Debian 13 Gui

Option A: Azure Portal

• Sign in to the Azure Portal.
• Search the Marketplace for Debian 13 with GNOME Desktop and select the SecureAnyCloud offer.
• Choose Create.
• Select your subscription, resource group and region.
• Enter a name for the virtual machine.
• Choose a size of Standard_B2ms or larger.
• Set the authentication type to SSH public key, with username azureuser and your own public key.
• Under Inbound port rules, allow SSH (22) only. Do not open 3389. The recommended route to the desktop is an SSH tunnel, and remote desktop is switched off on a new machine anyway.
• Select Review + create, and then Create.

Option B: Azure CLI

Run these commands on your own workstation, substituting your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, and then create the machine:

az vm image terms accept --urn sac1647283583153:debian-13-gui:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-debian-13-gui-vm \
  --image sac1647283583153:debian-13-gui:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

ssh azureuser@<your-vm-public-ip>

You do everything in this guide over SSH. You do not need the Azure serial console.

cat /etc/os-release
cat /etc/debian_version uname -r

The output shows Debian GNU/Linux 13 (trixie), a point release of 13.x, and a kernel ending -amd64 (the generic flavour, not -cloud-amd64).

Confirm that the desktop is installed and the machine boots to a graphical login screen:

systemctl get-default
systemctl is-active graphical.target
systemctl is-active gdm.service dpkg-query -W -f='${Package} ${Version}\n' gdm3 gnome-shell gnome-session gnome-remote-desktop nautilus

systemctl get-default should print graphical.target, both is-active checks should print active, and dpkg-query should list GDM, GNOME Shell, GNOME Session, GNOME Remote Desktop and Nautilus at version 48.x.

Check the graphics device that the desktop renders on:

ls -l /dev/dri/

The output shows card0. If that directory is missing, the machine is running the wrong kernel flavour. See Troubleshooting.

sudo sac-remote-desktop status

On a new machine, the output reports the service as disabled / inactive, the RDP backend as disabled, nothing listening on 3389, a per-VM RDP credential that has been generated, and no accounts able to log in at the GNOME login screen.

Confirm that nothing but SSH is listening off-box:

ss -tln

The only non-loopback listener is port 22.

The GNOME login screen asks for your own account password. The image does not ship one, so set it now:

sudo passwd azureuser

This password is used only at the graphical login screen. SSH remains key-only.

Now turn remote desktop on:

sudo sac-remote-desktop enable

The helper refuses to enable remote desktop while no administrator account has a password, so a login screen is never exposed with nothing behind it. Once remote desktop is enabled, the helper reports that port 3389 is listening and prints the TLS certificate fingerprint.

Print this machine's RDP credential:

sudo sac-remote-desktop credentials

The output contains RDP_USERNAME, RDP_PASSWORD, RDP_PORT and the TLS fingerprints. There are two secrets, and they are different:

• The RDP credential above is requested by your RDP client before anything is drawn (Network Level Authentication). It is not an operating system account and cannot be used for SSH.
• The account password you set with sudo passwd is what the GNOME login screen asks for once the session opens.

The recommended route is an SSH tunnel, so port 3389 is never exposed to the internet. On your own workstation, run:

ssh -N -L 3389:localhost:3389 azureuser@<your-vm-public-ip>

Leave that command running, and then point your RDP client at localhost:3389.

• Your client warns about the self-signed certificate. Compare its fingerprint with the RDP_TLS_SHA256 value from Step 5, and then accept it.
• At the first prompt, enter the RDP credential from Step 5.
• When the GNOME login screen appears, select your user and enter the account password you set in Step 5.

If you prefer not to tunnel, add an Azure network security group rule that allows TCP 3389 from your own IP address only (/32). Do not open 3389 to the internet.

You now have a full GNOME 48 session. The Activities overview (top left, or the Super key) gives you the application grid. Files, Terminal, Text Editor, System Monitor and Settings are installed.

The machine has no GPU acceleration, so expect software rendering. For everyday administration, editing and browsing of local files, this is usable at 1280x720 or 1920x1080.

Remote locations in Files

Files can open remote locations over SMB/CIFS (Windows and Samba shares), SFTP, WebDAV, NFS, AFP and FTP. It can also browse Android phones over MTP and iPhones/iPads over AFC, read cameras over PTP, open archives in place, and mount Microsoft OneDrive.

In Files, choose Network in the sidebar. Type an address such as smb://fileserver/share or sftp://host/ into the Server address box at the bottom, and then select Connect. Alternatively, use gio mount from a terminal:

# list the location types this image can mount ls /usr/share/gvfs/mounts/ | sed 's/\.mount$//'

Google Drive is the one exception: it is not available in Files on this image. You can still add a Google account under Settings -> Online Accounts and use it in Calendar and Contacts. The account's page offers only Mail, Calendar and Contacts, with no Files switch. Drive does not appear in the Files sidebar, and google-drive:// locations do not open. (The Connect an Account list still describes Google as "Email, calendar, contacts, files". That is a fixed label in Settings.) Microsoft 365 accounts are unaffected and still offer Files through the OneDrive backend.

This is deliberate. Google Drive support is the only part of GVFS that needs the libgdata library, so this image ships GVFS rebuilt from Debian's own source with that one backend switched off (the same configuration Debian ships on i386). In addition, /etc/goa.conf tells GNOME Online Accounts not to offer Files for Google accounts.

To get Google Drive in Files, switch back to Debian's stock GVFS build, which pulls libgdata back in. Then remove the [google] section from /etc/goa.conf, and sign out and back in. The SecureAnyCloud build carries a higher version number than the archive copy, so a plain apt-get install is a no-op and you must downgrade explicitly:

V="$(apt-cache madison gvfs-backends | awk -F'|' 'NR==1{gsub(/ /,"",$2); print $2}')"
sudo apt-get install --allow-downgrades gvfs=$V gvfs-backends=$V gvfs-common=$V gvfs-daemons=$V gvfs-fuse=$V gvfs-libs=$V
sudo sed -i '/^\[google\]/,/^files=/d' /etc/goa.conf

Debian security updates to GVFS are not blocked. The SecureAnyCloud build is versioned just below Debian's next GVFS update, so when Debian publishes one, the machine moves onto Debian's build. That build brings the Google Drive backend and libgdata back with it.

Confirm that no account carries a password hash other than the one you just set:

sudo awk -F: '($2 ~ /^\$/) {print $1}' /etc/shadow

Only azureuser appears, because you set that password yourself in Step 5.

Confirm that SSH is still key-only:

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin)'

Confirm that the RDP TLS certificate belongs to this machine:

sudo openssl x509 -in /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop/rdp-tls.crt -noout -subject -fingerprint -sha256

The CN is your VM's hostname, not a SecureAnyCloud build machine.

Networking is handled by cloud-init and systemd-networkd, the Azure default. NetworkManager is not installed.

networkctl status resolvectl status

/etc/systemd/resolved.conf.d/20-sac-no-llmnr.conf disables LLMNR. To re-enable it, delete that file and run sudo systemctl restart systemd-resolved.

To switch remote desktop off again and close the port:

sudo sac-remote-desktop disable

To rotate the RDP credential to a new random password:

sudo grdctl --system rdp set-credentials "$(whoami)" "$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | cut -c1-24)" sudo systemctl restart gnome-remote-desktop.service
sudo sac-remote-desktop credentials

sudo apt-get update echo "pending upgrades: $(apt-get -s dist-upgrade | grep -c '^Inst ' || true)" systemctl is-enabled unattended-upgrades.service

The image is patched at build time and ships with unattended-upgrades armed, so the machine keeps applying security updates on its own.