Note that it still exposes the connection to all local processes, on both hosts (except network-restricted services or with non-typical host-local firewall rule

Note that it still exposes the connection to all local processes, on both hosts (except network-restricted services or with non-typical host-local firewall rules), though it should be fine, if you're using semi-reasonable passwords. SSH supports unix domain socket forwarding and even cross unix/ip forwarding with a syntax like: ssh -L /path/to/sock:/path/to/sock ssh -L /path/to/sock:localhost:5901 ssh -L 5091:/path/to/sock Then you can have user-authenticated host and transit secure password-less VNC connections. Unfortunately I haven't been able to convince tigervnc viewer to connect to a unix domain socket, so I don't have a fully scripted connection, but remmina and tigervnc server work fine. Also, forwardings / connections fail if the socket already exists when the listening side starts up (often an unclosed leftover), so I rm them before starting the ssh connection / vnc server and it works reliably.