unlike Windows, xrdp has no Network Level Authentication, so anyone who can reach the port gets a login screen to guess passwords at. Make it listen on the server itself only:

sudo sed -i 's|^port=3389$|port=tcp://127.0.0.1:3389|' /etc/xrdp/xrdp.ini
sudo systemctl restart xrdp
ss -ltn | grep 3389

The last line should show 127.0.0.1:3389. In our test a direct connection to the server's address on 3389 was then refused, and the tunnel in the next step still worked.

5. Connect through SSH

On your own computer, open a tunnel. On Windows, PowerShell has the same ssh command:

ssh -L 13389:localhost:3389 deploy@YOUR.SERVER.IP

On a NAT plan, add -p and the personal SSH port from your dashboard. Leave that window open. Then point your Remote Desktop app at localhost:13389 and log in as deploy with that user's password:

Windows: Remote Desktop Connection (mstsc).
macOS: the Windows App from the App Store.
Linux: Remmina, or xfreerdp /v:localhost:13389 /u:deploy.

The local port is 13389 rather than 3389 because 3389 may already be taken on your computer by its own Remote Desktop. The first time, the app warns about a certificate it doesn't recognise. That's the server's self-signed certificate, and the connection is encrypted inside SSH anyway.

6. What you get

You get an XFCE desktop with a panel, a file manager and a terminal. On our server one session added about 360 MB of RAM: 388 MB used before we connected, 747 MB during the session.

Closing the Remote Desktop window doesn't log you out. In our test a long-running command kept going after we disconnected. When we connected again, xrdp put us back into the same session (reconnected session ... display :10 in its log). To end the session for real, use Log Out in the XFCE menu.

Which plan

The desktop needs RAM more than CPU. Micro (2 vCPU, 2 GB, 25 GB, $5/mo) runs XFCE and light tools comfortably. If you plan to keep a web browser open in the session, take Small with 4 vCPU and 4 GB for $8/mo. Both are NAT plans, and that's fine here: Remote Desktop goes through your SSH port.

If what you actually need is Windows software, a Windows VPS runs it directly, and Windows-Small starts at $11/mo. Ubuntu 24.04 is on the Ubuntu VPS page and on every Linux plan in VPS plans. Payment is in USDT, USDC or ETH on Base, Ethereum or Polygon.

How to install a desktop on a Linux VPS and connect with Remote Desktop (XFCE + xrdp)