SecureAnyCloud
Deployment guide

Ubuntu 26.04 Gui Cinnamon

Overview

This guide shows you how to deploy and configure Ubuntu 26.04 LTS with the Cinnamon desktop on Microsoft Azure. You deploy SecureAnyCloud's pre-configured virtual machine image from the Azure Marketplace.

Ubuntu is a widely used Linux distribution produced by Canonical. Version 26.04 is a long-term support (LTS) release with standard security maintenance to 29 May 2031. This image is Ubuntu Server 26.04 LTS with the Cinnamon 6.4 desktop added and xrdp 0.10 set up as the remote desktop server. You connect with any RDP client, sign in with your own account name and password, and get a full Cinnamon session on the virtual machine.

Cinnamon is a traditional desktop with a single panel along the bottom, an applications menu, a window list, a system tray and a clock. It idles in roughly 740 MB of memory on this build.

A freshly deployed machine exposes nothing but SSH. Remote desktop ships switched off, no account has a password, and nothing listens on the RDP port until you turn it on.

What you get:

  • Ubuntu 26.04 LTS on the Azure kernel, with the Cinnamon 6.4 desktop (Nemo file manager, GNOME Terminal, Text Editor, Calculator, Screenshot, Evince document viewer, Eye of GNOME image viewer and the full Cinnamon System Settings) and the LightDM display manager
  • xrdp 0.10 with xorgxrdp, configured for remote desktop sessions over TLS. The session manager talks to the server over a local UNIX socket, so it adds no network port of its own
  • A per-VM TLS certificate and a per-VM xrdp RSA key, generated at first boot and readable by root only
  • sac-remote-desktop, a small helper that shows the remote desktop state, switches it on and off, and prints your VM's connection details
  • Every available security update applied at build time, with unattended-upgrades armed so the machine keeps patching itself
  • The Azure provisioning path unchanged: cloud-init, the Azure Linux Agent and systemd-networkd, as on Ubuntu Server
  • Gen2 Hyper-V virtual machine support
  • 24/7 SecureAnyCloud support

Not included: a web browser (install one with sudo apt install firefox-esr or sudo snap install firefox), an office suite (sudo apt install libreoffice), printing, Bluetooth and the Avahi service discovery daemon. None of these adds value on a cloud server by default, and several would open network listeners.

Platform: Microsoft Azure (Gen2 Hyper-V, x64) Default user: azureuser Suggested size: Standard_B2ms (2 vCPU, 8 GB)

A note on NetworkManager

Unlike SecureAnyCloud's other Ubuntu desktop images, this one has NetworkManager installed. The Cinnamon desktop depends on it through cinnamon > nm-connection-editor > network-manager, so the desktop cannot be installed without it.

NetworkManager does not manage your network. On this image:

  • systemd-networkd, driven by netplan, owns eth0, as on Ubuntu Server and on every other SecureAnyCloud image.
  • The netplan renderer is pinned to networkd in /etc/netplan/00-sac-renderer.yaml.
  • NetworkManager is pinned to manage no device at all, in /etc/NetworkManager/conf.d/10-sac-unmanaged.conf.

One network stack is in charge, not two. The Cinnamon network applet shows no connections, which is expected and harmless.

Do not delete just one of those two files. To let NetworkManager run the network on this machine, remove /etc/NetworkManager/conf.d/10-sac-unmanaged.conf, set renderer: NetworkManager in /etc/netplan, then run sudo netplan apply. Doing only one of the two can leave the VM unreachable after its next reboot.

A note on package support

The Cinnamon desktop, xrdp, xorgxrdp and LightDM all come from the Ubuntu universe archive. Universe is maintained by the Ubuntu community rather than by Canonical. Canonical's guaranteed security-update commitment for universe packages is available only under an Ubuntu Pro subscription. This image does not include one, and SecureAnyCloud does not hold one on your behalf.

