VNC:
https://www.tightvnc.com
Listen to loopback only.

cmd:
ssh-keygen (ab Windows 10 build 1809)
type .ssh\id*.pub
Ausgabe nach sshserver vncuser .ssh/authorized_keys

sshserver /etc/ssh/sshd_config
...
Match User vncuser
	AllowTcpForwarding yes
	GatewayPorts yes
	PermitOpen 192.168.123.45:5900
	ForceCommand /bin/mv ~/.ssh/authorized_keys ~/.ssh/authorized_keys~
...

Desktopverknüpfung:
C:\Windows\System32\cmd.exe /C ECHO Verbindung gestartet && ssh -N -R 192.168.123.45:5900:127.0.0.1:5900 vncuser@sshserver