How to Set Up Remote Desktop on an Ubuntu 26.04 Server

TL;DR:

• To set up Ubuntu remote desktop on a 26.04 server, install the Xfce desktop and xrdp from the Ubuntu archive, then connect through an SSH tunnel with an RDP client such as Remote Desktop Connection, Windows App or Remmina.
• Ubuntu 26.04 ships GNOME 50, whose session runs only on Wayland, so xrdp cannot start a GNOME desktop. Xfce 4.20 still starts an X.org session and works with xrdp 0.10.1.
• Bind xrdp to 127.0.0.1 with port=tcp://.:3389 before you set a desktop password, and reach it with ssh -N -L 3390:127.0.0.1:3389. The firewall keeps only SSH open.
• xrdp logs in with the account password, not your SSH key, so the sudo user needs a password. SSH stays key-only.
• In container tests, the desktop install downloaded 251 MB, used about 1.1 GB of disk and took 95 to 189 seconds. One idle Xfce session over xrdp used about 0.4 to 0.8 GB of RAM, counting systemd and xrdp.
• A session keeps running when you disconnect. Log out from the Xfce Applications menu to end it.

Applies to: Ubuntu 26.04 LTS · xrdp 0.10.1 · xorgxrdp 0.10.2 · Xfce 4.20 · OpenSSH 10.2p1 · checked November 2026

Remote desktop on an Ubuntu server is a graphical desktop that runs on the server and appears in a Remote Desktop app on your computer, over the Remote Desktop Protocol (RDP). xrdp is an open-source RDP server, licensed under Apache 2.0, that starts a desktop session for each user who logs in, so the server needs no monitor and no GPU. This tutorial installs the Xfce desktop and xrdp on Ubuntu 26.04, keeps the RDP port closed to the internet, connects through an SSH tunnel from Windows, macOS or Linux, and covers the GNOME black screen and other login errors.

Can you use remote desktop on Ubuntu 26.04?

Yes. Ubuntu 26.04 LTS ships GNOME 50, and its release notes for LTS users state that the Ubuntu Desktop session now runs only on the Wayland back end, because GNOME Shell can no longer run as an X.org session. Two setups work: xrdp with a desktop that still runs on X.org, such as Xfce, or GNOME Remote Desktop with the standard GNOME desktop.

xrdp starts each session on its own X.org display through the xorgxrdp driver, so on Ubuntu 26.04 it cannot start GNOME: the login shows a black or blue screen, or closes. The same release notes list Xfce, MATE, KDE on X11 and i3 as desktops that still start an X.org session. This tutorial uses Xfce with xrdp, which needs no display manager on the server.

Xfce with xrdp or GNOME Remote Desktop: which one to use

Prerequisites

• A server running Ubuntu 26.04 LTS with SSH access, at least 2 GB of RAM and 2 GB of available disk space. Arct Cloud Linux VPS images include Ubuntu 26.04 LTS, and the Cost Optimized cvm.micro plan has 2 vCPU, 4 GB RAM and 40 GB NVMe storage.
• A non-root user with sudo privileges and SSH key login. How to Generate an SSH Key on Windows, macOS, and Linux creates the key and the sudo user.
• On your computer, an SSH client and an RDP client. macOS and Linux include the OpenSSH client; on Windows 10 (build 1809 or later) and Windows 11 it is the OpenSSH Client optional feature. Step 7 covers the RDP clients.

Commands run as the sudo user. Replace values written in capitals, such as YOUR_USER and YOUR_SERVER_IP, with your own. The examples use deploy as the sudo user.

Step 1: Update the server

Install pending updates before you add several hundred desktop packages:

sudo apt update
sudo apt upgrade

If the upgrade installs a new kernel, reboot with sudo reboot and reconnect.