In practice, this image is fully patched from the public Ubuntu archive at the moment it is built, and unattended-upgrades keeps installing whatever the archive publishes. The desktop stack does not carry the same support commitment as packages in Ubuntu's main archive. If your security policy requires a guaranteed fix timeline for every installed package, attach your own Ubuntu Pro subscription to the VM (sudo pro attach <token>) or choose a desktop image built entirely from main.

At build time this image carried no package needing an Ubuntu Pro or ESM-only fix. pro security-status reported zero esm-infra updates, zero esm-apps updates and zero standard security updates. Every universe source package in the desktop was checked individually against Ubuntu's security database for 26.04.

xrdp itself has a number of CVEs that Ubuntu's security team has triaged but not fixed in any archive, on any release. They are the same set carried by SecureAnyCloud's existing Ubuntu 26.04 XFCE image. Remote desktop ships off and is reached over an SSH tunnel by default, so the exposed surface of a machine you have not deliberately opened is SSH only.

Security notes

This image ships with no known credential:

  • No account has a password. The root account is locked, and azureuser is created at first boot with only the SSH key you supply.
  • SSH is key-only (PasswordAuthentication no). Setting an account password for the desktop does not enable password logins over SSH.
  • The remote desktop server is installed but disabled. A new virtual machine listens on SSH port 22 only.
  • At first boot the machine generates its own TLS certificate and key for xrdp, and its own xrdp RSA key. Nothing is shared between machines, and nothing is baked into the image.
  • Remote desktop cannot be switched on until an administrator account has a password, so an RDP login box is never exposed with nothing to protect it.
  • xrdp-sesman is configured to refuse root logins. Every session module except the local Xorg one has been removed from xrdp.ini, so the RDP login box cannot be used to make your VM open outbound connections elsewhere.
  • The machine identity and the SSH host keys are regenerated uniquely on every instance, and AppArmor is enforcing.

There is only one password, and it is yours. Unlike RDP servers that carry a credential of their own, xrdp authenticates you through PAM against your ordinary Linux account. The RDP login box asks for the password you set with sudo passwd. Until you set it, nobody can sign in.

Prerequisites

Before you deploy this image, make sure you have:

  • An active Microsoft Azure subscription
  • An SSH key pair
  • An RDP client: Windows App or Remote Desktop Connection on Windows, Windows App on macOS, or Remmina or FreeRDP on Linux
  • Network access to the VM on port 22
1

Deploy the Virtual Machine

Option A: Azure Portal

  • In the Azure Portal, search the Marketplace for Ubuntu 26.04 LTS with Cinnamon Desktop and select the SecureAnyCloud offer.
  • Click Create.
  • Select your subscription, resource group and region.
  • Enter a virtual machine name.
  • Choose a size. Standard_B2ms (2 vCPU, 8 GB) is the recommended starting point for a desktop session.
  • Set Authentication type to SSH public key, keep the username azureuser, and supply your public key.
  • Under Inbound port rules, allow SSH (22) only. Do not open 3389. The recommended route to the desktop is an SSH tunnel.
  • Click Review + create, then Create.

Option B: Azure CLI

SecureAnyCloud images carry a Marketplace purchase plan. Accept its terms once per subscription, then create the VM and open SSH only:

az vm image terms accept --urn sac1647283583153:ubuntu-26-04-gui-cinnamon:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-ubuntu-cinnamon \
  --image sac1647283583153:ubuntu-26-04-gui-cinnamon:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group myResourceGroup --name my-ubuntu-cinnamon --port 22
2

Connect via SSH

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-ubuntu-cinnamon --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

3

Confirm the release and the desktop

Check the release, confirm the machine booted to the graphical target, confirm the LightDM display manager is running, and list the installed desktop packages:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release systemctl get-default systemctl is-active lightdm dpkg-query -W -f='${Package} ${Version}\n' cinnamon cinnamon-desktop-environment cinnamon-session lightdm xrdp xorgxrdp

Expected output:

PRETTY_NAME="Ubuntu 26.04.1 LTS" VERSION_ID="26.04" graphical.target active cinnamon 6.4.13-2ubuntu0.2 cinnamon-desktop-environment 6.4.2 cinnamon-session 6.4.2-1 lightdm 1.32.0-6ubuntu4 xorgxrdp 1:0.10.2-1build1 xrdp 0.10.1-4.1
4

