openSUSE Leap 16 Gui

Option A: Azure Portal

• Go to the Azure Marketplace and search for "openSUSE Leap 16.0 with GNOME Desktop SecureAnyCloud".
• Select the image and choose Create.
• Configure the basics:
• Subscription: select your Azure subscription.
• Resource Group: create a new one or select an existing one.
• Virtual Machine Name: enter a name for your VM.
• Region: select your preferred Azure region.
• Size: Standard_B2ms or larger.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22) only. You do not need to open port 3389, because the recommended way to reach the desktop is through an SSH tunnel (Step 6).
• Choose Review + Create, then Create.

Option B: Azure CLI

Run these commands on your own workstation, and substitute your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn sac1647283583153:opensuse-leap-16-gui:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-opensuse-desktop \
  --image sac1647283583153:opensuse-leap-16-gui:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-opensuse-desktop --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, your client is not offering the key that you supplied at create time.

Check four things: the machine is openSUSE Leap 16.0, it boots to the graphical target, the GNOME login screen (GDM) is running, and the desktop packages are installed:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release uname -srm systemctl get-default systemctl is-active gdm.service rpm -q --qf '%{NAME} %{VERSION}\n' gdm gnome-shell mutter gnome-remote-desktop

The expected output is:

VERSION_ID="16.0" PRETTY_NAME="openSUSE Leap 16.0" Linux 6.12.0-160000.37-default x86_64 graphical.target active gdm 48.0+leap gnome-shell 48.4 mutter 48.4 gnome-remote-desktop 48.3

The kernel release number moves forward as openSUSE publishes kernel updates, so yours may be newer.

The desktop comes from the distribution's own pattern, not from a third-party repository:

zypper --non-interactive search --installed-only --type pattern gnome | grep -E '^i' || true echo "packages installed: $(rpm -qa | wc -l)" df -h /

There is no Xorg server in this image. The session is Wayland, and Xwayland runs X applications inside it:

rpm -q xorg-x11-server >/dev/null 2>&1 || echo "(no Xorg server: the desktop is a Wayland session)" rpm -q --qf '%{NAME} %{VERSION}\n' xwayland

A new virtual machine has remote desktop switched off. The helper shows the full status in one command:

sudo sac-remote-desktop status

The helper lives at /usr/local/sbin/sac-remote-desktop. On openSUSE Leap, sudo replaces your PATH with its own secure_path (/usr/sbin:/usr/bin:/sbin:/bin), which does not include /usr/local/sbin. The image therefore also ships /usr/sbin/sac-remote-desktop as a symlink to the helper. The short form sudo sac-remote-desktop status that this guide uses works, and so does the full path.

The expected output on a new VM is shown below. The fingerprint is unique to your machine:

remote desktop service: disabled / inactive RDP backend: disabled listening on 3389: no per-VM RDP credential: generated (/root/sac-remote-desktop-credentials.txt) TLS certificate SHA-256: <the SHA-256 fingerprint of this VM's own certificate> accounts able to log in at the GNOME login screen: none (set one with: sudo passwd <user>)

Confirm the result from the network side as well:

sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort

0.0.0.0:22 [::]:22

SSH on port 22 is the only service listening on the network.

The GNOME login screen asks for your account password, and a new VM has none. Choose your own. Run this command yourself on the VM, and enter the new password twice when prompted:

sudo passwd azureuser

Your SSH access is unaffected. SSH remains key-only, and this does not enable SSH password logins. Now switch remote desktop on:

sudo sac-remote-desktop enable

The expected output is:

remote desktop enabled: listening on port 3389 TLS certificate SHA-256: <the SHA-256 fingerprint of this VM's own certificate> RDP credential: sudo sac-remote-desktop credentials safest route: ssh -L 3389:localhost:3389 <user>@<vm-ip>, then point your RDP client at localhost:3389 note: this image has no host firewall. The SSH tunnel needs no change at all; a DIRECT connection to 3389 needs an Azure NSG rule scoped to your own address.

If no administrator account has a password yet, the helper refuses rather than open a login screen with nothing behind it. It tells you which command to run first:

refusing to enable remote desktop: no administrator account has a password yet, so the GNOME login screen would have nothing to accept. Set your own first:
sudo passwd azureuser

The setting survives reboots. The helper turns on the RDP backend of GNOME Remote Desktop's system configuration and runs systemctl enable --now gnome-remote-desktop.service. It then waits until port 3389 is listening before it reports success.

Now print this VM's RDP credential, which you need in the next step:

sudo sac-remote-desktop credentials

RDP_USERNAME=azureuser RDP_PASSWORD=<24 random characters, generated at this VM's first boot> RDP_PORT=3389 RDP_TLS_SHA256=<SHA-256 fingerprint of this VM's certificate> RDP_TLS_SHA1=<SHA-1 fingerprint of the same certificate, shown as the thumbprint by Windows>

RDP_USERNAME is your own administrator account name, but RDP_PASSWORD is used by your RDP client only: it is not an operating system password and it does not work for SSH.

Port 3389 is not open by default, and the SSH tunnel is the recommended route. It keeps RDP inside your existing SSH connection, so nothing new is exposed to the internet, and it needs no network security group change.

