Ubuntu 22.04 Gui

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Ubuntu 22.04 LTS with GNOME Desktop SecureAnyCloud"
• Select the image, then select Create
• Configure the basics:
• Subscription: Select your Azure subscription
• Resource Group: Create new or select existing
• Virtual Machine Name: Enter a name for your VM
• Region: Select your preferred Azure region
• Size: Standard_B2ms or larger
• Under Administrator Account, select SSH public key and enter your key
• Under Inbound Port Rules, allow SSH (port 22) only. Do not open any VNC port: the desktop is reached through an SSH tunnel
• Select Review + Create, then select Create

Option B: Azure CLI

Run these commands on your own workstation, substituting your own resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn sac1647283583153:ubuntu-22-04-gui:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-ubuntu-desktop \
  --image sac1647283583153:ubuntu-22-04-gui:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP address, then connect:

az vm show --resource-group myResourceGroup --name my-ubuntu-desktop --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is offering a different key from the one you supplied at creation time.

Check that the machine runs Ubuntu 22.04 and boots to the graphical target. Also check that the GNOME login screen (GDM) is running with Wayland disabled, and see which desktop and VNC packages are installed:

lsb_release -ds uname -srm systemctl get-default systemctl is-active gdm.service grep '^WaylandEnable' /etc/gdm3/custom.conf dpkg-query -W -f='${Package} ${Version}\n' ubuntu-desktop-minimal gdm3 gnome-shell mutter-common xserver-xorg-core tigervnc-standalone-server

Expected output:

Ubuntu 22.04.5 LTS Linux 6.8.0-1067-azure x86_64 graphical.target active WaylandEnable=false ubuntu-desktop-minimal 1.481.5 gdm3 42.0-1ubuntu7.22.04.4 gnome-shell 42.9-0ubuntu2.3 mutter-common 42.9-0ubuntu9 xserver-xorg-core 2:21.1.4-2ubuntu1.7~22.04.16 tigervnc-standalone-server 1.12.0+dfsg-4ubuntu0.22.04.1

The desktop comes from Ubuntu's main component and TigerVNC from universe, both from Canonical's own archive. Nothing comes from a third-party repository:

echo "packages installed: $(dpkg-query -W -f='${Package}\n' | wc -l)" apt-cache policy ubuntu-desktop-minimal | sed -n '4,6p' apt-cache policy tigervnc-standalone-server | sed -n '4,6p' df -h /

A new virtual machine has VNC switched off. The helper shows the full VNC status with one command:

sudo sac-vnc status

Expected output on a new VM:

VNC policy: localhost only, security types TLSVnc,VncAuth (/etc/tigervnc/vncserver-config-mandatory) VNC desktops configured: none listening on VNC ports 5900-5999: none users with a VNC password set: none (each user runs: vncpasswd)

The helper lives at /usr/local/sbin/sac-vnc, with /usr/sbin/sac-vnc as a symlink so that sudo sac-vnc works whatever sudo's secure_path happens to be. Its subcommands are status, enable [<user>], disable [<user>] and details. The <user> argument defaults to your administrator account.

Also confirm the policy and the network side:

grep -vE '^#|^$' /etc/tigervnc/vncserver-config-mandatory
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort echo "off-box listeners: $(sudo ss -tln | awk '$1=="LISTEN"{print $4}' | grep -vcE '^(127\.|\[::1\])' || true)"

The first-boot details for this VM are readable by root:

sudo sac-vnc details

By design, that file contains no password. TigerVNC has no per-machine server secret, and both of the secrets involved are yours to choose.

Set your account password first. The desktop asks for it when the screen locks and when an application needs administrator rights:

sudo passwd azureuser

Then set your VNC password. Run this without sudo, as your own user, because it writes into your own home directory:

vncpasswd

Answer n when it offers a view-only password, unless you want one. Only the first 8 characters of a VNC password are significant.

Check that the password file was written and is readable only by you. Resolving the path from the first-boot details file works whether you run the command as yourself or with sudo.

VNCUSER="$(sudo awk -F= '/^VNC_USERNAME=/{print $2}' /root/sac-vnc-details.txt)"
sudo ls -l "$(getent passwd "$VNCUSER" | cut -d: -f6)/.vnc/passwd"

Enable the desktop for your user:

sudo sac-vnc enable azureuser

The helper picks the first free display, adds the mapping to /etc/tigervnc/vncserver.users, starts tigervncserver@:1.service, waits for the port, and then checks that the port is bound to localhost only. If it is not, the helper stops the desktop again and tells you.

Expected output:

VNC desktop for azureuser enabled on display :1: listening on localhost port 5901 only from your own machine: ssh -N -L 5901:localhost:5901 azureuser@<vm-ip> then point a VNC viewer at localhost:5901 and enter azureuser's VNC password

Check what is now running:

sudo sac-vnc status
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | grep 5901 || echo "no VNC desktop running"

Run this command on your own workstation, not on the VM. It opens a tunnel and stays in the foreground, so leave it running.

ssh -N -L 5901:localhost:5901 -o ServerAliveInterval=60 azureuser@<vm-ip>

The ServerAliveInterval option matters. Without it, an idle SSH tunnel to an Azure VM is dropped after about four minutes.

Point your VNC viewer at localhost:5901 and enter your VNC password. TigerVNC Viewer warns that the certificate is not signed by a known authority. This warning is expected, because the connection uses anonymous TLS inside a tunnel that your SSH key has already authenticated.

