Debian 13 Gui XFCE

Option A: Azure Portal

• Open the Azure Marketplace and search for "Debian 13 with XFCE Desktop SecureAnyCloud".
• Select the image and click Create.
• Configure the basics:
  • Subscription: select your Azure subscription.
  • Resource Group: create a new one or select an existing one.
  • Virtual Machine Name: enter a name for your VM.
  • Region: select your preferred Azure region.
  • Size: Standard_B2s or larger.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22) only. You do not need to open port 3389, because the recommended way to reach the desktop is through an SSH tunnel (Step 6).
• Click Review + Create, then Create.

Option B: Azure CLI

SecureAnyCloud images carry a Marketplace purchase plan, so accept its terms once per subscription. Then create the VM:

az vm image terms accept --urn sac1647283583153:debian-13-gui-xfce:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-debian-xfce \
  --image sac1647283583153:debian-13-gui-xfce:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-debian-xfce --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, your client is not offering the key that you supplied at create time.

Check the release and point release, confirm that the machine booted to the graphical target and that the LightDM display manager is running, and list the installed desktop packages:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release cat /etc/debian_version systemctl get-default systemctl is-active lightdm dpkg-query -W -f='${Package} ${Version}\n' task-xfce-desktop xfce4 xfce4-session lightdm xrdp xorgxrdp

Expected output. The point release and package revisions move forward as Debian publishes updates:

PRETTY_NAME="Debian GNU/Linux 13 (trixie)" VERSION_ID="13" 13.7 graphical.target active lightdm 1.32.0-6+b2 task-xfce-desktop 3.81 xfce4 4.20.1 xfce4-session 4.20.2-2 xorgxrdp 1:0.10.2-1 xrdp 0.10.1-3.1+deb13u2

A new virtual machine has remote desktop switched off. The helper shows the full state:

sudo sac-remote-desktop status
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort

Expected output. The certificate fingerprint is unique to your VM:

remote desktop service: disabled / inactive session manager: disabled / inactive listening on 3389: no per-VM TLS certificate: generated (/etc/xrdp/cert.pem) TLS certificate SHA-256: D2:32:3D:93:E7:20:C9:7E:5E:7A:0F:48:4D:CA:C1:85:88:10:FA:CA:9E:C9:89:BD:F1:11:64:04:91:CC:FF:D9 accounts able to log in at the XFCE remote desktop: none (set one with:
sudo passwd <user>) 0.0.0.0:22 127.0.0.53%lo:53 127.0.0.54:53 [::]:22

The only listener reachable from outside the machine is SSH on port 22. The two port 53 entries are the local DNS resolver, bound to loopback addresses only.

The XFCE login box asks for your account password, and a new VM has none. Choose your own. Run the command below yourself on the VM, and enter the new password twice when prompted:

sudo passwd azureuser

Your SSH access is unaffected, because SSH remains key-only. Now switch remote desktop on:

sudo sac-remote-desktop enable

Expected output:

remote desktop enabled: listening on port 3389 TLS certificate SHA-256: D2:32:3D:93:E7:20:C9:7E:5E:7A:0F:48:4D:CA:C1:85:88:10:FA:CA:9E:C9:89:BD:F1:11:64:04:91:CC:FF:D9 sign in with your own account name and the password you set with
sudo passwd safest route: ssh -L 3389:localhost:3389 <user>@<vm-ip>, then point your RDP client at localhost:3389

If no administrator account has a password yet, the helper refuses and tells you which command to run first. The setting survives reboots. Under the hood, the helper runs systemctl enable --now xrdp.service, which starts the session manager with it.

Print this VM's connection details:

sudo sac-remote-desktop credentials

The output lists RDP_USERNAME (your admin account name), RDP_PORT and the TLS certificate fingerprints. There is no separate RDP password. RDP_PASSWORD_SOURCE records that the password is your own account password.

The recommended route keeps port 3389 closed to the internet and carries RDP inside your SSH connection. On your workstation, open a tunnel and leave it running:

ssh -N -L 3389:localhost:3389 azureuser@<vm-ip>

Then point your RDP client at localhost:3389:

• Windows: use Remote Desktop Connection (mstsc) or Windows App, with computer localhost:3389.
• macOS: use Windows App and add a PC with the name localhost:3389.
• Linux: use Remmina (RDP) with server localhost:3389, or FreeRDP 3: xfreerdp3 /v:localhost:3389 /u:azureuser /gfx /bpp:32.

