X2Go Server 4.1.0.6

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened WireGuard VPN & VPN, Proxy and Remote Access AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose X2Go Server 4.1.0.6 on Ubuntu 24.04, then choose your Region.
• Pick an instance type (m5.large is recommended) and your key pair.
• Set up the security group to allow SSH (22) only, from the addresses your users connect from.
• Choose your VPC and a subnet, with a public IP if users connect over the internet. Leave the metadata defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run these commands on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and replace the VPC, subnet, key pair and CIDR range with your own.

SG=$(aws ec2 create-security-group --group-name x2go-server \
  --description "X2Go Server" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-client-cidr>
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=x2go-server}]'

You do not need --metadata-options, because the AMI already requires IMDSv2. First boot takes a few seconds after the instance is running.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

systemctl is-active ssh x2goserver
sudo test -f /var/lib/sac/data/x2go-server-firstboot.done && echo FIRSTBOOT_DONE

active active FIRSTBOOT_DONE

x2go-server-firstboot ran once on the first boot, and x2goserver is the X2Go session housekeeper. Only SSH listens on a network port. The other two entries are Ubuntu's local DNS resolver:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22 127.0.0.53%lo:53 127.0.0.54:53 [::]:22

sudo cat /root/x2go-connection.txt

# X2Go Server on this instance - written on first boot by x2go-server-firstboot.service.
#
# Connect any X2Go client (Windows, macOS, Linux: https://wiki.x2go.org/doku.php/download:start) with:
# Host : <public-ip>
# Login : ubuntu
# SSH port : 22
# Authentication : the EC2 key pair you launched the instance with (Use RSA/DSA key for ssh connection)
# Session type : XFCE
# On the first connection the client shows the server's SSH host key. It must match one of these # fingerprints, minted on this instance at its first boot: # SHA256:<ed25519-fingerprint> (ED25519) # SHA256:<ecdsa-fingerprint> (ECDSA) # SHA256:<rsa-fingerprint> (RSA) # # Extra NON-admin desktop users with their own password:
sudo x2go-add-desktop-user <name>
# Remove one again:
sudo x2go-remove-desktop-user <name>
# Prove the server starts a desktop session:
sudo x2go-session-selftest
# Guide: https://secureanycloud.com/stacks/x2go-server-4-1-0-6/ x2go.host=<public-ip> x2go.port=22 x2go.login=ubuntu x2go.session=XFCE

Your file shows your instance's address and its own three fingerprints. The file holds no password, because there is none to hold.

In the X2Go client, create a new session (Session > New session) with these settings:

• Host: the instance's public IP or DNS name.
• Login: ubuntu.
• SSH port: 22.
• Use RSA/DSA key for ssh connection: your key pair's .pem file. The client accepts the OpenSSH key format.
• Session type: XFCE.
• Connection speed (Connection tab): ADSL or WAN for internet links, LAN inside AWS.

Choose OK, select the session and sign in. On the first connection, the client asks you to trust the server's host key. Compare it with a fingerprint from Step 3 before you accept. A few seconds later, the XFCE desktop opens in a window.

To leave the desktop running and reconnect later, use the client's Suspend button. To end it, use Log Out in the XFCE menu, or the client's Terminate button.

Audio forwarding, printing and folder sharing are not part of this minimal image. The desktop, keyboard, mouse and clipboard work as usual.

sudo x2go-session-selftest

Part A OK: SSH key login as x2go-selftest (the X2Go transport) Part B OK: XFCE session x2go-selftest-50-1793511132_stDxfce4-session_dp24 running on display :50 (x2goagent 4937, xfce4-session 5315, user-1001.slice) Part C OK: instance metadata service refused to the desktop user (control: this administrator session gets HTTP 200) OK: X2Go desktop session established and torn down

The self-test does the following:

• It creates a temporary account (home directory in memory, locked password, one-time SSH key).
• It signs in over SSH to 127.0.0.1 and starts a desktop through X2Go's own session commands.
• It connects the client side of the session through an SSH tunnel.
• It checks that the agent and the XFCE session are running and that the session's display answers.
• It checks that the metadata service is refused to that user while your own administrator session reaches it.
• It removes everything it created.

Your session name, display number and process IDs will differ.

Each person should have their own login. Create a non-administrator desktop user, using lowercase letters, digits, - and _:

sudo x2go-add-desktop-user alice

Created X2Go desktop user 'alice' (not an administrator; no access to the instance metadata service). Its password is in /root/x2go-users/alice.txt (root only):
sudo cat /root/x2go-users/alice.txt Connect an X2Go client to this instance on port 22 as 'alice' with that password, session type XFCE.

Read the password once, give it to the user over a secure channel, and then change or delete the file:

sudo cat /root/x2go-users/alice.txt

x2go.username=alice x2go.password=<24-character random password> x2go.session=XFCE

The user connects with Login alice, Session type XFCE and that password. Leave Use RSA/DSA key empty. The user can change the password with passwd in a terminal on their desktop, and you can reset it with sudo passwd alice.