Check that remote desktop is off

A new virtual machine has remote desktop switched off. The helper shows the full state:

sudo sac-remote-desktop status
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort

Expected output. The certificate fingerprint is unique to your VM:

remote desktop service: disabled / inactive session manager: disabled / inactive listening on 3389: no per-VM TLS certificate: generated (/etc/xrdp/cert.pem) TLS certificate SHA-256: 07:0D:1B:D4:A4:D3:EE:61:E8:6B:F6:B4:F3:FD:82:4C:89:7A:95:5E:D8:73:04:8D:D2:FD:6A:2A:D9:35:A6:5F accounts able to log in at the Cinnamon remote desktop: none (set one with:
sudo passwd <user>) 0.0.0.0:22 127.0.0.53%lo:53 127.0.0.54:53 [::]:22

The only listener reachable from outside the machine is SSH on port 22. The two port 53 entries are the local DNS resolver, bound to loopback addresses only.

5

Confirm which stack owns the network

This image ships NetworkManager because Cinnamon requires it. Confirm that it is not managing anything:

networkctl list | awk 'NR==1 || /eth0/' nmcli -t -f DEVICE,STATE device status netplan get network.renderer

Expected output:

IDX LINK TYPE OPERATIONAL SETUP 2 eth0 ether routable configured eth0:unmanaged lo:unmanaged networkd

eth0 is routable / configured under systemd-networkd, and NetworkManager reports every device as unmanaged.

6

Set your password and turn remote desktop on

The Cinnamon login box asks for your account password, and a new VM has none. Choose your own. Run this command on the VM and enter the new password twice when prompted:

sudo passwd azureuser

Then turn remote desktop on:

sudo sac-remote-desktop enable

Expected output:

remote desktop enabled: listening on port 3389 TLS certificate SHA-256: 07:0D:1B:D4:A4:D3:EE:61:E8:6B:F6:B4:F3:FD:82:4C:89:7A:95:5E:D8:73:04:8D:D2:FD:6A:2A:D9:35:A6:5F sign in with your own account name and the password you set with
sudo passwd safest route: ssh -L 3389:localhost:3389 <user>@<vm-ip>, then point your RDP client at localhost:3389

Setting a password for the desktop does not enable SSH password logins. SSH stays key-only.

7

Connect with your RDP client

The recommended route does not open port 3389 to the internet. From your own machine, open an SSH tunnel:

ssh -N -L 3389:localhost:3389 azureuser@<vm-ip>

Leave the tunnel running and point your RDP client at localhost:3389. At the xrdp login box, enter azureuser and the password you set in Step 6.

To connect directly instead, add an NSG rule for port 3389 scoped to your own address, never to the internet:

az network nsg rule create --resource-group myResourceGroup --nsg-name my-ubuntu-cinnamonNSG \
  --name allow-rdp-from-me --priority 1010 --access Allow --protocol Tcp \
  --direction Inbound --destination-port-ranges 3389 --source-address-prefixes <public-ip>/32
8

Use the desktop

The Cinnamon panel runs along the bottom of the screen:

  • The menu button at the far left opens the applications menu, with a search box and the standard categories.
  • Next to it are quick launchers for Files (Nemo) and Terminal.
  • The middle of the panel is the window list.
  • The right-hand end holds the system tray and the clock.

System Settings (menu > System Settings) is Cinnamon's control center. It covers backgrounds, panel layout, applets, themes, display resolution, keyboard and mouse.

The screen lock is switched off by default on this image. A lock screen that appears while you are away protects nothing extra here, because xrdp authenticates every new connection through PAM against your account password either way. To turn the lock on, run:

gsettings set org.cinnamon.desktop.screensaver lock-enabled true gsettings set org.cinnamon.desktop.session idle-delay 300

Or use System Settings > Screensaver.

