As a Linux network administrator, you will often be comparing Linux desktop environments as different Linux distributions come with various default desktop environments. The term “Linux desktop environment” typically refers to a graphical user interface (GUI) and is a set of programs that allows users to interact with the computer system via icons, windows, and various other visual elements. You will constantly be comparing Linux desktop environments because you need to:
- Use certain GUI utilities to administer the system and its security.
- Install and manage for users who prefer a graphical-based UI.
- Administer the underlying software is necessary too.
- Understand remote desktops and the client/server model. As remote desktop interactions are prone to privacy issues, it is crucial to know how secure these GUI transmissions.
Much like everything else you will encounter in Linux, many Linux users are quite opinionated passionate about their desktop environment selection and configuration.
Navigating Linux Desktop Environments
When comparing Linux desktop environments, the first thing you notice is that they are immensely configurable, almost to the point of overwhelming the user. The Linux GUI is actually a number of components assembled to provide the graphical setting for the user interface (UI). One of these components is the desktop environment. A desktop environment provides a predetermined look and feel to the GUI. It is typically broken up into the following graphical sections and functions:
- Desktop Settings: Allow configuration changes to the desktop.
- Display Manager: If multiple desktop environments are installed, the display manager allows you to select one prior to logging in.
- File Manager: Allows the performance of file maintenance activities graphically. Often represented as a folder icon is shown for directories within the manager program, it allows the performance of tasks like file moving, viewing directory contents, copying files, and so on.
- Favorites Bar: Contains frequently used icons that can be removed or added as desired. Some desktop environments update the bar automatically as you use the system to reflect your regularly used icons.
- Launch: Allows users to search for applications/ files.
- Menus: Contain files and/or programs lists as well as sublists of additional files and/or programs selections.
- Panels: Slim rectangular areas located at the top or bottom of a desktop environment’s main window and often contain notifications, system date and/or time, program icons, and so on.
- System Tray: A special menu, attached to a panel, that provides access to programs that allow a user to log out, lock their screen, manage audio settings, view notifications, shut down or reboot the system.
- Widgets: Programs that provide to the user information or functionality on the desktop and divided into:
- Applets
- Screenlets
- Desklets
- Window Manager: Client programs that determine how the windows/frames are presented on the desktop and control items such as the size, appearance and placement of the windows.
| Name | |||||
|---|---|---|---|---|---|
| Display Manager | |||||
| File Manager | |||||
| Favorites Bar | |||||
| Panels | |||||
| Systems Tray | |||||
| Widgets | |||||
| Windows Manager | |||||
How to Find Out Which Desktop Environment You are Using
Use the Command Line To Find Out Which Desktop Environment You are Using
In order to get the name of the desktop environment, use the following command to echo to display the value of XDG_CURRENT_DESKTOP variable in the terminal as seen in the screenshot below.
While this tells you which desktop environment is being used, it doesn’t give you the desktop environment version, which is harder than it sounds because there is no standard command or environment variable that could give this information.
One way to get the desktop environment information in Linux is by using Screenfetch, a command line tool which displays the logo of your Linux distribution in ascii format along with a few basic system information, including desktop environment version
The first screenshot below shows the installation of Screenfetch. When installed, type screenfetch in the terminal and it should show the desktop environment version along with other system information. In the second screenshot below, you can see system is using GNOME 3.36.4.
You can also use the GUI to check desktop environment version asall desktop environments provide basic system details in their Settings-About section. Search for Settings in the menu (press Windows key and search):
- Applications Menu Settings
- Search for Settings application
In here, go to the bottom to find the About section. Click on it and you should have the desktop environment along with its version as you can see in the screen shot below
Exploring the GNOME Desktop Environment for Linux
GNOME is very popular and is the default desktop environment on Linux distributions such as CentOS and Ubuntu. Of all the Linux desktop environments, GNOME is considered the most efficient, stable, reliable and incredibly user-friendly. The screenshot below shows the following:
- At the frame’s top, you see a clock and a system tray on the far right.
- The Activities menu item on the panel’s far left allows switching between windows and provides the Search bar.
- The Favorites bar on the UI frame’s left side shows various application icons as well as a multi-dot icon, which is the Apps button.