To remove a user, along with every session, file and setting the tool created, run:

sudo x2go-remove-desktop-user alice

The tool sets up the following, for these reasons:

• /etc/ssh/sshd_config.d/60-x2go-user-alice.conf enables password sign-in for alice only. The ubuntu user and every other account stay key-only.
• /etc/systemd/system/user-<uid>.slice.d/50-sac-imds-deny.conf blocks the instance metadata service for every process alice runs, including the X2Go desktop and SSH port forwards. Without it, any desktop user could read the instance role's temporary AWS credentials.
• alice is added to /etc/cron.deny, because cron jobs would run outside her blocked processes.

Inside an added user's desktop, a request to the metadata service never connects.

If you prefer keys for your users too, add their public keys to /home/<name>/.ssh/authorized_keys and remove the user's 60-x2go-user-<name>.conf file. Then run sudo systemctl reload ssh.

Check the SSH settings in force:

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|x11forwarding|kbdinteractiveauthentication|permittunnel|gatewayports) '

permitrootlogin no passwordauthentication no kbdinteractiveauthentication no x11forwarding no gatewayports no permittunnel no

Check the metadata block on SSH and the session housekeeper:

systemctl show -p IPAddressDeny ssh x2goserver

IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32

systemd may list the three addresses in a different order.

Check the X2Go settings that SecureAnyCloud changed. They keep the NX link on localhost, give the X display no TCP listener, and use notice-level logging so session cookies are never logged:

grep -E '^X2GO_NXOPTIONS|^X2GO_NXAGENT_DEFAULT_OPTIONS' /etc/x2go/x2goagent.options
grep -v '^#' /etc/x2go/x2goserver.conf | grep -A1 '^\[log\]'

X2GO_NXAGENT_DEFAULT_OPTIONS="" X2GO_NXAGENT_DEFAULT_OPTIONS+=" -nolisten tcp" X2GO_NXOPTIONS="loopback=1" [log] loglevel=notice

head -7 /usr/share/doc/sac-x2go-server/BUILD-INFO.txt

sac X2Go Server 4.1.0.6 on Ubuntu 24.04 - build information x2goserver=4.1.0.6-1.1build1 (Ubuntu noble universe) nxagent=2:3.5.99.27-1.1build2 (nx-libs, Ubuntu noble universe) xfce4-session=4.18.3-1build2 xfwm4=4.18.0-1build3 openssh-server=1:9.6p1-3ubuntu13.20 (ssh.socket=enabled ssh.service=disabled, the Ubuntu 24.04 default) package-source=Ubuntu archive (noble, noble-updates, noble-security); no third-party repository or key licences=x2goserver GPL-2.0-or-later; nx-libs GPL-2.0-only + MIT/X11; XFCE GPL-2.0-or-later / LGPL-2.0-or-later

These are the main file locations:

• /root/x2go-connection.txt: this instance's address and SSH host-key fingerprints (written at first boot).
• /root/x2go-users/: the password files of users you added (root only).
• /etc/ssh/sshd_config.d/00-sac.conf: the key-only SSH settings.
• /etc/x2go/: the X2Go Server configuration (x2goserver.conf, x2goagent.options).
• /var/lib/x2go/x2go_sessions: X2Go's session database (SQLite).
• /usr/local/sbin/x2go-*: the self-test and the add and remove desktop-user tools.
• /usr/share/doc/sac-x2go-server/BUILD-INFO.txt: versions, package source, licences and the list of Ubuntu universe packages.

Ubuntu security updates, including X2Go and XFCE, install automatically.

Some Ubuntu universe packages this image needs (X2Go Server, nx-libs and the XFCE desktop) receive certain security fixes only through Ubuntu Pro (ESM). None was outstanding when the image was built. Attach the instance to Ubuntu Pro (sudo pro attach) to receive them. sudo pro security-status --esm-apps shows the current state.

Desktop sessions keep their state in each user's home directory. Back up /home and /root/x2go-users if you rely on them.

• Restrict port 22 in the security group to the networks your users connect from.
• Give every person their own desktop user, and remove users who no longer need access with sudo x2go-remove-desktop-user.
• Do not give desktop users sudo, because an administrator can lift the metadata block.
• Check the SSH host key against /root/x2go-connection.txt on the first connection from each client.
• About the display server: X2Go's agent (nx-libs) is built from an older X.Org X server code base and does not carry the X.Org server fixes published since 2022. On this image the agent runs as the signed-in user, never as root, with no special privileges, and it accepts only that session's own cookie. A flaw in it therefore cannot give a user more than they already have. Run only software you trust inside a desktop session, as you would on any Linux desktop. Ubuntu's fixes for nx-libs install automatically when they are released, and SecureAnyCloud re-checks this version whenever Ubuntu publishes an nx-libs update.