Operating Systems AWS

Ubuntu 22.04 LTS with GNOME Desktop on AWS User Guide

| Product: Ubuntu 22.04 LTS with GNOME Desktop on AWS

Overview

This image is Ubuntu 22.04 LTS with the GNOME desktop, one software version of the cloudimg Hardened Debian & Linux Desktops AMIs listing on AWS Marketplace. Every desktop in the listing is described at /guides/linux-desktop-aws/.

It is Ubuntu Server 22.04 LTS with Ubuntu's own GNOME 42 desktop added (the ubuntu-desktop-minimal package set from the Ubuntu main archive) and TigerVNC for remote access: you open an SSH tunnel, point a VNC viewer at it, and work in a full GNOME desktop session running on the instance.

VNC ships switched off, and no account has a password. Each instance generates its own VNC password at first boot, readable by root only. You set your own account password over SSH (the desktop's lock screen asks for it), then turn VNC on with one command. The VNC server only ever listens on the instance's loopback address, so it is reached through your SSH connection and never exposed to the network.

Why VNC, and not RDP, on Ubuntu 22.04

  • xrdp on Ubuntu 22.04 is in the community-maintained universe archive, and its security fixes for 22.04 are published only to Ubuntu Pro (ESM). Without a Pro subscription it cannot be kept patched, so this image does not include it.
  • GNOME Remote Desktop 42 can only share a session that is already logged in at the console; remote login through the GNOME login screen arrived in GNOME 46 (Ubuntu 24.04). It is installed because GNOME Settings depends on it, but it is never enabled, and GNOME's screen sharing switches are locked off (see Security posture).
  • TigerVNC (tigervnc-standalone-server, universe) has no fixes that are held back for Ubuntu Pro on 22.04: its released fixes are in the ordinary security archive. The build checks that no installed package has an update that needs Ubuntu Pro.

For RDP to a GNOME login screen, launch the Ubuntu 24.04 LTS GNOME Desktop version from the same listing.

What cloudimg does to the image:

  • A curated GNOME desktop: GDM, GNOME Shell, Files, Terminal, Text Editor (gedit), System Monitor and Settings from the Ubuntu main archive, installed without the extras that open network listeners or carry identity (no NetworkManager, Avahi, printing, Bluetooth, first-login wizard or snap packages).
  • TigerVNC, off until you enable it, localhost only. A mandatory policy file, loaded after any user setting, forces the VNC server to listen on 127.0.0.1 and ::1 only and to accept only password-protected connections. At first boot each instance generates its own VNC password for ubuntu; nothing is shared between two instances and nothing is baked into the image. cloudimg-vnc enable refuses to start a desktop until the account has a password, so the lock screen is never left with nothing behind it.
  • Remediated with the OpenSCAP CIS Level 1 Server profile. The build applies the SCAP Security Guide 0.1.82 profile cis_level1_server with oscap --remediate after the desktop is installed, so its GNOME rules (login banner, no user list, screen lock, no automount) apply to this desktop. It then reboots and runs a scored evaluation; the build fails if fewer than 95% of the scored rules pass. The report ships in the image at /usr/share/doc/cloudimg/cis-l1-report.html. This is a measurement made by open-source tooling, not a certification or accreditation by the benchmark's publisher or any other body, and these images are not CIS Hardened Images.
  • Fully patched at build time, with automatic security updates left on (unattended-upgrades).
  • Key-only SSH as ubuntu. Password login over SSH is off and stays off when you set a desktop password; root login is refused and the root account is locked.
  • IMDSv2 only, the ufw host firewall (inbound SSH only), AppArmor enforcing, chrony on the Amazon Time Sync Service and the AWS Systems Manager agent.

Support window. Ubuntu 22.04 LTS receives free security updates for its main archive until 1 June 2027. Plan a move to Ubuntu 24.04 LTS before then.

Connecting to your instance

Connect over SSH as the default login user for the operating system variant you launched:

Operating system variant SSH login user
Ubuntu 22.04 LTS with GNOME Desktop ubuntu

Launch from AWS Marketplace

  1. Open the listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
  2. Once the subscription is active, choose Launch your software.
  3. Choose Launch from EC2 Console (or One-click launch), then in Version choose Ubuntu 22.04 LTS with GNOME Desktop - YYYY-MM-DD and your Region.
  4. Instance type: m5.large (2 vCPU, 8 GiB) is recommended: the GNOME desktop needs the 8 GiB. For smooth everyday use pick m5.xlarge or larger. There is no GPU requirement; the desktop renders in software.
  5. Key pair: choose your EC2 key pair. It is the only way in.
  6. Security group: allow inbound TCP 22 from your own IP address only. VNC needs no extra port: it travels inside your SSH connection.
  7. Storage: the root volume is 12 GiB gp3 by default. Choose a larger size if you will install applications; cloud-init grows the root filesystem to fill it on first boot.
  8. Leave the metadata settings at their defaults (the image requires IMDSv2), then choose Launch.

