X2Go Server

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for X2Go Server by SecureAnyCloud. Select the listing and choose Create.

On the Basics tab, pick your subscription, resource group, region and VM size (Standard_B2s or larger). Under Administrator account, select SSH public key (recommended) or Password, and set the username. You log in to the desktop with this account.

Under Inbound port rules, allow SSH (22). Choose Review + create, then choose Create. First-boot initialisation completes within a few seconds of the VM reaching the Running state.

This command creates a VM from the SecureAnyCloud X2Go Server image in an existing VNet and subnet. Replace each value in angle brackets with your own.

az vm create \
  --resource-group <your-rg> \
  --name x2go-server \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Open inbound SSH (port 22) on the VM's network security group. Restrict it to the networks your users connect from.

Connect to the VM as the administrator with the credential you chose at deployment:

ssh azureuser@<your-vm-public-ip>

The login banner summarises how to connect a desktop client. The server address recorded at first boot is in a file that only root can read:

sudo cat /root/x2go-connection.txt

Install X2Go Client on your own computer, then create a new session with these settings:

Session name : my-cloud-desktop Host : <your-vm-public-ip> Login : azureuser SSH port : 22 Session type : XFCE

Use the administrator username you set when you deployed the VM. If you deployed with an SSH key, select Use RSA/DSA key for ssh connection in the session settings and choose your private key file. If you deployed with a password, enter it when prompted.

A full XFCE desktop opens in the X2Go window. You can suspend the session and resume it later, from the same or a different machine, without losing your running applications.

The image ships with a built-in self-test. It creates a temporary account with a one-time SSH key, logs in over SSH the way an X2Go client does, starts a real XFCE session and then deletes the temporary account. Run it as root:

sudo x2go-session-selftest

Expected output:

Part A OK: SSH login works (the X2Go transport) Part B OK: XFCE desktop session 'x2go-selftest-50-...' running on display :50 OK: X2Go desktop session established and torn down

To list your own active X2Go sessions at any time, run the command below. A session in state R is running:

x2golistsessions

To give another person their own non-administrator desktop with a password, run:

sudo x2go-add-desktop-user alice

The command creates the user alice without sudo rights. It generates a strong password on your VM, prints it once and saves it to /root/x2go-users/alice.txt (readable by root only). It also enables SSH password login for that one user through a drop-in file, /etc/ssh/sshd_config.d/60-x2go-user-alice.conf. Every other account is unchanged.

The user then connects an X2Go client with alice and that password, using session type XFCE. To set a password of your own choosing later, run:

sudo passwd alice

To remove the user again:

sudo userdel -r alice
sudo rm /etc/ssh/sshd_config.d/60-x2go-user-alice.conf /root/x2go-users/alice.txt
sudo systemctl reload ssh

Each concurrent desktop session uses additional memory, so size the VM for the number of simultaneous users you expect.

The image contains no login account other than the administrator you create at deployment, and no password. SSH password authentication is off by default (PasswordAuthentication no). Azure turns it on for the administrator only if you choose a password at deployment. Extra desktop users get password login only when you create them with x2go-add-desktop-user. To check the effective setting for any user, run:

sudo sshd -T -C user=azureuser | grep -i passwordauthentication

Expected output for a VM deployed with an SSH key:

passwordauthentication no

The server does not run a PulseAudio sound daemon. X2Go clients can forward sound from the remote session to your computer's own PulseAudio server. To use it, enable Sound support in the client session settings.

The X2Go server, the XFCE desktop and the session housekeeping daemon are all installed and enabled. To review versions and service state at any time, run:

dpkg-query -W -f='${Package} ${Version}\n' x2goserver xfce4-session xfce4-terminal systemctl is-active ssh x2goserver x2go-server-firstboot

Expected output:

x2goserver 4.1.0.6-1.1build1 xfce4-session 4.18.3-1build2 xfce4-terminal 1.1.3-1build1 active active active