On first connection, the client shows the server's certificate. It is self-signed and unique to your VM, so compare its fingerprint with RDP_TLS_SHA256 before you accept it. You can also compare RDP_TLS_SHA1, which is what Windows displays as the thumbprint.

The xrdp login box appears. The Session list has one entry, Xorg, which is the one you want. Enter your account name and the password that you set in Step 5. The XFCE desktop appears.

Disconnecting your RDP client leaves the session running on the VM. Connect again with the same account to return to it. xrdp asks for your password every time you connect, so a disconnected session is not left unprotected.

Direct connection. If you prefer a direct connection instead of the tunnel, allow port 3389 in the VM's network security group from your own public address only, never from the whole internet. For example, run this from your workstation, replacing the example values:

az network nsg rule create --resource-group myResourceGroup --nsg-name my-debian-xfceNSG \
  --name allow-rdp-from-me --priority 1010 --access Allow --protocol Tcp \
  --direction Inbound --destination-port-ranges 3389 --source-address-prefixes <your-public-ip>/32

Open the Applications menu at the top left to see what is installed.

A terminal is in the dock at the bottom, and in Applications under Terminal Emulator. azureuser keeps its Azure administrator rights, so sudo works in the desktop exactly as it does over SSH.

To add software, use apt in the terminal as on any Debian machine, for example sudo apt install libreoffice or sudo apt install firefox-esr.

Settings live in Applications, then Settings, then Settings Manager. Appearance, display, keyboard layout and the panel are all configured there. Your RDP client, not the VM, sets the display resolution of a remote session.

Confirm that SSH is key-only, root is locked, and no account has a password until you set one:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow

Expected output on a new VM. After Step 5, the last line reads 1, which is your own account:

permitrootlogin without-password passwordauthentication no root L 2009-12-22 -1 -1 -1 -1 accounts with a password: 0

without-password is how this OpenSSH release prints prohibit-password, which means root may not authenticate with a password. L means the root account is locked.

cloud-init and systemd-networkd configure the Azure network interface, exactly as on Debian's own cloud image. The XFCE package set does not install NetworkManager, so no second network stack competes for your interface. Check the interface:

networkctl list --no-legend | awk '$2=="eth0"'

Expected output:

2 eth0 ether routable configured

NetworkManager is not installed, so the XFCE settings have no network panel. This is expected. If you want one, install NetworkManager yourself and test the change from the Azure serial console before you reboot.

Stock Debian 13 enables LLMNR in systemd-resolved, which listens on port 5355 on every interface. This image switches it off with a small drop-in file. Check it:

grep -vE '^[[:space:]]*(#|$)' /etc/systemd/resolved.conf.d/20-sac-no-llmnr.conf resolvectl llmnr

Expected output:

[Resolve] LLMNR=no MulticastDNS=no Global: no Link 2 (eth0): no

To turn LLMNR back on, delete that file and run sudo systemctl restart systemd-resolved.

The Azure Network Security Group is the enforced firewall. No host firewall is installed. If you add one, allow SSH first, and allow 3389 only if you connect directly rather than through the tunnel.

To switch remote desktop off again, run the command below yourself. The setting survives reboots.

sudo sac-remote-desktop disable

To change the password that the RDP login box asks for, change your account password. They are the same thing:

sudo passwd azureuser

To replace this VM's TLS certificate with one of your own, write it to /etc/xrdp/cert.pem and /etc/xrdp/key.pem, with the key readable by group xrdp. Then restart the service with sudo systemctl restart xrdp.

The image is fully updated at build time. Refresh the package lists and confirm that no upgrades are pending. grep -c exits non-zero on a zero count, hence the || true:

sudo apt-get update -qq echo "pending upgrades: $(apt-get -s dist-upgrade | grep -c '^Inst ' || true)"

Expected output on a freshly built image:

pending upgrades: 0

unattended-upgrades installs Debian security updates automatically. You can still update on your own schedule with sudo apt-get update && sudo apt-get -y dist-upgrade, and reboot if a new kernel was installed. Debian publishes point releases every couple of months, so after a while this count is above zero until you upgrade.