Install AnyDesk on Ubuntu—and Know What You Opened

Remote-access software usually gets installed when someone is already waiting: a parent needs help, a lab machine is across town, or a colleague is staring at an error you cannot reproduce. That urgency is exactly why it is worth taking two extra minutes. You are not merely adding an app; you are creating a path through which another computer may see or control this one.

One question before the terminal: who needs to control whom?

• This Ubuntu machine will control another device: an outgoing session can run from either Wayland or Xorg.

• Another device must control this Ubuntu desktop: AnyDesk’s current Linux documentation requires a graphical Xorg session for incoming connections.

• This is a headless server: installing a desktop remote-control client is not the same as administering a server; SSH or a managed console may be the better tool.

• No one will be present at the Ubuntu machine: installation and unattended access need separate decisions, credentials, permissions, and recovery planning.

Take the machine’s pulse first

$ printf 'Architecture: %s\nSession: %s\nDesktop: %s\n' "$(dpkg --print-architecture)" "$XDG_SESSION_TYPE" "$XDG_CURRENT_DESKTOP"
. /etc/os-release && printf 'OS: %s\n' "$PRETTY_NAME"

What these few lines tell us

• dpkg --print-architecture identifies the package architecture APT will select; AnyDesk’s current repository publishes several architectures.

• XDG_SESSION_TYPE normally reports wayland or x11. AnyDesk calls the latter an Xorg session in its support documentation.

• Reading /etc/os-release is non-destructive and avoids guessing the Ubuntu version from desktop appearance.

• AnyDesk officially supports Ubuntu 18.04 and newer, but its documentation limits support to unmodified listed distributions.

The repository route: less exciting, easier to maintain

AnyDesk recommends its official repositories for Debian- and Red Hat-based Linux systems. The repository lets APT resolve dependencies and discover later client updates. The following sequence mirrors AnyDesk’s current DEB repository instructions and replaces the retired apt-key pattern found in many older posts.

$ sudo apt update
sudo apt install ca-certificates curl apt-transport-https
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://keys.anydesk.com/repos/DEB-GPG-KEY -o /etc/apt/keyrings/keys.anydesk.com.asc
sudo chmod a+r /etc/apt/keyrings/keys.anydesk.com.asc

Pause here and read what changed

• apt update refreshes metadata; the following install may change packages, so inspect its transaction summary before confirming.

• install -d creates the keyring directory with predictable permissions without replacing existing keys.

• curl -f fails on HTTP errors, -sS suppresses progress but retains errors, -L follows redirects, and -o writes to the explicit key file.

• A dedicated keyring does not trust this key for every repository. The later signed-by option scopes it to AnyDesk’s source entry.

• AnyDesk says keys installed before 2 February 2025 must be refreshed using its current procedure.

$ gpg --show-keys --with-fingerprint /etc/apt/keyrings/keys.anydesk.com.asc

What this inspection proves—and what it does not

• gpg --show-keys parses the file and displays its identities, key IDs, dates, and fingerprint without importing it into a personal keyring.

• A readable key proves the file is structurally usable; it does not independently prove ownership when both key and instructions came from the same channel.

• For managed environments, validate the fingerprint through an independently approved vendor record before trusting the repository.

• Stop if the file is empty, cannot be parsed, or does not identify AnyDesk Software GmbH as expected.

$ echo 'deb [signed-by=/etc/apt/keyrings/keys.anydesk.com.asc] https://deb.anydesk.com all main' | sudo tee /etc/apt/sources.list.d/anydesk-stable.list >/dev/null
sudo apt update
apt-cache policy anydesk

The candidate is the checkpoint

• The source entry uses HTTPS and limits signature trust to the named AnyDesk keyring.

• sudo apt update retrieves signed repository metadata but does not install AnyDesk.

• apt-cache policy should identify deb.anydesk.com as the intended candidate source and show the version APT would install.

• Do not continue if APT reports signature, certificate, architecture, or repository metadata errors; never bypass signature verification.

Install only after the source looks right

$ sudo apt install anydesk

What APT is doing for you

• apt install resolves dependencies, verifies repository signatures, registers the package, and may enable the AnyDesk service.

• Review the exact packages, download size, disk impact, and source before accepting the transaction.

