Remote graphical access to Linux workstations

Guide for Windows 10 and Linux

Before logging in from Windows, you need to enable the SSH client; see the guide.

1. Setting the LOGIN environment variable

Open Windows PowerShell (, tip: you can paste from the clipboard by right-clicking, copyEnter), or the Bash shell (). Set the variableLOGIN (in the command below, replace “xlogin” with your faculty login):

• Windows

  PS C:\Users\user> $LOGIN="xlogin"
  

• Linux

  local$ LOGIN=xlogin
  

2. Selecting a Nymfe machine and port

We’ll randomly select one of the permanently running Nymfe instances and also the port to be used for VNC:

• Windows

  PS C:\Users\user> $NN= "0" + $(Get-Random -Maximum 3 -Minimum 1)
  PS C:\Users\user> $LC_PORT = $((5900 + $(Get-Random -Maximum 100)))
  PS C:\Users\user> echo $LC_PORT
  

  Make a note of the port number displayed for later use.

• Linux

   local$ NN=0$((RANDOM % 2 + 1)) && \
       export LC_PORT=$((5900 + RANDOM % 100)) && \
       echo $LC_PORT >/tmp/fi-nymfe-vnc-port

3. Creating an SSH tunnel

Nymfe machines are only accessible from the FI network, so you’ll need to log in via Aisa. We’ll connect via SSH, enable compression and create a tunnel. You will need to enter your password twice (unless you are using an SSH key) and you will also need to authenticate the SSH keys on your first connection.

The aim of this step is to securely make the Nymfe VNC port accessible on your local machine. Alternatively, you can use the faculty VPN – in which case there is no need to use a jump host when logging in via SSH.

• Windows

  SSH on Windows has a bug (as of February 2020) which prevents the `-J ` (jump host) switch from working. However, this can be worked around using the configuration file `config ` in your home directory, within the `.ssh` folder.

  Create a file calledC:\Users\user\.ssh\config (“user” is your Windows username) with the following content (replace “XLOGIN” with your faculty login):

   Host nymfe*.fi.muni.cz
       ProxyCommand C:\Windows\System32\OpenSSH\ssh.exe XLOGIN@aisa.fi.muni.cz -W %h:%p
  

  We can now connect:

   PS C:\Users\user> ssh -C $LOGIN@nymfe$MNN.fi.muni.cz -L $LC_PORT":localhost:"$LC_PORT
  

• Linux

   local$ ssh -CJ $LOGIN@{aisa,nymfe$MNN}.fi.muni.cz -L $LC_PORT:localhost:$LC_PORT -o SendEnv=LC_PORT

4. Setting a password for VNC

Set a random VNC password (this is advisable given the risk of a brute-force attack whilst the VNC server is running); make a note of the password. This step only needs to be done once when using this guide for the first time, but you can also repeat it each time.

nymfe$ { pwgen 8 1 | tee /dev/std{out,err}; echo n; } | vncpasswd; echo

5. Setting the type of graphical session

Configure the graphics session type (this step does not need to be repeated):

nymfe$ test -f ~/.dmrc || echo -e "[Desktop]\nSession=default" >~/.dmrc

6. Creating a session

We will create a session atx11vnc, including the creation of a new X server. You can change the dimensions of the remote desktop by adjusting the parameter-geometry. From Windows () variable forwarding does not work, so replace “$LC_PORT” in the command with the port number you obtained in step 2.

nymfe$ x11vnc -auth .Xauthority -N -localhost -rfbport $LC_PORT -usepw -create -geometry 1280x1024

Do not close the terminal window.

7. Connecting to Nymfe

Connect to Nymfe from your machine using a VNC client (use the password from step 4):

• Windows

  For Windows, you can download, for example, Real VNC Viewer (you can also choose the standalone version, which does not require installation).

  Address:localhost:LC_PORT (replace “LC_PORT” with the port number from step 2).

  Do not be alarmed by the warning about an unencrypted connection; the connection from your machine to Nymfe is encrypted via an SSH tunnel.

• Linux

  local$ vinagre localhost:$(cat /tmp/fi-nymfe-vnc-port)
  

Notes:

• Connections made using this method run via X.Org, whilst the default graphical session on the machine runs via Wayland. The user interface may therefore differ slightly.

• If you only see a black background with a white terminal (xterm), there is likely a problem with the session settings. In that case, try starting it manually via this terminal:

   xterm$ gnome-session
  

Properly ending the session

• log out of the Gnome session, which will terminate the VNC client as well as the VNC and X servers (it may take a moment – approximately 20 seconds – before you see the ‘Log Out’ prompt: please wait)
• if the step above fails for any reason, terminatex11vnc using the shortcutCtrl-C and rungnome-session-quit --force --logout
• In any case, check for any remaining processes one by one and terminate them (ps ux,kill PID, or, if no other graphical processes are running on your machine,systemctl --user stop dbus ssh-agent gpg-agent may also help )