9

Verify the security posture

echo "root password state: $(sudo passwd -S root | awk '{print $2}')"
sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin)'
sudo aa-status --enabled && echo "AppArmor: enforcing"

Expected output:

root password state: L permitrootlogin prohibit-password passwordauthentication no AppArmor: enforcing

L means the root password is locked.

10

Check the patch level

echo "pending upgrades: $(sudo apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade 2>/dev/null | grep -cE '^Inst ' || true)"
sudo pro security-status --format=json | python3 -c "import json,sys;s=json.load(sys.stdin)['summary'];print('esm-infra updates:',s['num_esm_infra_updates'],' esm-apps updates:',s['num_esm_apps_updates'],' standard security updates:',s['num_standard_security_updates'])"

Expected output on a freshly deployed VM:

pending upgrades: 0 esm-infra updates: 0 esm-apps updates: 0 standard security updates: 0
11

Turn remote desktop off again

sudo sac-remote-desktop disable

Expected output:

remote desktop disabled: nothing listening on port 3389

To change your desktop password later, run sudo passwd azureuser. To print this VM's connection details at any time, run sudo sac-remote-desktop credentials.

Common Use Cases

  • A Linux desktop in the cloud for developers who want a conventional, menu-driven environment
  • A remote workstation reachable from a laptop or tablet over RDP
  • Browser and GUI application testing on a clean Ubuntu desktop
  • Training and demonstration machines that you create and destroy per session
  • A jump host with a graphical environment for tools that have no command-line equivalent

Troubleshooting

The RDP client connects but the screen is black, or the session closes immediately

Check that a session actually started:

sudo journalctl -u xrdp -u xrdp-sesman --since "-10 min" --no-pager | tail -30

Look for Access permitted for user: followed by session is available on display. If PAM refused you, you will see AUTHFAIL instead. This means the password is wrong or you have not set one yet.

I connected a second time and was immediately disconnected

Cinnamon's session manager allows one session per account. Closing an RDP client does not end the session, so reconnecting reattaches to the session you left. A second, simultaneous connection as the same user is dropped. Disconnect the first client, or log in as a different account.

The RDP login box will not accept my password

Set a password first with sudo passwd azureuser. A new VM has no password on any account by design.

I get "connection refused" on localhost:3389

Your SSH tunnel is not running, or remote desktop is off. Run sudo sac-remote-desktop status on the VM. Also check that the ssh -N -L 3389:localhost:3389 command is still running locally.

The network applet shows no connections

This is expected. See "A note on NetworkManager" above. systemd-networkd owns the NIC on this image, and NetworkManager is configured to manage nothing.

The desktop resolution is wrong

Set the session size in your RDP client before connecting, or use System Settings > Display once you are connected.

Cannot connect via SSH

Confirm the NSG allows port 22 from your address and that you are using the key you supplied at deployment. SSH is key-only on this image.

Azure agent not running

sudo systemctl status walinuxagent

The Azure Linux Agent is installed and enabled on this image and coexists with the desktop. If it is not running, restart it with sudo systemctl restart walinuxagent.

Important Notes

  • Ubuntu 26.04 LTS receives standard security maintenance until 29 May 2031.
  • The Cinnamon desktop, LightDM and xrdp come from the Ubuntu universe archive. See "A note on package support" above.
  • Remote desktop ships disabled. Nothing listens on 3389 until you enable it.
  • There is no default password on this image, and no RDP credential of its own. The only password is the one you set.
  • The per-VM TLS certificate and xrdp RSA key are generated at first boot and are unique to your machine.
  • Do not delete /etc/netplan/00-sac-renderer.yaml or /etc/NetworkManager/conf.d/10-sac-unmanaged.conf unless you are deliberately switching the machine to NetworkManager, and then change both.
  • SecureAnyCloud charges nothing for the software. Azure bills the compute and storage the VM consumes at their normal rates.

Support

SecureAnyCloud provides 24/7 support for this image. Contact sales@secureanycloud.com with your Azure region, VM size and a description of the issue.

Deploy on Azure

Launch Ubuntu 26.04 LTS with Cinnamon Desktop on Azure with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure