Installing Xvnc

apt-get install tightvncserver
vncserver -localhost -nolisten tcp

Then set up the usual SSH tunnel and you're there.

Xvnc will run fine without the options, but one really should lock down access.

"-localhost" tells Xvnc to listen for VNC clients only on the loopback interface

"-nolisten tcp" tells Xvnc to listen for X11 clients only on the PF_UNIX socket in /tmp/.