Ubuntu 26.04 Gui

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Ubuntu 26.04 LTS with GNOME Desktop SecureAnyCloud".
• Select the image and choose Create.
• On the basics tab, set Subscription to your Azure subscription and Resource Group to a new or existing group.
• Enter a Virtual Machine Name, select your preferred Region, and set Size to Standard_B2ms or larger.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22) only. You do not need to open port 3389. The recommended way to reach the desktop is through an SSH tunnel (Step 6).
• Choose Review + Create, then Create.

Option B: Azure CLI

SecureAnyCloud images carry a Marketplace purchase plan. Accept its terms once per subscription, then create the VM:

az vm image terms accept --urn sac1647283583153:ubuntu-26-04-gui:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-ubuntu-desktop \
  --image sac1647283583153:ubuntu-26-04-gui:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-ubuntu-desktop --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, your client is not offering the key you supplied at create time.

Check the release, confirm that the machine booted to the graphical target, confirm that the GNOME login screen (GDM) is running, and list the installed desktop packages:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release systemctl get-default systemctl is-active gdm dpkg-query -W -f='${Package} ${Version}\n' ubuntu-desktop-minimal gnome-shell gdm3 gnome-remote-desktop

The output looks like this:

PRETTY_NAME="Ubuntu 26.04.1 LTS" VERSION_ID="26.04" graphical.target active gdm3 50.1-0ubuntu0.1 gnome-remote-desktop 50.2-0ubuntu0.1 gnome-shell 50.1-0ubuntu1.2 ubuntu-desktop-minimal 1.570.3

A new virtual machine has remote desktop switched off. The helper shows the full state:

sudo sac-remote-desktop status
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort

The output looks like this. The certificate fingerprint is unique to your VM:

remote desktop service: disabled / inactive RDP backend: disabled listening on 3389: no per-VM RDP credential: generated (/root/sac-remote-desktop-credentials.txt) TLS certificate SHA-256: 2A:36:FB:5B:62:CC:99:4D:B5:81:D1:A1:3D:F4:AC:F6:46:D0:12:5C:51:EB:21:FA:23:7F:89:DA:ED:D6:CD:BF accounts able to log in at the GNOME login screen: none (set one with:
sudo passwd <user>) 0.0.0.0:22 127.0.0.53%lo:53 127.0.0.54:53 [::]:22

The only listener reachable from outside the machine is SSH on port 22. The two port 53 entries are the local DNS resolver, which is bound to loopback addresses only.

The GNOME login screen asks for your account password, and a new VM has none. Choose your own. Run this command on the VM, and enter the new password twice when prompted:

sudo passwd azureuser

Your SSH access is unaffected. SSH remains key-only. Now switch remote desktop on:

sudo sac-remote-desktop enable

The output looks like this:

remote desktop enabled: listening on port 3389 TLS certificate SHA-256: 2A:36:FB:5B:62:CC:99:4D:B5:81:D1:A1:3D:F4:AC:F6:46:D0:12:5C:51:EB:21:FA:23:7F:89:DA:ED:D6:CD:BF RDP credential:
sudo sac-remote-desktop credentials safest route: ssh -L 3389:localhost:3389 <user>@<vm-ip>, then point your RDP client at localhost:3389

If no administrator account has a password yet, the helper refuses and tells you which command to run first. The setting survives reboots. The helper runs grdctl --system rdp enable and systemctl enable --now gnome-remote-desktop.service.

Print your VM's RDP credential. You need it in the next step:

sudo sac-remote-desktop credentials

The output lists RDP_USERNAME (your admin account name), RDP_PASSWORD (24 random characters generated at first boot), RDP_PORT and the certificate fingerprints. Only your RDP client uses this credential. It is not an operating system password, and it does not work for SSH.