• The old instructions to preinstall libgtkglext1 and libpangox-1.0-0 are deliberately absent; current package metadata, not a version-6-era blog post, should declare requirements.

• Installing the service improves availability after restart, but it does not automatically make unattended access a good idea.

If you only want a downloaded DEB

A manually downloaded package can be reasonable for a one-off test or controlled deployment. Download it only from AnyDesk’s Linux page, match the architecture, and keep the exact filename rather than copying an old version number.

$ sudo apt install ./anydesk_VERSION_ARCH.deb

Why the dot-slash matters

• ./ tells APT this is a local package path rather than a repository package name.

• Replace anydesk_VERSION_ARCH.deb with the literal downloaded filename; do not paste the placeholder unchanged.

• APT resolves declared dependencies, unlike a bare dpkg -i workflow that can leave the package unconfigured.

• A one-file installation does not automatically add the AnyDesk repository; decide how security updates will be discovered and deployed.

The first launch should feel uneventful

$ anydesk --version
systemctl --no-pager --full status anydesk.service

How to read this result

• The version should match the package APT reported, not an older binary elsewhere on the path.

• systemctl status is read-only; active (running) confirms the installed service is currently available.

• A service can be healthy while the desktop cannot receive a session under Wayland; display protocol remains a separate requirement.

• Launch the GUI as the logged-in desktop user from the application menu or with anydesk. AnyDesk explicitly says it cannot run as root.

Make the first connection with someone present

1. Open AnyDesk on both devices and verify which one is local and which one is remote.

1. Read the remote machine’s AnyDesk ID or Alias directly from its screen; treat it as connection information, not as proof of identity.

1. Enter that ID in Remote Address from the controlling device.

1. Have the person at the remote machine inspect the requester and permissions before selecting Accept.

1. Begin with only the permissions needed for the task. Test pointer, keyboard, clipboard, audio, and file transfer separately rather than granting everything by reflex.

1. End the session from both sides and confirm AnyDesk shows no active connection.

Unattended access is a second installation decision

Do not enable unattended access merely because the app is installed. It allows a connection without someone physically accepting it, which is useful for managed workstations and dangerous on an unmanaged laptop. AnyDesk disables it by default.

• Use a unique password longer than 12 characters and store it in an approved password manager.

• Enable two-factor authentication and preserve recovery material outside the remote machine.

• Create a restricted permission profile instead of defaulting to Full Access.

• Use the Access Control List to permit known AnyDesk IDs or organization aliases where your operating model supports it.

• Decide whether connecting clients may save login tokens; clear all tokens after device loss, staff departure, or suspected compromise.

• Changing the unattended password invalidates saved tokens, including when it is changed back to the same value.

When something refuses to work

• Outgoing works, incoming does not: check XDG_SESSION_TYPE; Wayland is supported for outgoing sessions only, while incoming Linux control requires Xorg.

• Command exists but no GUI appears: run it as the desktop user, confirm a graphical session and display variables exist, then inspect service and user logs.

• APT says NO_PUBKEY or EXPKEYSIG: reinstall the current key from AnyDesk’s HTTPS key URL and keep signed-by; do not use deprecated apt-key or mark the source trusted.

• Package has unmet dependencies: refresh APT metadata, confirm the Ubuntu release is supported, and let APT name the missing dependency instead of downloading old libraries manually.

• Security controls are locked: an installed AnyDesk client may require administrative authorization to modify Access settings.

• Connection is rejected: verify identity, ID, interactive-access mode, permission profile, ACL, network reachability, and licensing rather than repeatedly weakening security.

Leave the machine safer than you found it

After the support call, ask one final question: should this computer still be remotely reachable? If the answer is no, disable unattended access, clear saved tokens, remove unneeded ACL entries, and uninstall the client. If the answer is yes, document the owner, update path, approved operators, permissions, last review date, and offboarding procedure. Quiet remote access should never become forgotten remote access.

Sources worth keeping beside the runbook

• AnyDesk’s current DEB repository commands.

• AnyDesk Linux support and Xorg/Wayland limitations.

• AnyDesk installation methods and service behaviour.

• Secure unattended access with passwords, tokens, and 2FA.

• AnyDesk security and offboarding recommendations.

• Compare the installation model with TeamViewer on Ubuntu.