Step 2: Install the Xfce desktop

Xfce is a lightweight desktop environment, packaged in Ubuntu 26.04 as version 4.20. Install it with the Xfce terminal, and leave out LightDM, a display manager that shows a graphical login on the server's own screen. xrdp starts its sessions without it:

sudo apt install xfce4 xfce4-terminal lightdm-

The minus sign after lightdm tells apt to leave LightDM out, and to remove it if it is already installed. apt then picks xfce4-screensaver as the screen locker, because the first choice, light-locker, needs LightDM. On a machine that already shows a LightDM login screen, run the command without lightdm-. The output looks similar to this:

Package 'lightdm' is not installed, so not removed
...
Summary:
  Upgrading: 0, Installing: 482, Removing: 0, Not Upgrading: 0
  Download size: 251 MB
  Space needed: 1086 MB / 38.2 GB available

The package count and sizes depend on what the server already has. The test started from a minimal Ubuntu 26.04 container. If apt stops with a disk error, see How to Fix No Space Left on Device on a Linux Server.

Step 3: Install xrdp and choose the Xfce session

xrdp accepts RDP connections, and xrdp-sesman starts a desktop session for each login. The xrdp package recommends xorgxrdp, the X.org driver the sessions run on, so apt installs both:

sudo apt install xrdp

Check the version and the two services:

xrdp --version | head -1
systemctl is-active xrdp xrdp-sesman

The output looks similar to this:

xrdp 0.10.1
active
active

Both services start at boot, and xrdp already listens on port 3389 on every network interface. Step 4 closes that port before you set a desktop password. Older guides add the xrdp user to the ssl-cert group so xrdp can read its TLS key. The Ubuntu 26.04 package runs xrdp as root, so that step is not needed.

xrdp starts each session through /etc/xrdp/startwm.sh, which runs /etc/X11/Xsession, and that script runs ~/.xsession when the file exists. Make Xfce your session:

echo "xfce4-session" > ~/.xsession

Other users get Xfce too while it is the only desktop installed. If the server has a second desktop, create the same file for each RDP user.

Step 4: Keep the RDP port closed to the internet

Anyone who reaches port 3389 can try passwords on it, so close it before you set a password. Bind xrdp to the loopback address 127.0.0.1, which only the SSH tunnel in Step 6 reaches, and stop root from logging in over RDP:

sudo sed -i 's|^port=3389$|port=tcp://.:3389|' /etc/xrdp/xrdp.ini
sudo sed -i 's|^AllowRootLogin=true$|AllowRootLogin=false|' /etc/xrdp/sesman.ini
sudo systemctl restart xrdp xrdp-sesman

In xrdp.ini, tcp://.:3389 means 127.0.0.1 port 3389, as the comments above the port setting describe. AllowRootLogin in sesman.ini is true by default. Check the listening address:

sudo ss -tlnp | grep xrdp

LISTEN 0      2          127.0.0.1:3389      0.0.0.0:*    users:(("xrdp",pid=8962,fd=13))

127.0.0.1:3389 means only programs on the server can connect. Before the change, the line showed *:3389.

The Uncomplicated Firewall (UFW) needs no rule for xrdp, because the tunnel arrives over SSH. Check the rules:

sudo ufw status

Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
OpenSSH (v6)               ALLOW       Anywhere (v6)

If UFW is inactive, How to Set Up a UFW Firewall on Ubuntu 26.04 turns it on without locking you out. Do not add a rule for port 3389.

The desktop packages also install avahi-daemon, which answers local network name lookups (mDNS) on UDP port 5353 on every interface. Remote desktop does not use it. Turn it off:

sudo systemctl disable --now avahi-daemon.service avahi-daemon.socket
systemctl is-active avahi-daemon.service avahi-daemon.socket

systemctl warns that avahi-daemon.socket is still active, because it disables the service first. The check then prints inactive twice.

Step 5: Set a password for the desktop login

xrdp checks your Linux account password through PAM and does not use SSH keys. If SSH accepts passwords, a new account password also works for SSH logins. Check that SSH accepts keys only before you set it:

sudo sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication) '

passwordauthentication no
kbdinteractiveauthentication no

If passwordauthentication shows yes, follow Step 7 of How to Generate an SSH Key on Windows, macOS, and Linux to turn off SSH password login before you continue.

