Ubuntu 24.04 Gui

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Ubuntu 24.04 LTS GNOME Desktop SecureAnyCloud".
• Select the image and click Create.
• On the Basics tab, configure the following:
• Subscription: select your Azure subscription.
• Resource Group: create a new one or select an existing one.
• Virtual Machine Name: enter a name for your VM.
• Region: select your preferred Azure region.
• Size: choose Standard_B2ms or larger.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22) only. You do not need to open port 3389, because the recommended way to reach the desktop is through an SSH tunnel (Step 6).
• Click Review + Create, then Create.

Option B: Azure CLI

SecureAnyCloud images carry a Marketplace purchase plan. Accept its terms once per subscription, then create the VM:

az vm image terms accept --urn sac1647283583153:ubuntu-24-04-gui:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-ubuntu-desktop \
  --image sac1647283583153:ubuntu-24-04-gui:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-ubuntu-desktop --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check the release and confirm that the machine booted to the graphical target. Also confirm that the GNOME login screen (GDM) is running and see which desktop packages are installed:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release systemctl get-default systemctl is-active gdm dpkg-query -W -f='${Package} ${Version}\n' ubuntu-desktop-minimal gnome-shell gdm3 gnome-remote-desktop

Expected output:

PRETTY_NAME="Ubuntu 24.04.5 LTS" VERSION_ID="24.04" graphical.target active gdm3 46.2-1ubuntu1~24.04.9 gnome-remote-desktop 46.3-0ubuntu1.2 gnome-shell 46.0-0ubuntu6~24.04.14 ubuntu-desktop-minimal 1.539.2

A new virtual machine has remote desktop switched off. Run the helper to see the whole picture:

sudo sac-remote-desktop status
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort

Expected output (the certificate fingerprint is unique to your VM):

remote desktop service: disabled / inactive RDP backend: disabled listening on 3389: no per-VM RDP credential: generated (/root/sac-remote-desktop-credentials.txt) TLS certificate SHA-256: 2A:36:FB:5B:62:CC:99:4D:B5:81:D1:A1:3D:F4:AC:F6:46:D0:12:5C:51:EB:21:FA:23:7F:89:DA:ED:D6:CD:BF accounts able to log in at the GNOME login screen: none (set one with:
sudo passwd <user>) 0.0.0.0:22 127.0.0.53%lo:53 127.0.0.54:53 [::]:22

The only listener reachable from outside the machine is SSH on port 22. The two port 53 entries are the local DNS resolver, bound to loopback addresses only.

The GNOME login screen asks for your account password, and a new VM has none. Choose your own. Run this command yourself on the VM, and enter the new password twice when prompted:

sudo passwd azureuser

Your SSH access is unaffected, because SSH remains key-only. Now switch remote desktop on:

sudo sac-remote-desktop enable

Expected output:

remote desktop enabled: listening on port 3389 TLS certificate SHA-256: 2A:36:FB:5B:62:CC:99:4D:B5:81:D1:A1:3D:F4:AC:F6:46:D0:12:5C:51:EB:21:FA:23:7F:89:DA:ED:D6:CD:BF RDP credential:
sudo sac-remote-desktop credentials safest route: ssh -L 3389:localhost:3389 <user>@<vm-ip>, then point your RDP client at localhost:3389

If no administrator account has a password yet, the helper refuses and tells you which command to run first. The setting survives reboots. Under the hood, the helper runs grdctl --system rdp enable and systemctl enable --now gnome-remote-desktop.service.

Print your VM's RDP credential. You need it in the next step:

sudo sac-remote-desktop credentials

The output lists RDP_USERNAME (your admin account name), RDP_PASSWORD (24 random characters generated at first boot), RDP_PORT and the certificate fingerprints. Only your RDP client uses this credential. It is not an operating system password, and it does not work for SSH.