- The Apps button displays various application icons that allow you to quickly access a desired program
Activities: Where you access application launchers, minimized applications, search, and virtual desktops (all seen in the screenshot below). Get to the Activities overview by doing one of the following:
- Click on the Activities button in the upper left corner
- Hover your cursor in the upper left corner
- If you are using Windows, click the Super key on your keyboard.
The Dash: if you look on the left edge of the Activities window, you’ll notice a bar of icons. This bar is called The Dash. The Dash contains your Favorites, launchers for frequently used applications . Click any one of those icons to launch its associated application. If there are application launchers on the Dash you don’t want, right-click the launcher in question and select Remove from Favorites.
Add a favorite to the Dash by:
- Opening the Applications overview by clicking on the grid icon at the bottom of the Dash. When the Applications overview opens, scroll through the list of installed applications to find what you’re looking for.
- Locate the application in question
- Right-click the application icon,
- Select “Add to Favorites” and it is automatically added to the Dash.
Search: GNOME Search tool searches for both installed applications in the Application overview, applications not yet installed within GNOME Software and files.
Calendar/notifications: Clicking on the clock icon in the middle of the top bar shows the calendar and notification functionality and if a notification available is present, click on it.
Application menus: In GNOME, you will find that some application menus are in the top bar and not the applications themselves as seen in the screenshot below, using the LibreOffice Writer application as an example. As you can see in the top bar, next to the Applications button, a new drop-down menu appears Click on that to gain access to the supported entries for the application.
Exploring the KDE
First started in 1996 and released in 1998, the Kool Desktop Environment (KDE) has evolved to include many additional software projects in addition to desktop environment and tthe desktop environment was rebranded as KDE Plasma.
How to Install KDE on Ubuntu
- Open a terminal window.
- Issue the command “sudo apt-get install kubuntu-desktop”.
- Type your sudo password and hit Enter.
- Accept any dependencies and allow the installation to complete.
- Log out and log in, choosing your new KDE desktop. which you can see in the screenshot below.
Navigating the KDE Desktop
Finding Applications: If you want to applications via the Linux KDE, click on the menu icon highlighted in the image below. It will bring up a listing of applications with a search bar seen in the second screenshot below. When you enter any term in the search box it works more or less like the Dash of Gnome or Unity and offers apps, files, locations related to that term in an overlay.
Customize the KDE desktop layout: Plasma gives users complete control over the desktop layout of the desktop. Right-click anywhere on the desktop and choose the last option ‘Configure Desktop’ from the context menu (first screenshot below). It will open the ‘desktop settings’ option that is shown in the second screenshot below, which you can modify as you like.
Dash Search Functionality: If you just want “dash search” feature then Homerun is what you are looking for. You can install it for your distro and then add it to the panel. Click on the ‘cashew’ > add widget and search for ‘ Homerun’. Click on the one with full screen overlay. If you want you can replace the default Menu Launcher with Homerun, you can go ahead and move the panel to the left edge of your monitor to get a Unity-like experience.
Cinnamon
MATE
The MATE desktop environment also got its start in 2011, when GNOME 3 (now
called GNOME Shell) was released. It was started by an Arch Linux distribution user in Argentina. Pronounced “ma-tay,” this desktop environment was officially released only two months after it was announced and was derived from GNOME 2. The desktop envi- ronment is available on a wide variety of Linux distributions, such as Arch Linux, Debian, Fedora, Ubuntu, Linux Mint, and so on.
MATE is named after a tea made from a plant’s dried leaves. The plant (Ilex paraguariensis) is native to South America. Mate tea is the national drink of Argentina. It is purported to have the health benefits of tea as well as pro- vide mental alertness similar to the benefit of drinking coffee.
Unity
Rendering the Linux Desktop GUI
The desktop environment is only part of the Linux user interface and the entire process involves:
- Desktop Environment
- Windows Manager: a program that communicates with the display server on behalf of the UI and each desktop environment has its own default window manager.
- Display Server: uses a communication protocol to transmit the desires of the UI to the operating system, and vice versa. The communication protocol is called the display server protocol and can operate over a network.
- Compositor: Arranges display elements within a window, create the screen image to be passed back to the client.
While most desktop environments use their own display manager, the X display manager is available for use and employs the X Display Manager Control Protocol (XDMCP); the main configuration file is /etc/X11/xdm/xdm-config. While Wayland is replacing X as the default display server on many Linux systems, the X server will be around for a while, so you need to know both.
Understanding X11
The X (X Window System), around since the 1980s, was, until 2004 mainly implemented by the XFree86 server, when a licensing change occurred causing many Linux distributions to switch to the “X.Org” foundation’s implementation of X, the X Window System version 11.
Wayland is replacing X11, as it provide better security and is easier to maintain. As its use is quite wide spread, you still have distributions using X11, so it is important to understand its basics.
X11’s primary configuration file is “/etc/X11/xorg.conf“, though sometimes is stored in the /etc/ directory instead. Having said that, typically this file is no longer used as X11 creates a session configuration on the fly using runtime auto-detection of the hardware involved with each GUI’s session. In some cases, auto-detect might not work properly and you need to make X11 configuration changes manually and create the configuration file. To do this:
- Shut down the X server
- Open terminal emulator
- Generate the “xorg.conf.newfile” (found in your local directory) via the “Xorg -configure” command.
- Make any necessary changes,
- Rename the file, move it to its proper location, and restart the X server.
You will have little to no need to ever create or tweak the X11 configuration file. However, if you really want to dig into the X11 configuration file’s details, view its man page via the “man 5 xorg.conf” command. The xorg.conf file has several sections. Each section contains important configuration information as follows:
- Input Device: Configures the session’s keyboard and mouse
- Monitor: Sets the session’s monitor configuration
- Modes: Defines video modes
- Device: Configures the session’s video card(s)
- Screen: Sets the session’s screen resolution and color depth
- Module: Denotes any modules, which need to be loaded
- Files: Sets file path names, if needed, for fonts, modules, and keyboard layout files Server Flags: Configures global X server options
- Server Layout: Links together all the session’s input and output devices
Additionally many desktop environments provide dialog boxes in their UI, allowing you to configure your GUI X sessions. Most likely you will have little to no
Troubleshooting X11
Two utilities are available to troubleshoot X problems:
- xdpyinfo: provides information about the X server, including the different screen types available, the default communication parameter values, protocol extension information, and so on.
- xwininfo: seen in the screenshot above, is a utility is focused on providing window information. If no options are given, an interactive utility asks you to click the window for which you desire statistics. The “xwininfo” command hangs if you are running Wayland rather than X.
Understanding Wayland
Wayland is a replacement for the X11 display server and simpler, more secure, and easier to develop and maintain than its predecessor. Specifically, Wayland is an umbrella term that covers the compositor, the windows server, and the display server. Additionally, it:
- Defines the communication protocol between a display server and its various clients.
- Is now used by many current Linux desktop environments, such as GNOME Shell and KDE Plasma.
- Provides rather basic desktop compositor ,Weston, created as a Wayland compositor reference implementation, which is a compositor requirements example for developers who want to create their own Wayland compositor.
- Wayland’s compositor is swappable; you can use a different compositor if you need a more full-featured desktop experience.
- Many desktop environments create their own Wayland compositors, embedded within their window manager.
If you experience desktop UI problems and your system is Wayland, the following list steps through some basic approaches to troubleshooting.
- Try the GUI without Wayland. Reboot and use the desktop environment without Wayland. If your UI problems are resolved, then you know it has most likely something to do with Wayland. If you use the GNOME Shell user interface but do not have another desktop environment; turn off Wayland, by editing the /etc/gdm3/custom.conf file. and enable the line with:
#WaylandEnable=false line and save the file.
Reboot the system, log in to a GUI session and see if the problems resolved.
- Check your system’s graphics card: If your system seems buggy when running Wayland, check your graphics card drivers to determine if they support Wayland.
- Use a different compositor: If using a desktop environment’s built-in compositor or one of the other compositors, try the Weston compositor package.
Using Linux Remote Desktops
As either an administrator or hacker/pen tester, you wont be sitting down at a monitor and using a Linux desktop environment; servers are either rack-mounted systems or virtual machines running on those rack-mounted systems. Accessing these servers usually requires a user accessing the server via an SSH utility, but there are plenty of times you need a fully functional desktop environment, giving you ample experience comparing Linux desktop environments.
Remote desktop software uses a client/server model; the server runs on the remote Linux system, while the client runs on your machine.
Part of the process of comparing Linux desktop environments involves getting familiar with the more common remote Linux desktop implementations
VNC/Virtual Network Computing
Multiplatform and employs the Remote Frame Buffer (RFB) protocol which allows:
- Users on the client side to send GUI commands (mouse clicks, cursor movement) to the server.
