Debian 13 with KDE Plasma desktop

Connecting to your instance

Connect over SSH as the default login user for the operating system variant you launched:

• Debian 13 with KDE Plasma Desktop: SSH login user admin

Launch from AWS Marketplace

• Open the listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose Launch from EC2 Console (or One-click launch). In Version, choose Debian 13 with KDE Plasma Desktop - YYYY-MM-DD HH:MM, and select your Region.
• Instance type: m5.large (2 vCPU, 8 GiB) is recommended. Plasma is a full desktop and renders in software, so there is no GPU requirement. Pick m5.xlarge or larger for heavier desktop work.
• Key pair: choose your EC2 key pair. It is the only way in.
• Security group: allow inbound TCP 22 from your own IP address only. The listing's default security group also offers TCP 3389 for a direct RDP connection. Restrict it to your own address too, or remove it and use the SSH tunnel (Step 5).
• Storage: the root volume is 16 GiB gp3 by default. Choose a larger size if you will install applications. cloud-init grows the root filesystem to fill it on first boot.
• Leave the metadata settings at their defaults, because the image requires IMDSv2. Then choose Launch.

Security posture

Confirm that SSH is key-only and forwards no X11 (use the RDP desktop), that root is locked, that no account has a password until you set one, and that the host firewall admits SSH only:

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|pubkeyauthentication|x11forwarding) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow
sudo ufw status | grep -E '^(Status|22/tcp |3389)' || true

permitrootlogin no pubkeyauthentication yes passwordauthentication no x11forwarding no root L 2026-11-03 0 99999 7 -1 accounts with a password: 0 Status: active 22/tcp ALLOW Anywhere 22/tcp (v6) ALLOW Anywhere (v6)

After Step 3, the accounts with a password line reads 1 (your own account). L after root means the root password is locked.

Then confirm the xrdp hardening:

grep -E '^(security_layer|ssl_protocols|rdpsnd)=' /etc/xrdp/xrdp.ini
grep -E '^\[(Xorg|Xvnc|vnc-any|neutrinordp-any)\]' /etc/xrdp/xrdp.ini
grep -E '^AllowRootLogin=' /etc/xrdp/sesman.ini

security_layer=tls ssl_protocols=TLSv1.2, TLSv1.3 rdpsnd=false [Xorg] AllowRootLogin=false

View the compliance report

The evaluation that the build ran after its reboot is in /usr/share/doc/sac/cis-l1-report.html (HTML), cis-l1-arf.xml (machine-readable ARF) and cis-l1-summary.json (counts, pass rate, threshold, SSG version and checksums) in the same directory. The build host's name and addresses are replaced in the shipped copy.

python3 -c "import json; d=json.load(open('/usr/share/doc/sac/cis-l1-summary.json')); print(d['profileLabel'], d['ssgVersion'], '-', d['pass'], 'of', d['scored'], 'scored rules pass', '(' + str(d['ratePct']) + '%)', '- waived', d['waived'])"
python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/sac/cis-l1-summary.json'))['failingRules']]"

CIS Level 1 Server 0.1.82 - 359 of 364 scored rules pass (98.6%) - waived 6 file_groupownerships_var_log file_ownerships_var_log journald_forward_to_syslog service_systemd-journal-upload_enabled systemd_journal_upload_url

The 5 scored rules that do not pass are listed in the summary's failingRules. Four fail, and one (file_ownerships_var_log) reports error. Each is the result of a deliberate choice, and each stays in the score rather than being hidden:

• Log file ownership (file_ownerships_var_log, file_groupownerships_var_log). These checks accept only log files owned by root and a short list of groups. Three services on this image keep their own log files on purpose. Debian's daily AIDE check runs as _aide and rotates /var/log/aide/aide.log itself. xrdp writes /var/log/xrdp.log as its own xrdp account. Debian's SDDM package creates /var/log/sddm.log for the sddm account and group (mode 0640 on this image). Handing those files to root would make the services fail to write their logs.
• journald forwarding (journald_forward_to_syslog). The profile selects both "forward the journal to syslog" and "do not forward the journal to syslog", so one of the pair always fails.
• Remote journal upload (service_systemd-journal-upload_enabled, systemd_journal_upload_url). The benchmark wants the journal sent to a remote log server. The image cannot know yours, and with no address the upload service would fail at every boot, so it is installed but disabled. To use it, set URL= to your collector in /etc/systemd/journal-upload.conf, then run sudo systemctl enable --now systemd-journal-upload.

