Ubuntu 26.04 XFCE

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Ubuntu 26.04 LTS with XFCE Desktop SecureAnyCloud".
• Select the image and click Create.
• On the Basics tab, configure the following:
• Subscription: select your Azure subscription.
• Resource Group: create a new one or select an existing one.
• Virtual Machine Name: enter a name for your VM.
• Region: select your preferred Azure region.
• Size: choose Standard_B2s or larger.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22) only. You do not need to open port 3389, because the recommended way to reach the desktop is through an SSH tunnel (Step 6).
• Click Review + Create, then Create.

Option B: Azure CLI

SecureAnyCloud images carry a Marketplace purchase plan. Accept its terms once per subscription, then create the VM:

az vm image terms accept --urn sac1647283583153:ubuntu-26-04-xfce:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-ubuntu-xfce \
  --image sac1647283583153:ubuntu-26-04-xfce:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-ubuntu-xfce --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check the release and confirm that the machine booted to the graphical target. Also confirm that the LightDM display manager is running and see which desktop packages are installed:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release systemctl get-default systemctl is-active lightdm dpkg-query -W -f='${Package} ${Version}\n' xfce4 xfce4-session lightdm xrdp xorgxrdp

Expected output:

PRETTY_NAME="Ubuntu 26.04.1 LTS" VERSION_ID="26.04" graphical.target active lightdm 1.32.0-6ubuntu4 xfce4 4.20.1 xfce4-session 4.20.4-1 xorgxrdp 1:0.10.2-1build1 xrdp 0.10.1-4.1

A new virtual machine has remote desktop switched off. Run the helper to see the whole picture:

sudo sac-remote-desktop status
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort

Expected output (the certificate fingerprint is unique to your VM):

remote desktop service: disabled / inactive session manager: disabled / inactive listening on 3389: no per-VM TLS certificate: generated (/etc/xrdp/cert.pem) TLS certificate SHA-256: 7C:F6:51:CB:E9:24:50:6F:D5:CB:D5:B6:5D:B9:89:FB:77:E4:F4:8E:9F:B5:A8:83:C9:99:3D:20:FB:6A:47:96 accounts able to log in at the XFCE remote desktop: none (set one with:
sudo passwd <user>) 0.0.0.0:22 127.0.0.53%lo:53 127.0.0.54:53 [::]:22

The only listener reachable from outside the machine is SSH on port 22. The two port 53 entries are the local DNS resolver, bound to loopback addresses only.

The XFCE login box asks for your account password, and a new VM has none. Choose your own. Run this command yourself on the VM, and enter the new password twice when prompted:

sudo passwd azureuser

Your SSH access is unaffected, because SSH remains key-only. Now switch remote desktop on:

sudo sac-remote-desktop enable

Expected output:

remote desktop enabled: listening on port 3389 TLS certificate SHA-256: 7C:F6:51:CB:E9:24:50:6F:D5:CB:D5:B6:5D:B9:89:FB:77:E4:F4:8E:9F:B5:A8:83:C9:99:3D:20:FB:6A:47:96 sign in with your own account name and the password you set with
sudo passwd safest route: ssh -L 3389:localhost:3389 <user>@<vm-ip>, then point your RDP client at localhost:3389

If no administrator account has a password yet, the helper refuses and tells you which command to run first. The setting survives reboots. Under the hood, the helper runs systemctl enable --now xrdp.service, which starts the session manager with it.

Print this VM's connection details:

sudo sac-remote-desktop credentials

The output lists RDP_USERNAME (your admin account name), RDP_PORT and the TLS certificate fingerprints. There is no separate RDP password. RDP_PASSWORD_SOURCE records that the password is your own account password.