- The server to sends desktop frames back to the client’s monitor.
Benefits of VNC include:
- Flexibility in providing remote desktops.
- Desktops are available on demand and for multiple users.
- Persistent and static desktops are available.
- Establishing an encrypted SSH tunnel via ssh or a client viewer command-line option to encrypt.
Drawbacks of VNC are that:
- The server only handles mouse movements/keystrokes; not file/audio transfer or printing services for the client.
- It does not provide traffic encryption by default
- Server password is stored as plain text in a server file.
Initiating a VNC Connection
As a VNC server offers a GUI service at TCP port 5900 + n (where n equals the “display number,” usually 1 eg port 5901), so when using the command line, point the VNC client/viewer to the VNC server’s hostname and TCP port.
Alternatively, use the display number instead of the whole TCP port number; The client/user enters a predetermined password for the VNC server, not Linux system authentication. Once authenticated with VNC, the user is served up the desktop environment’s display manager output so system authentication can take place.
If using a Java-enabled web browser, the VNC server can be accessed via TCP port 5800 + n.
Two types of desktop UIs are available for VNC clients:
Persistent desktops: Available only via web browser access, they have UIs that do not change when presented and similar to the local desktop experience in that the user:
- Has certain windows open.
- Locks the screen and engages in an activity away from the local system;
- Comes back and unlocks the screen;
- Finds the GUI in the exact same state it was left in.
Static desktops: do not provide a saved-state GUI.
VNC Technology Alternatives for Linux
TigerVNC is a popular alternative VNC technology and also works on Windows, so you can connect to either a remote Linux or remote Windows system.
- Use the “tigervnc-server” package to install the server on a Linux system. When configuring your VNC server, be sure to employ OpenSSH port forwarding for the VNC server ports and configure your firewalls to allow traffic through port 22 (or the port number you use for SSH traffic).
- Once installed, control TigerVNC with the “vncserver” and “vncconfig” commands.
- Install the VNC client with the “tigervnc” package:
- After the appropriate server firewall modifications, use the “vncviewer” command to connect to the server system and get a remote desktop.
- When accessing a remote desktop via the command line, use a terminal emulator in the GUI environment. Attempting to use a text-mode terminal outside the GUI to issue these commands will fail.
Using xrdp
An alternative to VNC, xrdp has a number of benefits:
- Encryption of traffic via TLS as Xrdp uses RDP.
- Xrdp is fairly simple to use. Also, because so many Windows-oriented users are already familiar with Remote Desktop Connection, it typically does not take long to employ it in the office environment.
- Compatible with a wide-variety of RDP client software.
- Ability to connect to an existing connection, providing a persistent desktop.
- Xrdp server handles:
- Mouse movements and keystrokes.
- Audio transfers.
- Mounting of local client drives on remote system.
From an operational perspective, Xrdp:
- Uses X11rdp or Xvnc to manage the GUI session.
- Supports the Remote Desktop Protocol (RDP).
- Provides only the server-side of an RDP connection.
- Allows access from several RDP client implementations such as:
- rdesktop,
- FreeFDP
- Microsoft Remote Desktop Connection.
- Is systemd ready, so you can simply install, enable, and start the server with “systemctl” commands.
- Linux package name is “xrdp“.
- May not be in your Linux distribution’s standard repositories.
- After installation of the Xrdp server.
- Adjust the firewall so that traffic can access the standard RDP port (TCP 3389).
- Direct the RDP client choice to the server via its hostname or IP address and provide the RDP port number.
- Handles configuration settings in the /etc/xrdp/xrdp.ini file.
- An important setting in this file is the security_layer directive.
- The default setting is “negotiate“; the Xrdp server negotiates with the client to use one of three security methods:
- tls: Provides SSL (TLS 1.0) encryption for server authentication and data transfer.
- rdp: Sets the security to standard RDP Security; not safe from man-in-the-middle attacks.
- negotiate: Sets the security method to be the highest the client can use; potential problematic connecting over a public network and the client must use the Standard RDP Security method.
- The default setting is “negotiate“; the Xrdp server negotiates with the client to use one of three security methods:
- An important setting in this file is the security_layer directive.
NX Protocol
NX protocol/technology is another remote desktop sharing protocol. It
- Its v3.5 core technology was open source and available under the GNU GPL2 license.
