Kali Linux + GNOME 50 + GNOME Remote Desktop + Windows Remote Desktop (MSTSC)
Getting a full GNOME desktop remotely on Kali Linux can be confusing because there are several different technologies involved: GNOME, GDM3, Wayland, gnome-remote-desktop, RDP, and the user/system systemd services.
This guide documents a working Kali Linux setup where a Windows machine connects to Kali using the built-in Remote Desktop Connection (mstsc) and receives a full GNOME desktop session.
The important part is that this configuration uses GNOME Remote Login, rather than traditional xrdp.
What We Are Building
The final architecture looks like this:
┌─────────────────────────────┐ │ Windows 10/11 │ │ │ │ Remote Desktop Connection │ │ mstsc.exe │ └──────────────┬──────────────┘ │ │ RDP / TCP 3389 │ ▼ ┌─────────────────────────────┐ │ Kali Linux │ │ │ │ GDM3 │ │ │ │ │ ▼ │ │ GNOME Remote Desktop │ │ │ │ │ ▼ │ │ GNOME Desktop │ │ GNOME Shell 50.x │ │ │ │ Wayland │ └─────────────────────────────┘
GNOME's Remote Login implementation integrates with GDM and provides remote login through RDP. GNOME documents this as the headless multi-user remote login mode.
Why GNOME Instead of Xfce?
Kali supports several desktop environments, including GNOME and Xfce. The Kali GNOME desktop is provided by the kali-desktop-gnome metapackage and includes components such as gdm3, gnome-session, and gnome-shell.
For this configuration, the goal was specifically:
Windows ↓ RDP ↓ Kali ↓ GNOME
Rather than:
Windows ↓ xrdp ↓ Xfce
Both approaches are possible, but they are different architectures.
GNOME Remote Desktop has native support for RDP and can integrate with GDM for remote login.
Step 1 — Check the Current Desktop
When connecting to Kali through SSH, these commands may initially show:
echo "Desktop: $XDG_CURRENT_DESKTOP" echo "Session: $XDG_SESSION_TYPE"
Output:
Desktop: Session: tty
This does not mean GNOME is missing.
It simply means the current SSH session is a TTY rather than a graphical GNOME session.
For example, GNOME Shell itself can still be installed:
gnome-shell --version
In this setup, the system reported:
GNOME Shell 50.4
So the important distinction is:
SSH session ↓ TTY RDP session ↓ GNOME graphical session
Do not use the SSH environment variables alone to determine whether GNOME is installed.
Step 2 — Install GNOME and GNOME Remote Desktop
Install the GNOME desktop components and Remote Desktop server:
sudo apt update sudo apt install -y kali-desktop-gnome gdm3 gnome-remote-desktop
Kali's official kali-desktop-gnome package provides the GNOME desktop and depends on gdm3, gnome-session, gnome-shell, and other GNOME components.
Step 3 — Set GDM3 as the Display Manager
Run:
sudo dpkg-reconfigure gdm3
When prompted, select:
gdm3
Then enable GDM:
sudo systemctl enable gdm3
Also make graphical boot the default:
sudo systemctl set-default graphical.target
Verify:
systemctl get-default systemctl is-enabled gdm3
Expected:
graphical.target enabled
Step 4 — Install the RDP Certificate Tools
GNOME Remote Desktop requires TLS for RDP connections. GNOME's upstream configuration documentation provides certificate-generation examples using FreeRDP's winpr-makecert, OpenSSL, or GnuTLS.
Install the FreeRDP tools:
sudo apt install -y freerdp3-x11 winpr3-utils
Create the certificate directory for the system GNOME Remote Desktop service:
sudo -u gnome-remote-desktop mkdir -p \ ~gnome-remote-desktop/.local/share/gnome-remote-desktop
Generate the TLS certificate and key:
sudo -u gnome-remote-desktop \ winpr-makecert -silent -rdp \ -path ~gnome-remote-desktop/.local/share/gnome-remote-desktop tls
Verify:
sudo -u gnome-remote-desktop ls -l \ ~gnome-remote-desktop/.local/share/gnome-remote-desktop/
You should have:
tls.crt tls.key
GNOME specifically documents running the certificate generation as the gnome-remote-desktop user when the certificate is intended for the system remote-login service.
Step 5 — Configure System-Wide RDP
This is one of the most important parts of the configuration.