The VNC session logs you straight into GNOME as your own user, at 1920x1080 by default. The dock is on the left, and the Activities overview is in the top-left corner.

To change the resolution, create ~/.vnc/tigervnc.conf with your own geometry and restart the desktop:

mkdir -p ~/.vnc printf '$geometry = "2560x1440";\n1;\n' | tee ~/.vnc/tigervnc.conf

sudo sac-vnc disable azureuser
sudo sac-vnc enable azureuser

You cannot change the localhost and security type settings this way. The mandatory policy file is loaded after your configuration and overrides both.

Each user gets a desktop of their own, on their own display and port. Create the account and give it a password. Let that user set their own VNC password, then enable the desktop:

sudo adduser alice
sudo passwd alice
sudo -u alice -i vncpasswd
sudo sac-vnc enable alice

The user alice gets display :2 on port 5902. Tunnel to that port the same way.

Disable the desktop for your user:

sudo sac-vnc disable azureuser

This command stops the session, removes the mapping and the boot-time enablement, and confirms that nothing is listening on the port any more. Your passwords are untouched, so turning VNC back on takes one command.

SecureAnyCloud runs these checks on every build. Run them yourself on a new machine as well.

No account has a usable password before you set one, and the root account is locked:

sudo awk -F: '{h=$2; sub(/^!+/,"",h); if (h ~ /^\$[0-9a-z]+\$/) print $1}' /etc/shadow | sed 's/^/usable password: /' || true echo "accounts with a usable password: $(sudo awk -F: '{h=$2; sub(/^!+/,"",h); if (h ~ /^\$[0-9a-z]+\$/) print $1}' /etc/shadow | grep -c . || true)"
sudo passwd -S root

SSH is key only:

sudo sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin) '

Nothing but SSH is reachable from off the machine:

echo "off-box TCP ports: $(sudo ss -tln | awk '$1=="LISTEN"{print $4}' | grep -vE '^(127\.[0-9.]+|::1|\[::1\])(%[a-z0-9]+)?:' | sed -E 's/.*:([0-9]+)$/\1/' | sort -un | tr '\n' ' ')"

The screen-scraping server that CVE-2026-34352 concerns is not installed:

echo "tigervnc-scraping-server installed: $(dpkg -s tigervnc-scraping-server >/dev/null 2>&1 && echo yes || echo no)"
echo "x0vncserver present: $([ -e /usr/bin/x0vncserver ] && echo yes || echo no)"

xrdp, whose 22.04 fixes are available only through Ubuntu Pro, is not installed:

echo "xrdp installed: $(dpkg -s xrdp >/dev/null 2>&1 && echo yes || echo no)"

No installed package needs an Ubuntu Pro subscription to stay patched. This is the most important check on a 22.04 image. The command apt list --upgradable does not answer it, because fixes that are available only through Pro never appear there:

sudo pro security-status --format json | python3 -c 'import json,sys; s=json.load(sys.stdin)["summary"]; print("packages needing Ubuntu Pro (esm-infra):", s["num_esm_infra_updates"]); print("packages needing Ubuntu Pro (esm-apps):", s["num_esm_apps_updates"]); print("universe packages installed:", s["num_universe_packages"]); print("main packages installed:", s["num_main_packages"])'

Expected output:

packages needing Ubuntu Pro (esm-infra): 0 packages needing Ubuntu Pro (esm-apps): 0 universe packages installed: 6 main packages installed: 1174

The six universe packages are TigerVNC's three, one Perl module that TigerVNC uses, and two that Ubuntu Server already carried. Everything else, the whole desktop included, comes from main.

The desktop cannot suspend the machine:

busctl call org.freedesktop.login1 /org/freedesktop/login1 org.freedesktop.login1.Manager CanSuspend busctl call org.freedesktop.login1 /org/freedesktop/login1 org.freedesktop.login1.Manager CanPowerOff

CanSuspend answers na and CanPowerOff answers yes.

The machine applies security updates automatically. Confirm that the service and the periodic settings are enabled:

systemctl is-enabled unattended-upgrades.service apt-config dump | grep -E 'APT::Periodic::(Update-Package-Lists|Unattended-Upgrade)'

To check and apply updates by hand:

sudo apt-get update apt list --upgradable 2>/dev/null | tail -n +2 | wc -l

sudo apt-get -y dist-upgrade

A kernel update needs a restart, which ends any VNC session. Check whether a restart is required, restart from SSH, and then start your desktop again:

[ -f /var/run/reboot-required ] && echo "restart required" || echo "no restart required"

Desktop applications you add yourself follow the same route. Firefox is deliberately not preinstalled. On Ubuntu it is a snap, and installing it at build time would bake this machine's snap identity into every copy of the image. Install it on your own machine when you want it:

sudo snap install firefox

The image ships no firewall rules of its own. Your Azure Network Security Group is the boundary, and it should allow port 22 only. Do not open a VNC port: doing so would expose a protocol whose password is truncated to 8 characters.

Printing and network discovery daemons are not installed on this profile, so nothing is listening for them. If you want them, install them in the usual way and remember that they add listening ports. Check their state with:

echo "cups-daemon installed: $(dpkg -s cups-daemon >/dev/null 2>&1 && echo yes || echo no)"
echo "avahi-daemon installed: $(dpkg -s avahi-daemon >/dev/null 2>&1 && echo yes || echo no)"

The network is managed by systemd-networkd, pinned by /etc/netplan/00-network-manager-all.yaml:

netplan get network.renderer networkctl status eth0 | grep -E 'State:|Online state:' || true