The recommended route keeps port 3389 closed to the internet and carries RDP inside your SSH connection. On your workstation, open a tunnel and leave it running:

ssh -N -L 3389:localhost:3389 azureuser@<vm-ip>

Then point your RDP client at localhost:3389:

• Windows: Remote Desktop Connection (mstsc) or Windows App, computer localhost:3389
• macOS: Windows App, add a PC with the name localhost:3389
• Linux: Remmina (RDP), server localhost:3389, or FreeRDP 3: xfreerdp3 /v:localhost:3389 /u:azureuser /gfx /bpp:32

On first connection, the client shows the server's certificate. It is self-signed and unique to your VM. Compare its fingerprint with RDP_TLS_SHA256 before you accept it. Windows displays the SHA-1 value, RDP_TLS_SHA1, as the thumbprint.

The xrdp login box appears. The Session list has one entry, Xorg, which is the one you want.

Enter your account name and the password you set in Step 5. The XFCE desktop appears.

Disconnecting your RDP client leaves the session running on the VM. Connect again with the same account to return to it. xrdp asks for your password every time you connect, so a disconnected session is never left unprotected.

If you prefer a direct connection instead of the tunnel, allow port 3389 in the VM's network security group from your own public address only, never from the whole internet. For example, run this from your workstation and replace the example resource group and VM names with your own:

az network nsg rule create --resource-group myResourceGroup --nsg-name my-ubuntu-xfceNSG \
  --name allow-rdp-from-me --priority 1010 --access Allow --protocol Tcp \
  --direction Inbound --destination-port-ranges 3389 --source-address-prefixes <your-public-ip>/32

Open the Applications menu at the top left to see what is installed.

A terminal is in the dock at the bottom, and in Applications under Terminal Emulator. azureuser keeps its Azure administrator rights, so sudo works in the desktop exactly as it does over SSH.

To add software, use apt in the terminal as on any Ubuntu machine, for example sudo apt install libreoffice. For a web browser, run sudo apt install firefox-esr or sudo snap install firefox.

Open Applications, then Settings, then Settings Manager to configure appearance, display resolution, keyboard layout and the panel. Your RDP client sets the display resolution of a remote session, not the VM.

Confirm that SSH is key-only, root is locked, and no account has a password until you set one:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow

Expected output on a new VM (after Step 5 the last line reads 1, your own account):

permitrootlogin prohibit-password passwordauthentication no root L 2009-12-22 -1 -1 -1 -1 accounts with a password: 0

prohibit-password means root may not authenticate with a password. L means the root account is locked. Older OpenSSH releases print the same setting as without-password.

The Azure network interface is configured by cloud-init and systemd-networkd, exactly as on Ubuntu Server. Unlike a GNOME desktop image, the XFCE package set does not try to hand your interface to NetworkManager, so no override file is needed and none is shipped. Check the interface:

networkctl list --no-legend | awk '$2=="eth0"'

Expected output:

2 eth0 ether routable configured

NetworkManager is not installed, so there is no network panel in the XFCE settings. This is expected. If you want one, install NetworkManager yourself and test the change from the Azure serial console before you reboot.

The Azure Network Security Group is the enforced firewall. ufw is installed but inactive, which is the Ubuntu default. If you enable it, allow SSH first (sudo ufw allow OpenSSH). Allow 3389 only if you connect directly rather than through the tunnel.

To switch remote desktop off again, run this command yourself. The setting survives reboots:

sudo sac-remote-desktop disable

To change the password the RDP login box asks for, change your account password. They are the same thing:

sudo passwd azureuser

To replace this VM's TLS certificate with one of your own, write it to /etc/xrdp/cert.pem and /etc/xrdp/key.pem. The key must be readable by group xrdp. Then restart the service with sudo systemctl restart xrdp.

The image is fully updated at build time. Confirm that no upgrades are pending. The command ends in || true because grep -c exits non-zero on a zero count:

echo "pending upgrades: $(apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c '^Inst ' || true)"

Expected output:

pending upgrades: 0

unattended-upgrades installs security updates automatically. You can still update on your own schedule with sudo apt-get update && sudo apt-get -y dist-upgrade. Reboot if a new kernel was installed. Remember the universe caveat above: updates arrive when the Ubuntu community publishes them.