Rocky 9 Gui

Option A: Azure Portal

• Open the Azure Marketplace and search for "Rocky Linux 9 with GNOME Desktop SecureAnyCloud".
• Select the image and choose Create.
• On the Basics tab, configure the following:
• Subscription: select your Azure subscription.
• Resource Group: create a new one or select an existing one.
• Virtual Machine Name: enter a name for your VM.
• Region: select your preferred Azure region.
• Size: Standard_B2ms or larger.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22) only. Do not open any VNC port, because you reach the desktop through an SSH tunnel.
• Choose Review + Create, then Create.

Option B: Azure CLI

Run this on your own workstation, substituting your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn sac1647283583153:rocky-9-gui:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-rocky-desktop \
  --image sac1647283583153:rocky-9-gui:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-rocky-desktop --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key that you supplied at create time.

Check that the machine is Rocky Linux 9, that it boots to the graphical target, that the GNOME login screen (GDM) is running with Wayland disabled, and which desktop and VNC packages are installed. Run:

cat /etc/rocky-release uname -srm systemctl get-default systemctl is-active gdm.service grep '^WaylandEnable' /etc/gdm/custom.conf rpm -q --qf '%{NAME} %{VERSION}\n' gdm gnome-shell mutter xorg-x11-server-Xorg tigervnc-server

The expected output is:

Rocky Linux release 9.8 (Blue Onyx) Linux 5.14.0-687.48.1.el9_8.x86_64 x86_64 graphical.target active WaylandEnable=False gdm 40.1 gnome-shell 40.10 mutter 40.9 xorg-x11-server-Xorg 1.20.11 tigervnc-server 1.15.0

The desktop and TigerVNC come from the distribution's own repositories, not from a third-party repository. Confirm this:

dnf group list --installed 2>/dev/null | grep -i 'Server with GUI' || true
dnf repolist echo "packages installed: $(rpm -qa | wc -l)" df -h /

dnf repolist shows exactly appstream, baseos and extras. No EPEL repository is configured.

A new virtual machine has VNC switched off. The helper shows the whole picture in one command:

sudo sac-vnc status

The expected output on a new VM is:

VNC policy: localhost only, security types tlsvnc,vncauth (/etc/tigervnc/vncserver-config-mandatory) xvnc.socket (unauthenticated mode): disabled / inactive VNC desktops configured: none listening on VNC ports 5900-5999: none users with a VNC password set: none (each user runs: vncpasswd)

The helper lives at /usr/local/sbin/sac-vnc. On Rocky Linux, sudo replaces your PATH with its own secure_path, which does not include /usr/local/sbin. The image therefore also ships /usr/sbin/sac-vnc as a symlink, so sudo sac-vnc works as written.

The helper's subcommands are status, enable [<user>], disable [<user>] and details. The <user> argument defaults to your administrator account.

Confirm the policy and the network side as well:

grep -vE '^#|^$' /etc/tigervnc/vncserver-config-mandatory
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort

localhost securitytypes=tlsvnc,vncauth 0.0.0.0:22 [::]:22

SSH on port 22 is the only service listening.

First, set your account password. Run this yourself on the VM and enter the new password twice when prompted:

sudo passwd azureuser

Then set your VNC password. Run vncpasswd as yourself, without sudo, enter the password twice, and answer n to the view-only question:

vncpasswd

Password: Verify: Would you like to enter a view-only password (y/n)? n A view-only password is not used

Only the first 8 characters of a VNC password are used, and vncpasswd stores it in ~/.config/tigervnc/passwd with mode 0600. Your SSH access is unaffected, and SSH remains key-only.

Enable your VNC desktop with the helper:

sudo sac-vnc enable

The expected output is:

VNC desktop for azureuser enabled on display :1: listening on localhost port 5901 only from your own machine: ssh -N -L 5901:localhost:5901 azureuser@<vm-ip> then point a VNC viewer at localhost:5901 and enter azureuser's VNC password

The helper adds :1=azureuser to /etc/tigervnc/vncserver.users, runs systemctl enable --now vncserver@:1.service, waits until port 5901 is listening, and refuses and stops the desktop again if the port is bound anywhere other than localhost. The desktop starts again after a reboot.

If a password is missing, the helper refuses and tells you which one:

refusing to start a VNC desktop for azureuser: the account has no password yet. The GNOME lock screen and administrator prompts inside the desktop ask for it. Set it first:
sudo passwd azureuser

refusing to start a VNC desktop for azureuser: no VNC password is set. As azureuser (without sudo) run: vncpasswd

On your own workstation, open the tunnel and leave it running:

ssh -N -L 5901:localhost:5901 azureuser@<vm-ip>

Then point your VNC viewer at localhost:5901. TigerVNC and RealVNC accept localhost:5901, and some viewers want the display form localhost:1. On macOS, open Screen Sharing and connect to vnc://localhost:5901.

Enter your VNC password, and your GNOME desktop opens.

TigerVNC Viewer marks the password dialog "This connection is not secure". It does so because the server has no certificate for the viewer to verify: TigerVNC's TLSVnc security type uses anonymous TLS. Through the SSH tunnel, the connection is encrypted and SSH authenticates the server, which is why the image only allows VNC over the tunnel.

GNOME opens in the Activities overview. Press Escape for the desktop, or the Super key to return to the overview.

