Continuing my previous post about vnc over ssh, here is a way to limit the connection to local only.
If you are using gnome, you can configure it via gconf-editor. Go to the following key: /desktop/gnome/remote_access/network_interface and set 'lo' as the value. This way, vino server will only listen to local (loopback) interface only.
Now, if you would like to have vino server ready on each time you logged in, you need to configure it from, System -> Preferences -> Desktop Session Settings, and enable Remote Desktop.
Remember to configure Remote Desktop itself, from System -> Preferences -> Remote Desktop Preferences and allow other users to view your dekstop.