- Version 4 is proprietary and closed source.
- Several open-source Linux variations are available based upon the NX v3 technology, including FreeNX and X2Go.
Benefits of NX include:
- Excellent response times, including low-bandwidth environments with high-latency issues.
- Better speed than VNC-based products.
- Compresses X11 data; there is less data to send (improving response times).
- Employs caching data to improve the remote desktop experience.
- Encrypted by default; uses OpenSSH tunneling.
- Support for simultaneous users through a single network port.
SPICE/Simple Protocol for Independent Computing Environments
SPICE, developed as remote desktop product for various virtual machines, is used primarily for providing connections with KVM virtual machines, and offers the following features:
- The Spice client side uses multiple data socket connections, and allows multiple clients.
- If you use X11, you can use Xspice, which acts as a stand-alone Spice server as well as an X server.
- Delivers desktop experience similar to a local connection.
- Low CPU consumption allows it to be used with various servers with multiple virtual machines.
- High-quality video streaming.
- Live migration features so there are no connection interruptions if the virtual machine is being migrated to a new host.
- Has a single server implementation, with several client implementations. These include remote-viewer and GNOME Boxes.
- Strong security features;
- Data can either be sent plain text or have its traffic encrypted using TLS.
- Authentication between the client and remote server uses Simple Authentication and Security Layer (SASL), allowing various SASL supported authentication methods, including KerberOS.
Forwarding
Providing data access to only those who are authorized is imperative. Whether it’s sending plaintext data or remote desktop GUI client/server interaction information, both need to be secured across the network. SSH port forwarding/SSH tunnelling redirects a connection from one particular network port to port 22, where the SSH service is waiting to receive it, allowing data traffic to move back and forth through a secure encrypted tunnel, similar to a virtual private network (VPN).
To use SSH port forwarding, you must have the OpenSSH service installed and enabled on your Linux system, so check this first (as seen in the screenshot below). If not installed, follow these instructions to install sshd on your system.
Next, check that OpenSSH is set up to allow port forwarding by looking in the OpenSSH configuration file at “/etc/ssh/sshd_config”, confirm the directive “AllowTcpForwarding” is set to yes, and if not modify the file to employ SSH port forwarding. As seen in the screenshot below, the directive is commented out via a pound sign (#); this is not an issue because the default setting for “AllowTcpFowarding” is yes.
SSH port forwarding has 3 settings for tunneled traffic.:
- Local
- Remote
- Dynamic
Setting Up Local Port Forwarding in Linux
LLocal port forwarding route outbound traffic to a different outbound port and tunneled via OpenSSH prior to leaving the client system.
- It sends traffic from the OpenSSH client on your system to the client’s OpenSSH server.
- The client’s OpenSSH server then forwards that traffic onto the destination server via a secured tunnel.
- Use the following command to set up local port forwarding, the -L option of the ssh command is used as follows:
ssh -L local-port:127.0.0.1:remote-port -Nf user@destination-host
The command’s syntax contains two parts, each with a number of arguments:
- The portion that establishes the tunnel
- The local-port is the application’s port number you are employing on the client side.
- The 127.0.0.1 designates that you are using a local SSH port forwarding method.
- The remote-port is the port where the application is listening on the destination host.
- The destination-host is the computer you are logging into in order to use the desktop environment residing there.
- The user is the desktop host username you wish to use to authenticate so that the secure tunnel can be established
- The remote desktop connection portion that allows users to issue additional commands, such as a remote desktop command, after the secured tunnel is established:
- The “-N ” option indicates that no remote terminal process is desired,
- The ” -f” option indicates that after authenticated to the server occurs, the ssh command should move into the background.
Setting Up Remote Port Forwarding in Linux
As opposed to local port forwarding, that starts at the remote client, remote or reverse SSH port forwarding starts at the destination/server; create the remote desktop secure tunnel via the following command:
ssh -R local-port:127.0.0.1:remote-port -Nf user@client-host
Let’s break down this command:
- The -R option is used instead of the -L option.
- local-port: Port number on the client-host with the vncviewer command.
- The remote-port is on the remote desktop server.
- The “-N” option indicates that no remote terminal process is desired.
- The ” -f” option indicates that after authenticated to the server occurs, the ssh command should move into the background.
- client-host: the remote client’s IP address or hostname that issues remote desktop commands.