Notice the use of:
grdctl --system
rather than:
grdctl
The --system mode is used for GNOME's system-wide remote-login configuration. GNOME's upstream documentation distinguishes system remote login from the ordinary per-user remote-assistance service.
Configure the TLS key:
sudo grdctl --system rdp set-tls-key \ ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.key
Configure the certificate:
sudo grdctl --system rdp set-tls-cert \ ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.crt
Configure credentials:
sudo grdctl --system rdp set-credentials
Enter the credentials when prompted.
For example:
Username: shashwat Password: ********
Then enable RDP:
sudo grdctl --system rdp enable
These are the same system-mode operations documented by GNOME for Remote Login.
Step 6 — Enable the Services
Enable GDM:
sudo systemctl enable --now gdm3
Enable GNOME Remote Desktop:
sudo systemctl enable --now gnome-remote-desktop.service
Check the service:
sudo systemctl status gnome-remote-desktop.service --no-pager
Also check:
sudo systemctl status gdm3 --no-pager
And:
sudo grdctl --system status
An Important Difference: User Service vs System Service
One of the confusing parts during troubleshooting was seeing:
systemctl --user status gnome-remote-desktop
return:
Active: inactive (dead)
That does not necessarily indicate a problem with the system Remote Login configuration.
GNOME Remote Desktop has several operating modes.
User Remote Assistance
grdctl rdp ...
This works with an already running user's GNOME session.
System Remote Login
grdctl --system rdp ...
This integrates with GDM and allows a remote user to reach the graphical login environment.
Headless Single User
grdctl --headless rdp ...
This creates a separate headless GNOME session.
GNOME officially documents all three modes.
For this setup, the relevant one is:
System Remote Login
Step 7 — Check Port 3389
GNOME Remote Login uses TCP port 3389 by default.
Check whether the RDP service is listening:
sudo ss -lntp | grep ':3389'
You should see something similar to:
LISTEN 0 10 0.0.0.0:3389
or:
LISTEN 0 10 [::]:3389
You can also determine the Kali IP address with:
ip addr
or simply:
hostname -I
For example:
192.168.1.50
Step 8 — Connect from Windows
On Windows press:
Win + R
Enter:
mstsc
The Windows Remote Desktop client opens.
Enter:
192.168.1.50
or:
192.168.1.50:3389
GNOME officially lists Microsoft's built-in mstsc client among the clients known to work with GNOME Remote Login.
Enter the credentials configured with:
sudo grdctl --system rdp set-credentials
After authentication, the result should be:
Windows ↓ RDP ↓ Kali GDM ↓ GNOME
In the working setup documented here, this successfully produced a full GNOME desktop remotely.
Why You May See a Different Desktop When Testing Over SSH
Suppose you SSH into Kali:
ssh shashwat@192.168.1.50
and run:
echo $XDG_CURRENT_DESKTOP
You may see:
And:
echo $XDG_SESSION_TYPE
may show:
tty
That is normal.
SSH does not automatically become your GNOME graphical session.
Your RDP connection creates a separate graphical login/session.
So:
SSH → tty RDP → GNOME
This distinction is particularly useful when troubleshooting remote desktop problems.
Troubleshooting Commands
Check GNOME
gnome-shell --version
Check GDM
systemctl status gdm3 --no-pager
Check GNOME Remote Desktop
sudo systemctl status gnome-remote-desktop.service --no-pager
Check Remote Login configuration
sudo grdctl --system status
Check RDP port
sudo ss -lntp | grep ':3389'
Check IP address
hostname -I
Check boot target
systemctl get-default
Expected:
graphical.target
If Windows Cannot Connect
First test the network connection from Windows PowerShell:
Test-NetConnection 192.168.1.50 -Port 3389
A successful configuration should report:
TcpTestSucceeded : True
If it reports:
TcpTestSucceeded : False
then investigate:
Kali IP ↓ network connectivity ↓ GNOME Remote Desktop service ↓ TCP 3389 ↓ firewall
Firewall Considerations
If you use a firewall, allow RDP on the appropriate interface/network.
For a LAN-only setup, it is preferable to restrict RDP access to your trusted LAN rather than expose TCP 3389 directly to the Internet.
GNOME's project documentation specifically warns about opening remote-desktop ports to the public Internet.
For Internet-accessible remote administration, a VPN such as WireGuard or Tailscale is generally a safer architecture than directly exposing RDP.
