Ubuntu 24.04 GNOME desktop

Connecting to your instance

Connect over SSH as the default login user for the operating system variant you launched.

Operating system variant SSH login user

Ubuntu 24.04 LTS GNOME Desktop ubuntu

Launch from AWS Marketplace

• Open the listing on AWS Marketplace, choose View purchase options, and then choose Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose Launch from EC2 Console (or One-click launch). In Version, choose Ubuntu 24.04 LTS GNOME Desktop - YYYY-MM-DD and your Region.
• Set the instance type. m5.large (2 vCPU, 8 GiB) is recommended, because the GNOME desktop needs the 8 GiB. For smooth everyday use, pick m5.xlarge or larger. There is no GPU requirement, because the desktop renders in software.
• Choose your EC2 key pair. It is the only way in.
• Set the security group to allow inbound TCP 22 from your own IP address only. The listing's default security group also offers TCP 3389 for a direct RDP connection. Restrict that rule to your own address too, or remove it and use the SSH tunnel (Step 5).
• Set the storage. The root volume is 12 GiB gp3 by default. Choose a larger size if you will install applications. cloud-init grows the root filesystem to fill the volume on first boot.
• Leave the metadata settings at their defaults (the image requires IMDSv2), and then choose Launch.

Security posture

Confirm that SSH is key-only, root is locked, no account has a password until you set one, and the host firewall admits SSH only.

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|pubkeyauthentication) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow
sudo ufw status | grep -E '^(Status|22/tcp |3389)' || true

permitrootlogin no pubkeyauthentication yes passwordauthentication no root L 2024-04-23 0 99999 7 -1 accounts with a password: 0 Status: active 22/tcp ALLOW Anywhere 22/tcp (v6) ALLOW Anywhere (v6)

After Step 3, the third line reads 1 (your own account). root L means the root password is locked.

View the compliance report

The evaluation the build ran is in /usr/share/doc/sac/cis-l1-report.html (HTML), cis-l1-arf.xml (machine-readable ARF) and cis-l1-summary.json (counts, pass rate, threshold, SSG version and checksums) in the same directory. The build host's name and addresses are replaced in the shipped copy.

python3 -c "import json; d=json.load(open('/usr/share/doc/sac/cis-l1-summary.json')); print(d['profileLabel'], d['ssgVersion'], '-', d['pass'], 'of', d['scored'], 'scored rules pass', '(' + str(d['ratePct']) + '%)', '- waived', d['waived'])"
python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/sac/cis-l1-summary.json'))['failingRules']]"

CIS Level 1 Server 0.1.82 - 358 of 362 scored rules pass (98.9%) - waived 6 all_apparmor_profiles_in_enforce_complain_mode set_nftables_loopback_traffic set_nftables_table set_ufw_default_rule

The 4 scored rules that do not pass are listed in the summary's failingRules.

• The two nftables rules belong to the profile's nftables firewall option, which this image does not use (ufw is the host firewall).
• set_ufw_default_rule fails because outbound traffic is allowed on purpose. A default-deny outbound policy would cut the SSM agent, cloud-init and the instance metadata service off, and it would stop DNS, NTP and package updates.
• all_apparmor_profiles_in_enforce_complain_mode fails because Ubuntu 24.04 loads about 90 of its own AppArmor profiles in unconfined mode. They exist to grant applications user-namespace access, not to confine them, and the rule counts them as neither enforce nor complain. AppArmor itself is enabled and enforcing its other profiles (sudo aa-status).

Copy the HTML report to your workstation and open it in a browser.

scp -i ~/.ssh/my-key.pem ubuntu@<public-ip>:/usr/share/doc/sac/cis-l1-report.html .

You can re-run the same evaluation on your instance at any time. It takes about 5 to 10 minutes and changes nothing. oscap exits with status 2 when any rule fails, and the report is still written.

sudo oscap xccdf eval --tailoring-file /usr/share/sac/openscap/tailoring.xml \
  --profile xccdf_co.sac_profile_cis-l1_ec2_single \
  --report ~/cis-l1-rescan.html /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

Waived rules

These rules of the profile are deselected through the tailoring file /usr/share/sac/openscap/tailoring.xml and are not scored. The reasons are in /usr/share/doc/sac/cis-l1-waivers.txt. Everything else the profile selects is remediated and scored. The tailoring also selects ufw as the profile's firewall option and chrony as its time service.