The recommended route keeps port 3389 closed to the internet and carries RDP inside your SSH connection. On your workstation, open a tunnel and leave it running:

ssh -N -L 3389:localhost:3389 azureuser@<vm-ip>

Then point your RDP client at localhost:3389:

• Windows: Remote Desktop Connection (mstsc) or Windows App, computer localhost:3389
• macOS: Windows App, add a PC with the name localhost:3389
• Linux: Remmina (RDP), server localhost:3389, or FreeRDP 3: xfreerdp3 /v:localhost:3389 /u:azureuser /gfx /bpp:32

When the client asks for credentials, enter RDP_USERNAME and RDP_PASSWORD from Step 5.

On first connection, the client shows the server's certificate. It is self-signed and unique to your VM. Compare its fingerprint with RDP_TLS_SHA256 before you accept it. Windows displays the SHA-1 value, RDP_TLS_SHA1, as the thumbprint.

The GNOME login screen appears. Select your account and enter the password you set in Step 5. The session is handed over to your own desktop.

The orange indicator in the top bar shows that the session is being viewed remotely. Disconnecting your RDP client leaves the session running. Connect again to return to it.

If you prefer a direct connection instead of the tunnel, allow port 3389 in the VM's network security group from your own public address only, never from the whole internet. For example, run this from your workstation and replace the example resource group and VM names with your own:

az network nsg rule create --resource-group myResourceGroup --nsg-name my-ubuntu-desktopNSG \
  --name allow-rdp-from-me --priority 1010 --access Allow --protocol Tcp \
  --direction Inbound --destination-port-ranges 3389 --source-address-prefixes <your-public-ip>/32

Open Show Apps at the bottom of the dock, or press Super and A, to see the installed applications.

A terminal is one shortcut away (Ctrl, Alt and T). azureuser keeps its Azure administrator rights, so sudo works in the desktop exactly as it does over SSH.

To add software, use apt in the terminal as on any Ubuntu machine, for example sudo apt install libreoffice. For a web browser, run sudo snap install firefox.

Confirm that SSH is key-only, root is locked, and no account has a password until you set one:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow

Expected output on a new VM (after Step 5 the last line reads 1, your own account):

permitrootlogin without-password passwordauthentication no root L 2009-12-22 -1 -1 -1 -1 accounts with a password: 0

without-password is how OpenSSH reports the prohibit-password setting, which means root may not authenticate with a password. L means the root account is locked.

The Azure network interface is configured by cloud-init and systemd-networkd, exactly as on Ubuntu Server:

netplan get network.renderer networkctl list --no-legend | awk '$2=="eth0"'

Expected output:

networkd 2 eth0 ether routable configured

Ubuntu's desktop settings package would normally hand every interface to NetworkManager, which this image does not install. The image keeps systemd-networkd in charge with /etc/netplan/00-network-manager-all.yaml.

Do not delete that file unless you have installed NetworkManager and tested the change from the Azure serial console. Without it, the VM loses its network connection at the next boot. For the same reason, the network panel in GNOME Settings is empty. This is expected.

The Azure Network Security Group is the enforced firewall. ufw is installed but inactive, which is the Ubuntu default. If you enable it, allow SSH first (sudo ufw allow OpenSSH). Allow 3389 only if you connect directly rather than through the tunnel.

To switch remote desktop off again, run this command yourself. The setting survives reboots:

sudo sac-remote-desktop disable

To replace the generated RDP credential with one of your own:

sudo grdctl --system rdp set-credentials azureuser '<new-rdp-password>'
sudo systemctl restart gnome-remote-desktop.service

sac-remote-desktop credentials keeps showing the first-boot values, so update or remove /root/sac-remote-desktop-credentials.txt if you change the credential.

The image is fully updated at build time. Confirm that no upgrades are pending. The command ends in || true because grep -c exits non-zero on a zero count:

echo "pending upgrades: $(apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c '^Inst ' || true)"

Expected output:

pending upgrades: 0

unattended-upgrades installs security updates automatically. You can still update on your own schedule with sudo apt-get update && sudo apt-get -y dist-upgrade. Reboot if a new kernel was installed.