Debian 13 Gui KDE

Option A: Azure Portal

• Open the Azure Marketplace and search for "Debian 13 with KDE Plasma Desktop SecureAnyCloud".
• Select the image and click Create.
• On the Basics tab, set Subscription (select your Azure subscription), Resource Group (create a new one or select an existing one), Virtual Machine Name (enter a name for your VM) and Region (select your preferred Azure region).
• Set Size to Standard_B2ms or larger.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22) only. You do not need to open port 3389, because the recommended way to reach the desktop is through an SSH tunnel (Step 6).
• Click Review + Create, then Create.

Option B: Azure CLI

SecureAnyCloud images carry a Marketplace purchase plan. Accept its terms once per subscription, then create the VM:

az vm image terms accept --urn sac1647283583153:debian-13-gui-kde:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-debian-kde \
  --image sac1647283583153:debian-13-gui-kde:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-debian-kde --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is offering a different key from the one you supplied at create time.

Check the release and point release, and confirm that the machine booted to the graphical target. Confirm that the SDDM display manager is running, and list the installed desktop packages:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release cat /etc/debian_version systemctl get-default systemctl is-active sddm dpkg-query -W -f='${Package} ${Version}\n' task-kde-desktop plasma-workspace kwin-x11 sddm xrdp xorgxrdp

Expected output (the point release and package revisions move forward as Debian publishes updates):

PRETTY_NAME="Debian GNU/Linux 13 (trixie)" VERSION_ID="13" 13.7 graphical.target active kwin-x11 4:6.3.6-1 plasma-workspace 4:6.3.6-2 sddm 0.21.0+git20250502.4fe234b-2 task-kde-desktop 3.81 xorgxrdp 1:0.10.2-1 xrdp 0.10.1-3.1+deb13u2

Confirm the session that an RDP connection starts. xrdp runs the system's default X session manager, which on this image is Plasma's X11 session:

grep -E '^(Name|Exec)=' /usr/share/xsessions/plasmax11.desktop update-alternatives --query x-session-manager | grep '^Value:'

Expected output:

Exec=/usr/bin/startplasma-x11 Name=Plasma (X11) Value: /usr/bin/startplasma-x11

Plasma's Wayland session is installed as well, because it is part of Debian's Plasma packaging. It is used only if you sign in at a local screen, which an Azure VM does not have. Every RDP connection uses Plasma (X11).

A new virtual machine has remote desktop switched off. The helper shows the full state:

sudo sac-remote-desktop status
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort

Expected output (the certificate fingerprint is unique to your VM):

remote desktop service: disabled / inactive session manager: disabled / inactive listening on 3389: no per-VM TLS certificate: generated (/etc/xrdp/cert.pem) TLS certificate SHA-256: 14:B5:3A:51:A6:C3:72:80:55:E7:B6:15:48:66:C2:06:2E:7A:1B:21:67:0B:8E:AD:5F:F9:25:D9:3A:9E:8A:08 accounts able to log in at the KDE Plasma remote desktop: none (set one with:
sudo passwd <user>) 0.0.0.0:22 127.0.0.53%lo:53 127.0.0.54:53 [::]:22

The only listener reachable from outside the machine is SSH on port 22. The two port 53 entries are the local DNS resolver, which is bound to loopback addresses only.

The xrdp login box asks for your account password, and a new VM has none. Choose your own. Run this command yourself on the VM, and enter the new password twice when prompted:

sudo passwd azureuser

Your SSH access is unaffected, because SSH remains key-only. Now switch remote desktop on:

sudo sac-remote-desktop enable

Expected output:

remote desktop enabled: listening on port 3389 TLS certificate SHA-256: 14:B5:3A:51:A6:C3:72:80:55:E7:B6:15:48:66:C2:06:2E:7A:1B:21:67:0B:8E:AD:5F:F9:25:D9:3A:9E:8A:08 sign in with your own account name and the password you set with
sudo passwd safest route: ssh -L 3389:localhost:3389 <user>@<vm-ip>, then point your RDP client at localhost:3389

If no administrator account has a password yet, the helper refuses and tells you which command to run first. The setting survives reboots. Under the hood, the helper runs systemctl enable --now xrdp.service, which also starts the session manager.

Print this VM's connection details:

sudo sac-remote-desktop credentials

The output lists RDP_USERNAME (your admin account name), RDP_PORT and the TLS certificate fingerprints. There is no separate RDP password. RDP_PASSWORD_SOURCE records that the password is your own account password.

The recommended route keeps port 3389 closed to the internet and carries RDP inside your SSH connection. On your workstation, open a tunnel and leave it running:

ssh -N -L 3389:localhost:3389 azureuser@<vm-ip>

Then point your RDP client at localhost:3389:

• Windows: Remote Desktop Connection (mstsc) or Windows App, computer localhost:3389
• macOS: Windows App, add a PC with the name localhost:3389
• Linux: Remmina (RDP), server localhost:3389, or FreeRDP 3: xfreerdp3 /v:localhost:3389 /u:azureuser /gfx /bpp:32

On first connection, the client shows the server's certificate. It is self-signed and unique to your VM. Before you accept it, compare its fingerprint with RDP_TLS_SHA256 (or RDP_TLS_SHA1, which Windows displays as the thumbprint).