The profile's GNOME login-screen rules do not apply to this image, because it uses SDDM, not GNOME's display manager. The local display's X server writes its log to /run/sddm/Xorg.0.log rather than /var/log, because Xorg always creates that file world-readable.

Copy the HTML report to your workstation and open it in a browser:

scp -i ~/.ssh/my-key.pem admin@<public-ip>:/usr/share/doc/sac/cis-l1-report.html .

Re-run the same evaluation on your instance at any time. Nothing is changed. oscap exits with status 2 when any rule fails, and the report is still written:

sudo oscap xccdf eval --tailoring-file /usr/share/doc/sac/cis-l1-tailoring.xml \
  --profile xccdf_co.sac_profile_cis-l1_ec2_single \
  --report ~/cis-l1-rescan.html /usr/share/xml/scap/ssg/content/ssg-debian13-ds.xml

Waived rules

The tailoring file /usr/share/doc/sac/cis-l1-tailoring.xml deselects these rules of the profile, so they are not scored. The reasons are in /usr/share/doc/sac/cis-l1-waivers.txt. Everything else the profile selects is remediated and scored. Each entry below gives the rule, its category and why it is waived on EC2:

• partition_for_tmp (single-volume-partitions): the image boots from one EBS root volume, so /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home live on the root filesystem.
• grub2_password (serial-console-and-boot): a boot-loader or root password would have to be baked into the image, giving every instance the same credential. Root stays locked and no password exists.
• grub2_uefi_password (serial-console-and-boot): as above, for the UEFI boot loader.
• accounts_maximum_age_login_defs (key-only-account-aging): password-age defaults apply to every account cloud-init creates at launch. Those accounts are key-only and have no password, so an age limit would expire them and lock the SSH key out. Accounts that do have a password (yours, after Step 3) are still aged.
• account_disable_post_pw_expiration (key-only-account-aging): as above, for the inactivity default.
• sshd_limit_user_access (ssh-access-list): an AllowUsers/AllowGroups list fixed at build time would refuse SSH to accounts you create with cloud-init user-data. SSH is key-only, root login is refused, and your security group restricts the source addresses.

Networking, LLMNR and sleep

The EC2 network interface is configured by cloud-init and systemd-networkd, exactly as on Debian's own AMI. The KDE package set on this image does not install NetworkManager, so no second network stack competes for your interface.

networkctl list --no-legend

1 lo loopback carrier unmanaged 2 ens5 ether routable configured

Because NetworkManager is not installed, Plasma shows no network applet in the system tray. This is expected. If you want one, install NetworkManager and plasma-nm yourself, and test the change from the EC2 serial console before you reboot.

LLMNR and multicast DNS are switched off in systemd-resolved, so the instance does not listen on ports 5355 or 5353.

In-guest sleep is switched off as well. An instance that suspends itself stops answering SSH and RDP while EC2 still shows it as running, so every sleep mode is disabled and Plasma offers no Sleep button. Shut down and restart work normally. Check both:

resolvectl llmnr busctl call org.freedesktop.login1 /org/freedesktop/login1 org.freedesktop.login1.Manager CanSuspend

Global: no Link 2 (ens5): no s "no"

Turn remote desktop off, or change your password

To switch remote desktop off again (the setting survives reboots):

sudo sac-remote-desktop disable

To change the password that the xrdp login box asks for, change your account password. They are the same password.

sudo passwd admin

To use a certificate of your own instead of the generated one, write it to /etc/xrdp/cert.pem and its key to /etc/xrdp/key.pem (owner root, group xrdp, mode 0640) and run sudo systemctl restart xrdp.