Rule Category Why it is waived on EC2

partition_for_tmp single-volume-partitions The image boots from one EBS root volume, so /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home live on the root filesystem.

grub2_password serial-console-and-boot A boot-loader or root password would have to be baked into the image, giving every instance the same credential. Root stays locked and no password exists.

grub2_uefi_password serial-console-and-boot As above, for the UEFI boot loader.

accounts_maximum_age_login_defs key-only-account-aging Password-age defaults apply to every account cloud-init creates at launch. Those accounts are key-only and have no password, so an age limit would expire them and lock the SSH key out. Accounts that do have a password (yours, after Step 3) are still aged.

account_disable_post_pw_expiration key-only-account-aging As above, for the inactivity default.

sshd_limit_user_access ssh-access-list An AllowUsers/AllowGroups list fixed at build time would refuse SSH to accounts you create with cloud-init user-data. SSH is key-only, root login is refused, and your security group restricts the source addresses.

Networking

cloud-init and systemd-networkd configure the EC2 network interface, exactly as on Ubuntu Server.

sudo netplan get network.renderer networkctl list --no-legend

networkd 1 lo loopback carrier unmanaged 2 ens5 ether routable configured

Ubuntu's desktop settings package would normally hand every interface to NetworkManager, which this image does not install. The image keeps systemd-networkd in charge with /etc/netplan/00-network-manager-all.yaml. Do not delete that file unless you have installed NetworkManager and tested the change from the EC2 serial console. Without the file, the instance loses its network connection at the next boot. For the same reason, the network panel in GNOME Settings is empty, which is expected.

Turn remote desktop off, or replace the RDP credential

To switch remote desktop off again, run the following command. The setting survives reboots.

sudo sac-remote-desktop disable

To replace the generated RDP password with a new random one, run the following command, which then prints it. The password is handed to the remote desktop server on standard input, so it never appears in a log or a process list.

sudo sac-remote-desktop rotate
sudo sac-remote-desktop credentials

Patching

unattended-upgrades installs security updates automatically. To see how many updates are waiting, run the following command.

echo "pending upgrades: $(apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade 2>/dev/null | grep -c '^Inst ' || true)"

pending upgrades: 0

To install every pending update now, run sudo apt-get update && sudo apt-get -y dist-upgrade. Reboot if /var/run/reboot-required exists.

Troubleshooting

The RDP client connects, then the screen stays black or disconnects

GNOME Remote Desktop requires the RDP graphics pipeline. Current Windows and macOS clients support it. With FreeRDP, pass /gfx /bpp:32. Without them, the server logs "Client did not advertise support for the Graphics Pipeline" and closes the connection. Check the server side with the following command.

sudo journalctl -u gnome-remote-desktop --no-pager -n 20

The RDP client says the credentials are wrong

The client needs the RDP credential from sudo sac-remote-desktop credentials, not your account password. The account password is only for the GNOME login screen that appears afterwards.

The login screen does not accept my password

The login screen does not list accounts. Type ubuntu (or your account name), and then your password. If the account has no password yet, set it with sudo passwd ubuntu over SSH. After 4 failed attempts, the account is locked for 15 minutes (part of the CIS Level 1 remediation). Unlock it early with sudo faillock --user ubuntu --reset.

Software Updater offers Ubuntu 26.04 LTS

Ubuntu's Software Updater tells desktop users when a newer LTS release is available. This image is Ubuntu 24.04 LTS, which keeps receiving security updates, so you can close the notice. To stop it appearing, set Prompt=never in /etc/update-manager/release-upgrades.

The session locked while I was away

The screen locks after 15 minutes of inactivity (CIS Level 1). Unlock it with your account password.

Cannot connect via SSH

• Check that the security group allows port 22 from your address.
• Use the user ubuntu and the key pair you chose at launch. Password login over SSH is disabled by design.
• If you removed or edited /etc/netplan/00-network-manager-all.yaml, the instance may have booted without networking. Use the EC2 serial console or Session Manager to restore the file.

Emergency access

No account has a password until you set one. EC2 Serial Console and single-user recovery need a local password, and the one you set in Step 3 works for the serial console. Session Manager (SSM) is the other way in if SSH is unavailable.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat: sales@secureanycloud.com.

Ubuntu is free and open source, assembled from thousands of independently packaged components, each under its own license (see /usr/share/doc/<package>/copyright). No subscription or license key is required, and Ubuntu Pro is neither included nor required. Ubuntu is a registered trademark of Canonical Ltd. GNOME is a trademark of the GNOME Foundation. CIS and CIS Benchmarks are trademarks of the Center for Internet Security, Inc. The names are used only to identify the software this image contains; SecureAnyCloud is not affiliated with or endorsed by Canonical, the GNOME Foundation or CIS.

Deploy on AWS

Launch Ubuntu 24.04 LTS GNOME Desktop on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com