On your own workstation, open the tunnel and leave it running:

ssh -N -L 3389:localhost:3389 azureuser@<vm-ip>

Then point your RDP client at localhost:3389:

• Windows: Remote Desktop Connection (mstsc) or Windows App, computer localhost:3389
• macOS: Windows App, add a PC with the name localhost:3389
• Linux: Remmina (RDP), server localhost:3389, or FreeRDP 3 (xfreerdp on openSUSE and Fedora, xfreerdp3 on Debian and Ubuntu): xfreerdp /v:localhost:3389 /u:azureuser /gfx /bpp:32

When the client asks for credentials, enter RDP_USERNAME and RDP_PASSWORD from Step 5. The client asks before any screen is drawn.

On the first connection, the client shows the server's certificate. It is self-signed and unique to your VM. Compare its fingerprint with RDP_TLS_SHA256 (or RDP_TLS_SHA1, which Windows displays as the thumbprint) before you accept it.

The GNOME login screen then appears. Select your account and enter the password that you set in Step 5. The full desktop session opens.

If you prefer a direct connection instead of the tunnel, allow 3389 in the network security group from your own public address only, never from the whole internet. This image has no host firewall, so the network security group rule is the only change needed:

az network nsg rule create --resource-group myResourceGroup --nsg-name my-opensuse-desktopNSG \
  --name allow-rdp-from-me --priority 1010 --access Allow --protocol Tcp \
  --direction Inbound --destination-port-ranges 3389 --source-address-prefixes <your-public-ip>/32

Open Activities, or press the Super key, to reach the application grid. Files sits in the dock, and the grid holds Text Editor, Settings and Console plus the YaST2, Utilities and System folders, which carry the remaining tools such as System Monitor, Passwords and Keys and YaST Software.

These come from the gnome pattern and the few desktop tools that this image adds. The image deliberately installs the pattern without its optional extras, so there is no web browser, office suite or media player until you add one.

A terminal inside the session behaves exactly as your SSH session does, and your administrator account keeps its sudo rights. To confirm that you are on a Wayland session, run this command in Console inside the desktop:

echo "$XDG_SESSION_TYPE"

To add software, use zypper as on any openSUSE Leap machine, for example sudo zypper install gnome-calculator libreoffice-writer. Then open the application from the grid.

Disconnecting your RDP client leaves the session running on the VM. Connect again and you return to it.

When you have finished, switch remote desktop back off. This closes port 3389 and keeps it closed across reboots:

sudo sac-remote-desktop disable

remote desktop disabled: nothing listening on port 3389

sudo sac-remote-desktop status shows the state at any time, whether the service is on or off.

Confirm that SELinux is enforcing, that SSH is key-only, and that no account has a password until you set one:

getenforce
sudo sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication) '
sudo passwd -S root | awk '{print $1, $2}'
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow

The expected output on a new VM is shown below. After Step 5, the last line reads 1, your own account:

Enforcing passwordauthentication no kbdinteractiveauthentication no root L accounts with a password: 0

L in the second field means the root account is locked. The SSH policy is pinned by a drop-in file that sorts ahead of every other one, so a later package update to the vendor configuration cannot quietly loosen it:

grep -vE '^#' /etc/ssh/sshd_config.d/00-sac-hardening.conf

PermitRootLogin prohibit-password PasswordAuthentication no KbdInteractiveAuthentication no PermitEmptyPasswords no

Every available patch was applied when this image was built, and a daily timer keeps applying patches on your machine. Check the timer:

systemctl is-enabled sac-zypper-patch.timer
systemctl cat sac-zypper-patch.service | grep '^ExecStart='

The expected output is:

enabled ExecStart=/usr/bin/zypper --non-interactive --gpg-auto-import-keys refresh ExecStart=/usr/bin/zypper --non-interactive patch --with-interactive --auto-agree-with-licenses --auto-agree-with-product-licenses --replacefiles

--with-interactive matters. zypper marks every patch that suggests a reboot as interactive, which includes every kernel and systemd security fix. A plain non-interactive zypper patch silently skips those patches, and with the flag the timer applies them too.

The timer never restarts the machine itself, so check whether a restart is owed and pick your own window:

sudo zypper patch-check >/dev/null 2>&1; echo "exit=$? (0 = nothing pending, 100 = patches available, 101 = security patches available)"
sudo zypper needs-rebooting >/dev/null 2>&1; echo "needs-rebooting exit=$? (0 = no reboot needed, 102 = reboot needed)"

You can always patch on your own schedule with sudo zypper patch --with-interactive, and reboot if a new kernel was installed. To opt out of the automatic run, use sudo systemctl disable --now sac-zypper-patch.timer.

The Azure network security group is the only packet filter for this image. There is no host firewall installed:

rpm -q firewalld >/dev/null 2>&1 || echo "(no host firewall installed: the Azure network security group is the packet filter)" nmcli -t -f DEVICE,TYPE,STATE device status | grep '^eth0' for u in rpcbind.socket gnome-remote-desktop.service; do echo "$u: $(systemctl is-enabled "$u" 2>/dev/null || true)"; done

(no host firewall installed: the Azure network security group is the packet filter) eth0:ethernet:connected rpcbind.socket: disabled gnome-remote-desktop.service: disabled

The network stack is NetworkManager, the native openSUSE Leap 16 stack. The Azure agent and cloud-init configure it exactly as on the server image, and the desktop adds no second network stack.

The rpcbind portmapper is installed but left disabled, never masked, so NFSv3 is one command away with sudo systemctl enable --now rpcbind.socket. If you want a host firewall as well, sudo zypper install firewalld adds one. Allow SSH in it before you enable it.

The root file system is Btrfs on the operating system disk, laid out as in openSUSE Leap 16's Azure image, with separate subvolumes for /home, /var, /opt, /root, /srv and /usr/local:

findmnt -no SOURCE,FSTYPE / df -h /