A sudo user who logs in with a key can have no usable password. Check yours:

sudo passwd -S $USER

The output looks similar to this:

deploy P 2026-11-06 0 99999 7 -1

P in the second field means the account has a usable password. L means the password is locked and NP means there is none. In both cases, set a password:

sudo passwd $USER

New password:
Retype new password:
passwd: password updated successfully

Step 6: Open an SSH tunnel from your computer

An SSH tunnel carries the RDP connection inside your SSH session to the server's 127.0.0.1:3389. Run this on your computer, in PowerShell on Windows or in a terminal on macOS and Linux:

ssh -N -L 3390:127.0.0.1:3389 YOUR_USER@YOUR_SERVER_IP

Replace YOUR_USER with the sudo user and YOUR_SERVER_IP with the server's IP address.

• -L 3390:127.0.0.1:3389 listens on port 3390 on your computer and forwards each connection to port 3389 on the server's loopback address.
• -N opens no remote shell, so the command prints nothing while the tunnel is up. Leave the window open; closing it closes the tunnel.
• Local port 3390 keeps the tunnel off port 3389, which Windows uses when Remote Desktop is turned on for your own PC.

How to Open a Private Dashboard with an SSH Tunnel saves a tunnel in ~/.ssh/config, keeps it alive, and opens it with PuTTY on Windows.

Step 7: Connect from Windows, macOS or Linux

While the tunnel runs, every client connects to localhost:3390 and logs in with your user name and the password from Step 5.

Windows

Remote Desktop Connection is part of Windows. Press Windows+R and run:

mstsc /v:localhost:3390

In Windows App, select Add a remote PC, or the + icon on the Devices tab. Enter localhost:3390 as the PC Name, then select Add & Connect.

macOS

Install Windows App, previously named Microsoft Remote Desktop, from the Mac App Store. On the Devices tab, select the + icon, then Add PC. Enter localhost:3390 as the PC Name, select Add, and double-click the new PC to connect.

Linux

Remmina is in the Ubuntu archive, version 1.4.43 in Ubuntu 26.04. Install it with its RDP plugin and connect to localhost:3390 with the RDP protocol:

sudo apt install remmina remmina-plugin-rdp

From a terminal, FreeRDP 3 (package freerdp3-x11 on Ubuntu) connects with one command. It asks for a domain, which you can leave empty, and then the password:

xfreerdp3 /v:localhost:3390 /u:YOUR_USER

The certificate warning

The first connection shows a certificate warning. xrdp uses the self-signed certificate that the ssl-cert package creates for the server's hostname, valid for 10 years, so the client cannot verify it and the name does not match localhost. The connection runs inside the SSH tunnel. Accept the certificate for this server.

After login, the Xfce desktop opens with a panel at the top and a dock at the bottom. The background can be plain black; the panel and dock show that the session works. On the server, the session log confirms it:

sudo grep "Session in progress" /var/log/xrdp-sesman.log | tail -1

[2026-11-06T18:01:24.190+0000] [INFO ] Session in progress on display :10. Waiting until the window manager (pid 9053) exits to end the session

Closing the client window disconnects without ending the session. xrdp keeps it running with your apps open, and the next login returns to it. Log out from the Xfce Applications menu to end it.

Step 8: Check remote desktop after a reboot

A reboot ends every desktop session, so save open work first. Reboot the server:

sudo reboot

Reconnect over SSH and check the services and the listening address:

systemctl is-active xrdp xrdp-sesman
sudo ss -tlnp | grep xrdp

active
active
LISTEN 0      2          127.0.0.1:3389      0.0.0.0:*    users:(("xrdp",pid=161,fd=13))

Open the tunnel from Step 6 again and connect. A new session starts, with xrdp still on 127.0.0.1 and avahi-daemon still off.

From a Linux computer, check that the RDP port is closed to the internet. -w 5 stops waiting after 5 seconds; on macOS, use -G 5 instead:

nc -zv -w 5 YOUR_SERVER_IP 3389

nc: connect to 203.0.113.10 port 3389 (tcp) timed out: Operation now in progress

A timeout or Connection refused means the port is closed. succeeded means an RDP server is reachable from the internet: repeat Step 4.

Remove remote desktop

Purge xrdp and Xfce, then the packages the desktop pulled in:

sudo apt purge xrdp xorgxrdp
sudo apt purge xfce4 xfce4-terminal
sudo apt autoremove --purge

The last command prints a summary similar to this:

Summary:
  Upgrading: 0, Installing: 0, Removing: 481, Not Upgrading: 0
  Freed space: 1085 MB

Use GNOME Remote Desktop instead

GNOME Remote Desktop is GNOME's own RDP server, packaged in Ubuntu 26.04 as version 50.2. Its Remote Login mode works with the GDM display manager: the client first authenticates with a system-wide RDP user name and password, which opens the GDM login screen, and you then log in with your own account. It runs the standard Ubuntu desktop on Wayland, so it needs the full desktop with GDM on the server.

The GNOME Remote Desktop 50.2 README lists the grdctl --system commands for this mode, and GNOME Help covers the same setting in Settings. Remote Login uses port 3389. Keep that port out of the UFW rules, as in Step 4, and connect through the Step 6 tunnel.

Troubleshoot common remote desktop errors

xrdp logs connections to /var/log/xrdp.log and sessions to /var/log/xrdp-sesman.log. sudo journalctl -u xrdp-sesman shows the session messages too.

FAQ

Does xrdp work on Ubuntu 26.04?

Yes, with a desktop that still runs on X.org, such as Xfce. Ubuntu 26.04 packages xrdp 0.10.1, and it starts Xfce 4.20 sessions. It cannot start the default GNOME 50 desktop, because GNOME on Ubuntu 26.04 runs only on Wayland.

Why do I get a black screen with remote desktop on Ubuntu?

On Ubuntu 26.04 the usual cause is xrdp trying to start GNOME, which no longer has an X.org session, so the screen stays black or blue, or the session closes. Install Xfce, put xfce4-session in the .xsession file in your home directory, and log in again.

How do I connect to an Ubuntu server from a Mac with remote desktop?

Install Windows App, previously named Microsoft Remote Desktop, from the Mac App Store. Open an SSH tunnel in Terminal with ssh -N -L 3390:127.0.0.1:3389 followed by your user and server address, then add a PC named localhost:3390 in Windows App and log in with your Ubuntu user name and password.

Is it safe to open the remote desktop port on a server?

Keep it closed. An open RDP port lets anyone on the internet try passwords, and xrdp logs in with account passwords, not SSH keys. Bind xrdp to 127.0.0.1 and connect through an SSH tunnel, so the firewall keeps only the SSH port open.

How much RAM does a desktop on an Ubuntu server need?

Plan for at least 2 GB. In container tests, one idle Xfce session over xrdp, counting systemd and xrdp, used about 0.4 to 0.8 GB of RAM. The kernel, other services and any desktop apps add memory on top of that.

What is the difference between desktop sharing and remote login on Ubuntu?

Desktop Sharing lets someone view and control a desktop session that is already open on the machine. Remote Login lets you log in to your own account from another device, starting at the login screen. xrdp works like Remote Login and starts a new session for each user.

Can I use remote desktop on Ubuntu without a monitor?

Yes. xrdp starts its own X.org display for each session, so a server with no monitor, GPU or display manager runs a full desktop. GNOME Remote Desktop also has headless modes for the GNOME desktop.

Next steps

• How to Secure RDP on Windows Server
• Windows VPS plans, for Windows Server with administrator Remote Desktop
• xrdp on GitHub
• Windows App: connect to a remote PC

Arct Cloud Linux images deploy in under 30 seconds. Compare plans.