Remote Desktop with SSH allows you to securely connect to a remote Windows computer by encrypting your Remote Desktop Protocol (RDP) traffic through an SSH tunnel. This method protects your remote session from eavesdropping, reduces exposure to internet-based attacks, and adds an extra layer of security, especially when accessing servers over public networks. Whether you’re an IT administrator, developer, or business owner, using SSH with Remote Desktop is one of the safest ways to manage remote systems.
What Is Remote Desktop with SSH?
Remote Desktop with SSH combines two technologies:
- Remote Desktop Protocol (RDP): Microsoft’s protocol for remotely controlling Windows computers.
- Secure Shell (SSH): A secure protocol that encrypts network traffic between two devices.
You don’t expose the RDP port 3389 to the internet, but connect to an SSH server first. The SSH server creates an encrypted tunnel that safely forwards your RDP traffic.
Your PC │ Encrypted SSH Tunnel │ SSH Server │ Remote Desktop (RDP) │ Windows Server
This method gives you a huge security boost while still keeping the same Remote Desktop experience.
Why Use SSH for Remote Desktop?
There are several advantages to combining SSH with Remote Desktop.
1. Strong Encryption
SSH encrypts all traffic between your computer and the remote server, making it extremely difficult for attackers to intercept your data.
2. Hide RDP from the Internet
Instead of opening TCP port 3389 publicly, only the SSH port (usually 22) is exposed.
This reduces:
- Port scanning
- Brute-force attacks
- RDP exploits
- Unauthorized login attempts
3. Secure Public Wi-Fi Access
If you’re working from:
- Airports
- Hotels
- Coffee shops
- Shared office spaces
SSH keeps your Remote Desktop session encrypted.
4. Additional Authentication
SSH supports:
- Password authentication
- Public key authentication
- Multi-factor authentication (MFA)
This makes unauthorized access significantly more difficult.
How Remote Desktop Over SSH Works
The process is straightforward.
Step 1
Connect your computer to the SSH server.
↓
Step 2
Create an SSH tunnel that forwards a local port to the remote Windows machine’s RDP port.
↓
Step 3
Open Remote Desktop Connection.
↓
Step 4
Connect to:
localhost:3390
instead of the remote server directly.
The SSH client securely forwards all RDP traffic through the encrypted tunnel.
Requirements
Before you set up Remote Desktop over SSH, you’ll need:
- Windows PC
- Remote Windows Server
- SSH server
- SSH client
- Administrator privileges
- Remote Desktop enabled
- Firewall configured correctly
How to Set Up Remote Desktop with SSH
Step 1: Install an SSH Server
Linux servers already include OpenSSH.
Windows Server 2019 and later also support OpenSSH Server.
Verify SSH is running:
sudo systemctl status ssh
or
Get-Service sshd
Step 2: Enable Remote Desktop
On Windows:
Settings ↓ System ↓ Remote Desktop ↓ Enable Remote Desktop
Turn on Windows Firewall for Remote Desktop access.
Step 3: Create an SSH Tunnel
Using the command line:
</> Bash ssh -L 3390:WINDOWS_SERVER_IP:3389 username@SSH_SERVER_IP
Example:
</> Bash ssh -L 3390:192.168.1.50:3389 [email protected]
Explanation:
- Local Port: 3390
- Remote Windows Server: 192.168.1.50
- RDP Port: 3389
The SSH tunnel forwards local port 3390 to the remote RDP service.
Step 4: Launch Remote Desktop
Open:
mstsc
Enter:
localhost:3390
Click Connect.
You’ll now access the remote computer securely through the SSH tunnel.
Using PuTTY for SSH Tunneling
Windows users commonly use PuTTY.
Configure:
Connection ↓ SSH ↓ Tunnels
Source Port:
3390
Destination:
192.168.1.50:3389
Click:
Add
↓
Open the SSH connection.
After logging in, open Remote Desktop and connect to:
localhost:3390
Benefits of Remote Desktop over SSH
| Feature | Remote Desktop Only | Remote Desktop with SSH |
|---|---|---|
| Encryption | Good | Excellent |
| Hidden RDP Port | ❌ | ✅ |
| Protection Against Scanning | Low | High |
| Public Wi-Fi Safety | Medium | Excellent |
| SSH Key Authentication | ❌ | ✅ |
| MFA Support | Limited | Excellent |
SSH Key Authentication
Passwords can be guessed.
SSH keys are significantly more secure.
Generate a key:
</> Bash ssh-keygen
Copy the public key:
</> Bash ssh-copy-id username@server
Now authentication occurs using cryptographic keys instead of passwords.
Best Security Practices
Disable Public RDP
Never expose port 3389 directly unless absolutely necessary.
Use Strong SSH Keys
Avoid weak passwords.
Use:
- RSA 4096-bit
- ED25519
Change Default SSH Port
Although not a security feature by itself, changing the default port can reduce automated scanning.
Example:
22 → 2222
Enable MFA
Multi-factor authentication greatly improves security.
Popular methods include:
- Google Authenticator
- Microsoft Authenticator
- Duo Security
Keep Software Updated
Always update:
- Windows
- OpenSSH
- Firewall
- Antivirus
- Remote Desktop client
Common Problems and Solutions
SSH Tunnel Won’t Connect
Possible causes:
- SSH service stopped
- Incorrect IP address
- Firewall blocking SSH
- Wrong credentials
Remote Desktop Connection Failed
Check:
- Remote Desktop enabled
- Windows Firewall
- Port forwarding
- Local tunnel configuration
Authentication Errors
Verify:
- SSH username
- SSH key permissions
- Password
- Administrator rights
Slow Performance
Reduce bandwidth usage by:
- Lowering display resolution
- Disabling desktop wallpaper
- Turning off animations
- Reducing color depth
When Should You Use Remote Desktop with SSH?
RDP over SSH is ideal for:
- Remote IT administration
- Cloud Windows servers
- VPS management
- Development environments
- Small businesses
- Secure work-from-home access
- Managing servers across public networks
SSH vs VPN for Remote Desktop
| Feature | SSH Tunnel | VPN |
|---|---|---|
| Setup | Simple | Moderate |
| Encryption | Excellent | Excellent |
| Speed | High | High |
| Access | Single Service | Entire Network |
| Security | Excellent | Excellent |
| Resource Usage | Low | Moderate |
If you only need secure RDP access, SSH tunneling is often simpler and lighter than deploying a full VPN.
Conclusion
Using Remote Desktop with SSH is one of the most effective ways to secure remote Windows access. Using an SSH tunnel to encrypt RDP traffic gives you better protection against eavesdropping, port scanning, and brute-force attacks without modifying how you use Remote Desktop. Whether you’re managing a VPS, administering enterprise servers, or working remotely, SSH tunneling provides a practical balance of security, performance, and ease of deployment.