The recommended route keeps port 3389 closed to the internet and carries RDP inside your SSH connection. On your workstation, open a tunnel and leave it running:

ssh -N -L 3389:localhost:3389 azureuser@<vm-ip>

Then point your RDP client at localhost:3389:

• Windows: Remote Desktop Connection (mstsc) or Windows App, computer localhost:3389
• macOS: Windows App, add a PC with the name localhost:3389
• Linux: Remmina (RDP), server localhost:3389, or FreeRDP 3: xfreerdp3 /v:localhost:3389 /u:azureuser /gfx /bpp:32

When the client asks for credentials, enter RDP_USERNAME and RDP_PASSWORD from Step 5. On first connection, the client shows the server's certificate. It is self-signed and unique to your VM. Compare its fingerprint with RDP_TLS_SHA256 before you accept it. You can also use RDP_TLS_SHA1, which Windows displays as the thumbprint.

The GNOME login screen appears:

Select your account and enter the password you set in Step 5. The session is handed over to your own desktop:

The orange indicator in the top bar shows that the session is being viewed remotely. Disconnecting your RDP client leaves the session running. Connect again to return to it.

For a direct connection instead of the tunnel, allow port 3389 in the VM's network security group from your own public address only. Never allow it from the whole internet. For example, run this on your workstation and replace the example values:

az network nsg rule create --resource-group myResourceGroup --nsg-name my-ubuntu-desktopNSG \
  --name allow-rdp-from-me --priority 1010 --access Allow --protocol Tcp \
  --direction Inbound --destination-port-ranges 3389 --source-address-prefixes <your-public-ip>/32

Open Show Apps (at the bottom of the dock, or press Super and A) to see the installed applications:

Press Ctrl, Alt and T to open a terminal. azureuser keeps its Azure administrator rights, so sudo works in the desktop exactly as it does over SSH:

To add software, use apt in the terminal as on any Ubuntu machine, for example sudo apt install libreoffice. To install a web browser, run sudo snap install firefox.

Confirm that SSH is key-only, that root is locked, and that no account has a password until you set one:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow

On a new VM, the output looks like this. After Step 5, the last line reads 1, your own account:

permitrootlogin without-password passwordauthentication no root L 2009-12-22 -1 -1 -1 -1 accounts with a password: 0

without-password is how OpenSSH reports the prohibit-password setting. Root may not authenticate with a password. L means that the root account is locked.

The Azure network interface is configured by cloud-init and systemd-networkd, exactly as on Ubuntu Server:

netplan get network.renderer networkctl list --no-legend | awk '$2=="eth0"'

The output looks like this:

networkd 2 eth0 ether routable configured

Ubuntu's desktop settings package normally hands every interface to NetworkManager, which this image does not install. The image keeps systemd-networkd in charge with /etc/netplan/00-network-manager-all.yaml. Do not delete that file unless you have installed NetworkManager and tested the change from the Azure serial console. Without the file, the VM loses its network connection at the next boot.

For the same reason, the network panel in GNOME Settings is empty. This is expected.

The Azure Network Security Group is the enforced firewall. ufw is installed but inactive, which is the Ubuntu default. If you enable it, allow SSH first (sudo ufw allow OpenSSH). Allow 3389 only if you connect directly instead of through the tunnel.

To switch remote desktop off again, run this command. The setting survives reboots:

sudo sac-remote-desktop disable

To replace the generated RDP credential with one of your own:

sudo grdctl --system rdp set-credentials azureuser '<new-rdp-password>'
sudo systemctl restart gnome-remote-desktop.service

sac-remote-desktop credentials keeps showing the first-boot values. If you change the credential, update or remove /root/sac-remote-desktop-credentials.txt.

The image is fully updated at build time. Confirm that no upgrades are pending. grep -c exits non-zero on a zero count, which is why the command ends with || true:

echo "pending upgrades: $(apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c '^Inst ' || true)"

The output looks like this:

pending upgrades: 0

unattended-upgrades installs security updates automatically. You can still update on your own schedule with sudo apt-get update && sudo apt-get -y dist-upgrade, and reboot if a new kernel was installed.