Remote Login vs Desktop Sharing
This distinction is worth remembering.
Remote Login
Windows ↓ RDP ↓ GDM ↓ Login ↓ GNOME session
This is what we configured.
GNOME describes Remote Login as the feature that lets you log into a user account from another device.
Desktop Sharing
User already logged into GNOME ↓ Existing desktop ↓ Remote viewer/controller
This is intended for accessing an already active graphical session.
GNOME documents Remote Assistance/Desktop Sharing separately from system Remote Login.
Headless GNOME
RDP ↓ Dedicated headless GNOME session
This is another option provided by GNOME Remote Desktop.
Complete Installation and Configuration Summary
For a fresh Kali GNOME installation, the overall process is:
sudo apt update sudo apt install -y \ kali-desktop-gnome \ gdm3 \ gnome-remote-desktop \ freerdp3-x11 \ winpr3-utils sudo dpkg-reconfigure gdm3 sudo systemctl enable gdm3 sudo systemctl set-default graphical.target sudo -u gnome-remote-desktop mkdir -p \ ~gnome-remote-desktop/.local/share/gnome-remote-desktop sudo -u gnome-remote-desktop \ winpr-makecert -silent -rdp \ -path ~gnome-remote-desktop/.local/share/gnome-remote-desktop tls sudo grdctl --system rdp set-tls-key \ ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.key sudo grdctl --system rdp set-tls-cert \ ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.crt sudo grdctl --system rdp set-credentials sudo grdctl --system rdp enable sudo systemctl enable --now gdm3 sudo systemctl enable --now gnome-remote-desktop.service
Then verify:
sudo grdctl --system status sudo ss -lntp | grep ':3389' hostname -I
Finally connect from Windows:
mstsc ↓ KALI-IP:3389 ↓ GNOME Remote Login
The Key Lesson
The biggest thing I learned while setting this up is that GNOME being installed is not the same thing as having a GNOME session in your current shell.
Seeing:
Desktop: Session: tty
over SSH is perfectly compatible with having:
GNOME Shell 50.4
installed and subsequently receiving a full GNOME desktop through RDP.
The critical pieces are:
GNOME + GDM3 + GNOME Remote Desktop + System RDP configuration + TLS certificate + RDP credentials + Port 3389
Once those pieces are correctly configured, Windows' native Remote Desktop client can connect directly to Kali's GNOME environment. GNOME officially supports mstsc as an RDP client for Remote Login.
Final Architecture
WINDOWS 11 │ │ mstsc.exe │ │ RDP / 3389 ▼ ┌───────────────────┐ │ KALI LINUX │ │ │ │ GNOME Remote │ │ Desktop │ │ │ │ │ ▼ │ │ GDM3 │ │ │ │ │ ▼ │ │ GNOME Shell │ │ 50.x │ │ │ │ │ Wayland │ └───────────────────┘ │ ▼ FULL GNOME DESKTOP
Result: Working. The configuration gives Kali Linux a native GNOME graphical session accessible through Windows Remote Desktop without switching to Xfce. GNOME's system Remote Login mode is specifically designed for this workflow.
Official References
GNOME Remote Login documentation
GNOME Remote Desktop configuration
Kali GNOME desktop package
Suggested Blog Title
Kali Linux Remote Desktop: Access GNOME from Windows Using Native RDP
SEO Description
Learn how to configure GNOME Remote Desktop on Kali Linux and access the full GNOME desktop remotely from Windows using the built-in Remote Desktop Connection (mstsc). This step-by-step guide covers GDM3, GNOME Remote Desktop, TLS certificates, RDP credentials, port 3389, troubleshooting, and the difference between Remote Login, Desktop Sharing, and headless GNOME sessions.
Tags
Kali Linux, GNOME, GNOME Remote Desktop, RDP, Remote Desktop, Linux RDP, Kali Linux RDP, Windows Remote Desktop, mstsc, GDM3, Wayland, GNOME 50, Linux Remote Access, Cybersecurity Linux, Kali Linux Tutorial
Hashtags
#KaliLinux, #GNOME, #RemoteDesktop, #RDP, #Linux, #LinuxAdmin, #CyberSecurity, #Windows, #MSTSC, #Wayland, #GDM3, #GNOMERemoteDesktop, #LinuxTutorial, #SysAdmin, #KaliTutorial
No comments:
Post a Comment
Thank you for Commenting Will reply soon ......