The xrdp login box appears. The Session list has one entry, Xorg, which is the one you want:

Enter your account name and the password you set in Step 5. The first sign-in takes a little longer while Plasma creates your settings. Then the Plasma desktop appears:

Disconnecting your RDP client leaves the session running on the VM. Connect again with the same account to return to it. xrdp asks for your password every time you connect, so a disconnected session is never left unprotected.

If you prefer a direct connection instead of the tunnel, allow port 3389 in the VM's network security group from your own public address only, never from the whole internet. For example, run this from your workstation, and substitute your own values where the command shows example ones:

az network nsg rule create --resource-group myResourceGroup --nsg-name my-debian-kdeNSG \
  --name allow-rdp-from-me --priority 1010 --access Allow --protocol Tcp \
  --direction Inbound --destination-port-ranges 3389 --source-address-prefixes <your-public-ip>/32

Click the application launcher at the bottom left of the panel to see what is installed:

Press Ctrl+Alt+T to open Konsole, the terminal. It is also in the launcher under System. azureuser keeps its Azure administrator rights, so sudo works in the desktop exactly as it does over SSH:

To add software, use apt in Konsole as on any Debian machine, for example sudo apt install libreoffice or sudo apt install firefox-esr.

Plasma's defaults on this image have a few quirks:

• The panel's pinned icons are Plasma's stock set: System Settings, the Discover software centre, the file manager and the web browser. Discover is not installed (use apt), so its pin shows a plain document icon and does nothing. Right-click it and choose Unpin from Task Manager. The web browser pin opens a browser once you install one.
• The screen locks after 5 minutes of inactivity. This is Plasma's default. Unlock it with your account password. To change the delay or turn it off, open System Settings and search for Screen Locking.
• There is no Sleep button. An Azure VM that suspends itself cannot be woken again from the inside, so the image switches in-guest sleep off (Step 9). To stop paying for compute, stop and deallocate the VM from Azure instead.
• Resolution follows your RDP client. Resize the client window, or set the display size in the client, before you connect.

Confirm that SSH is key-only, that root is locked, and that no account has a password until you set one:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow

Expected output on a new VM (after Step 5 the last line reads 1, your own account):

permitrootlogin without-password passwordauthentication no root L 2009-12-22 -1 -1 -1 -1 accounts with a password: 0

without-password is how this OpenSSH release prints prohibit-password. It means root may not authenticate with a password. L means the root account is locked.

Cloud-init and systemd-networkd configure the Azure network interface, exactly as on Debian's own cloud image. The KDE package set on this image does not install NetworkManager, so no second network stack competes for your interface:

networkctl list --no-legend | awk '$2=="eth0"'

Expected output:

2 eth0 ether routable configured

NetworkManager is not installed, so Plasma shows no network applet in the system tray. This is expected. If you want one, install NetworkManager and plasma-nm yourself, and test the change from the Azure serial console before you reboot.

Stock Debian 13 enables LLMNR in systemd-resolved, which listens on port 5355 on every interface. This image switches LLMNR off with a small drop-in file. Check it:

grep -vE '^[[:space:]]*(#|$)' /etc/systemd/resolved.conf.d/20-sac-no-llmnr.conf resolvectl llmnr

Expected output:

[Resolve] LLMNR=no MulticastDNS=no Global: no Link 2 (eth0): no

To turn LLMNR back on, delete that file and run sudo systemctl restart systemd-resolved.

In-guest sleep is switched off the same way. A virtual machine that suspends itself stops answering SSH and RDP while the Azure portal still shows it as running. Only a restart from Azure brings it back. For this reason, every sleep mode is disabled and Plasma offers no Sleep button. Shut down and restart work normally. Check it:

grep -vE '^[[:space:]]*(#|$)' /etc/systemd/sleep.conf.d/20-sac-no-guest-sleep.conf busctl call org.freedesktop.login1 /org/freedesktop/login1 org.freedesktop.login1.Manager CanSuspend

Expected output:

[Sleep] AllowSuspend=no AllowHibernation=no AllowSuspendThenHibernate=no AllowHybridSleep=no s "no"

The Azure network security group is the enforced firewall. No host firewall is installed. If you add one, allow SSH first, and allow 3389 only if you connect directly rather than through the tunnel.

To switch remote desktop off again, run this command yourself. The setting survives reboots:

sudo sac-remote-desktop disable

To change the password that the RDP login box asks for, change your account password. They are the same thing:

sudo passwd azureuser

To replace this VM's TLS certificate with one of your own, write it to /etc/xrdp/cert.pem and /etc/xrdp/key.pem. The key must be readable by group xrdp. Then restart the service with sudo systemctl restart xrdp.

The image is fully updated at build time. Refresh the package lists and confirm that no upgrades are pending. grep -c exits non-zero on a zero count, which is why the command ends in || true:

sudo apt-get update -qq echo "pending upgrades: $(apt-get -s dist-upgrade | grep -c '^Inst ' || true)"

Expected output on a freshly built image:

pending upgrades: 0

unattended-upgrades installs Debian security updates automatically. You can also update on your own schedule with sudo apt-get update && sudo apt-get -y dist-upgrade. Reboot if a new kernel was installed.

Debian publishes point releases every couple of months, so after a while this count will be above zero until you upgrade.