The top-right system menu offers Restart, Power Off and Log Out. Suspend is deliberately absent, because a suspended Azure virtual machine stops answering while Azure still reports it as running.

The application grid holds the applications that come with the Server with GUI group.

A terminal inside the session behaves exactly as your SSH session does, and your administrator account keeps its sudo rights. The session type is X11, and the VNC server listens on the loopback addresses only.

To add software, use dnf as on any Rocky Linux machine, for example sudo dnf install -y libreoffice, then open the application from the grid.

Closing your VNC viewer leaves the session running on the VM. Connect again to return to it.

Each user gets their own display and port. Create the user with a password, have them run vncpasswd, then enable their desktop. The helper assigns the next free display (:2 is port 5902). For example:

sudo useradd -m alice
sudo passwd alice
sudo -u alice -H vncpasswd
sudo sac-vnc enable alice

Once her SSH key is in place, Alice tunnels her own port, for example ssh -N -L 5902:localhost:5902 alice@<vm-ip>.

Disable your VNC desktop with the helper:

sudo sac-vnc disable

VNC desktop for azureuser disabled: display :1 removed, nothing listening on port 5901

This command stops the session, disables vncserver@:1.service and removes the mapping, so nothing listens after a reboot. Run sudo sac-vnc status to see the state at any time.

Confirm that SELinux is enforcing, that SSH is key-only, that no account has a password until you set one, and that guest sleep is disabled:

getenforce
sudo sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication) '
sudo passwd -S root | awk '{print $1, $2}'
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow busctl call org.freedesktop.login1 /org/freedesktop/login1 org.freedesktop.login1.Manager CanSuspend

The expected output on a new VM is shown below. After Step 5, the password count reads 1, your own account.

Enforcing passwordauthentication no kbdinteractiveauthentication no root LK accounts with a password: 0 s "na"

LK means the root account is locked, and na means logind will not suspend the machine. Drop-in files pin both the sleep policy and the SSH policy, so a later package update to the main configuration cannot quietly loosen them:

grep -vE '^#|^$' /etc/systemd/sleep.conf.d/20-sac-no-guest-sleep.conf
grep -vE '^#' /etc/ssh/sshd_config.d/60-sac-hardening.conf

[Sleep] AllowSuspend=no AllowHibernation=no AllowSuspendThenHibernate=no AllowHybridSleep=no PermitRootLogin prohibit-password PasswordAuthentication no KbdInteractiveAuthentication no ChallengeResponseAuthentication no

Every available update was applied when this image was built, and dnf-automatic is armed so that the machine applies security updates on its own schedule. Check its state:

systemctl is-enabled dnf-automatic.timer grep -E '^(upgrade_type|download_updates|apply_updates) ' /etc/dnf/automatic.conf

The expected output is:

enabled upgrade_type = security download_updates = yes apply_updates = yes

You can check two views of what is pending at any time: whether any package update is available, and whether any security advisory applies to an installed package:

dnf -q check-update >/dev/null 2>&1; echo "check-update exit=$? (0 = nothing pending, 100 = updates available)" echo "pending security advisories: $(dnf -q updateinfo list --security --available 2>/dev/null | wc -l)"

Automatic updates never restart the machine for you. After a kernel update, check whether a restart is owed and pick your own window:

dnf needs-restarting -r || true

You can always update on your own schedule with sudo dnf -y upgrade, and reboot if a new kernel was installed. To opt out of the automatic updates entirely, run sudo systemctl disable --now dnf-automatic.timer.

GNOME Software may show "Software Updates Ready to Install" on your first login even when dnf reports nothing pending. That notification comes from the firmware updater (fwupd), not from a package. On Azure, it offers Microsoft's UEFI Secure Boot revocation list (the "dbx") update, published through the Linux Vendor Firmware Service.

It is not an operating system package and it is not part of this image. Whether to apply a firmware variable update to your virtual machine is your decision. Run fwupdmgr get-updates to see exactly what it offers.

The Azure Network Security Group is the enforced firewall for this image. You do not need to open any port for the desktop, because it travels inside SSH.

The Server with GUI group brings several daemons that a cloud server does not need, and the base image had rpcbind listening. They are left installed but disabled, never masked, so the image exposes only port 22 and you can turn any of them back on with a single command. Check their state:

for u in cockpit.socket avahi-daemon.service cups.service bluetooth.service firewalld.service rpcbind.socket xvnc.socket; do echo "$u: $(systemctl is-enabled "$u" 2>/dev/null || true)" done

cockpit.socket: disabled avahi-daemon.service: disabled cups.service: disabled bluetooth.service: disabled firewalld.service: disabled rpcbind.socket: disabled xvnc.socket: disabled

To enable any of them, for example the Cockpit web console, run sudo systemctl enable --now cockpit.socket and open the port in your Network Security Group.

Do not enable xvnc.socket. It serves a login screen over VNC on port 5900 with no VNC password (-SecurityTypes=None).

firewalld is installed but switched off, consistent with the rest of the SecureAnyCloud Rocky Linux family, so your NSG rules take effect exactly as written. If your policy requires a host firewall, enable it yourself and allow SSH through it:

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --reload

The VNC desktop needs no firewalld rule, because the tunnel arrives over SSH. The network stack is NetworkManager, configured by cloud-init exactly as on Rocky Linux Server.