Patching

unattended-upgrades installs security updates automatically. The desktop, SDDM and xrdp are included, because they come from the same Debian archive. To see how many updates are waiting:

echo "pending upgrades: $(apt-get -s dist-upgrade 2>/dev/null | grep -c '^Inst ' || true)"

pending upgrades: 0

To install everything now, run sudo apt-get update && sudo apt-get -y dist-upgrade. Reboot if /var/run/reboot-required exists.

Kernel updates arrive through linux-image-amd64, Debian's standard kernel. This image boots it so that the login screen has a display device.

Troubleshooting

The RDP client connects but the screen is black, or the session closes immediately

Check what the session manager recorded, on the instance:

sudo tail -n 30 /var/log/xrdp-sesman.log

A healthy sign-in logs Access permitted for user: admin, then the start of an X server on display 10.

If you see AUTHFAIL: user=admin instead, the password is wrong or the account has none yet. Set it with sudo passwd admin over SSH and try again. The first sign-in to a new account takes longer than later ones while Plasma creates its settings, so give it up to a minute.

I connected a second time and was immediately disconnected

You get one Plasma desktop session per account. If you disconnect and reconnect later, xrdp returns you to the session you left, which is the normal path. A second connection while the first is still attached starts a second Plasma session for the same account, and Plasma does not support two desktop sessions for one user at the same time.

To use two desktops at once, sign in as two different accounts. Create one with sudo adduser <name> and give it a password. To abandon a session you can no longer reach, sign out from inside it, or end it from SSH with sudo pkill -u admin ksmserver. Then connect again.

The client refuses the connection or reports a security negotiation error

This image accepts TLS only. Every current RDP client supports it; very old clients that only offer the legacy RDP security layer are refused. Update your client.

The login box does not accept my password

The username is your Linux account name (admin), not an email address. If the account has no password yet, set it with sudo passwd admin over SSH. After repeated failed attempts, the account is locked for 15 minutes (part of the CIS Level 1 remediation). Unlock it early with sudo faillock --user admin --reset.

I get "connection refused" on localhost:3389

The tunnel is not up, or remote desktop is still off. Check sudo sac-remote-desktop status on the instance, and confirm your ssh -N -L 3389:localhost:3389 command is still running on your workstation.

The desktop feels slow

Plasma renders in software on an instance without a GPU. Move to a larger instance type such as m5.xlarge for heavier work, and use a smaller window or a lower color depth in your RDP client. You can reduce desktop effects in System Settings (search for Desktop Effects).

Cannot connect via SSH

• Check that port 22 is allowed in the security group from your address.
• Use the user admin and the key pair you chose at launch. Password login over SSH is disabled by design.

Emergency access

There is no password on any account until you set one. EC2 Serial Console and single-user recovery need a local password, and the one you set in Step 3 works for the serial console. Session Manager (SSM) is the other way in if SSH is unavailable.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat: sales@secureanycloud.com.

Debian is free and open-source software, assembled from thousands of independently packaged components, each under its own license (see /usr/share/doc/<package>/copyright). KDE Plasma and the KDE applications are free software, mostly under the GPL and LGPL. SDDM is under the GPL. xrdp and xorgxrdp are under the Apache License 2.0. No subscription or license key is required.

"Debian" is a trademark of Software in the Public Interest, Inc. "KDE" and "Plasma" are trademarks of KDE e.V. CIS and CIS Benchmarks are trademarks of the Center for Internet Security, Inc. The names are used only to identify the software this image contains. SecureAnyCloud is not affiliated with or endorsed by the Debian Project, KDE e.V. or CIS.

Deploy on AWS

Launch Debian 13 with KDE Plasma Desktop on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com