Step 1: Connect over SSH and check the desktop

ssh -i ~/.ssh/my-key.pem ubuntu@<public-ip>

ubuntu has passwordless sudo. There is no password on any account. Confirm the release, that the instance booted to the graphical target with the GNOME display manager running, and the installed desktop packages:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release
systemctl get-default
systemctl is-active gdm
dpkg-query -W -f='${Package} ${Version}\n' ubuntu-desktop-minimal gnome-shell gdm3 tigervnc-standalone-server

PRETTY_NAME="Ubuntu 22.04.5 LTS"
VERSION_ID="22.04"
graphical.target
active
gdm3 42.0-1ubuntu7.22.04.4
gnome-shell 42.9-0ubuntu2.3
tigervnc-standalone-server 1.12.0+dfsg-4ubuntu0.22.04.1
ubuntu-desktop-minimal 1.481.5

Step 2: Check that VNC is off

A new instance has VNC switched off. The helper shows the whole picture:

sudo cloudimg-vnc status
sudo ss -tlnH | awk '{print $4}' | sort

VNC policy: localhost only, security types TLSVnc,VncAuth (/etc/tigervnc/vncserver-config-mandatory)
VNC desktops configured: none
listening on VNC ports 5900-5999: none
per-instance VNC password: generated for ubuntu (sudo cloudimg-vnc credentials)
0.0.0.0:22
127.0.0.1:25
127.0.0.53%lo:53
[::1]:25
[::]:22

The only listener reachable from outside the instance is SSH on port 22. The other entries are the local DNS resolver and the local mail transfer agent (port 25, for system mail), bound to loopback addresses only.

The VNC policy that keeps the server on localhost and password-only is a short file. TigerVNC loads it after every user setting, so it cannot be overridden from a user's own configuration:

grep -vE '^[[:space:]]*(#|$)' /etc/tigervnc/vncserver-config-mandatory

$localhost     = "yes";
$SecurityTypes = "TLSVnc,VncAuth";
1;

Step 3: Set your account password

The desktop asks for your account password when the screen locks and when an application needs administrator rights, and a new instance has none. Choose your own. Run this yourself on the instance and enter the new password twice when prompted:

sudo passwd ubuntu

The image's password policy (part of the CIS Level 1 remediation) requires at least 14 characters with upper case, lower case, a digit and a symbol, no more than 3 identical or sequential characters in a row, and no dictionary words. SSH stays key only: the password works inside the desktop and for nothing else over the network.

Step 4: Turn VNC on

sudo cloudimg-vnc enable

Expected output:

VNC desktop for ubuntu enabled on display :1: listening on localhost port 5901 only
from your own machine: ssh -N -L 5901:localhost:5901 ubuntu@<instance-ip>
then point a VNC viewer at localhost:5901 (VNC password: sudo cloudimg-vnc credentials)

If the account has no password yet, the helper refuses and tells you which command to run first. The helper maps display :1 to ubuntu in /etc/tigervnc/vncserver.users, starts tigervncserver@:1.service, waits for the port and checks that it is bound to localhost only; if it is not, it stops the desktop again. The setting survives reboots.

Print your instance's VNC password (you need it in the next step):

sudo cloudimg-vnc credentials

The output lists VNC_USERNAME (ubuntu), VNC_PASSWORD (8 random characters generated at first boot: the VNC password protocol uses only the first 8 characters of any password), VNC_PORT, VNC_LISTEN and VNC_SECURITY_TYPES. The VNC password is used by your VNC viewer only: it is not an operating system password and it does not work for SSH.

Step 5: Connect with your VNC viewer through an SSH tunnel

On your workstation, open a tunnel and leave it running. ServerAliveInterval keeps an idle tunnel open:

ssh -i ~/.ssh/my-key.pem -N -L 5901:localhost:5901 -o ServerAliveInterval=60 ubuntu@<public-ip>

Then point a VNC viewer at localhost:5901 and enter VNC_PASSWORD from Step 4:

  • Windows, macOS and Linux: TigerVNC Viewer, server localhost:5901
  • Linux: Remmina with the VNC plugin, server localhost:5901
  • macOS: the built-in Screen Sharing app also connects to vnc://localhost:5901

TigerVNC Viewer may say the connection is not signed by a known authority. That is expected: the VNC layer uses anonymous TLS, and the whole connection already runs inside your SSH tunnel, which is authenticated by your key.

The session opens straight into your own GNOME desktop as ubuntu, at 1920x1080. Disconnecting the viewer leaves the session running, and connecting again returns to it.

Step 6: Use the desktop

Open Show Applications (bottom of the dock) to see the installed applications. A terminal is one shortcut away (Ctrl, Alt and T). ubuntu keeps its passwordless sudo, so sudo works in the desktop exactly as it does over SSH.

To change the resolution, create ~/.vnc/tigervnc.conf with your own geometry, then restart the desktop with sudo cloudimg-vnc disable and sudo cloudimg-vnc enable:

printf '$geometry = "2560x1440";\n1;\n' > ~/.vnc/tigervnc.conf

The localhost and security type settings cannot be changed this way: the mandatory policy file overrides both.

To add software, use apt in the terminal as on any Ubuntu machine, for example sudo apt install libreoffice. Ubuntu's firefox package installs a snap, and this image ships without snapd: install it with sudo apt install snapd and then sudo snap install firefox, or use Mozilla's own APT repository.

Desktops for more users

Each user gets their own desktop on the next free display (:2 on port 5902, and so on). The user needs an account password and their own VNC password, which they set themselves without sudo:

sudo adduser alice
sudo -iu alice vncpasswd
sudo cloudimg-vnc enable alice

Each user opens their own tunnel to their display's port. GNOME runs one session per user: do not log the same account in twice.

Security posture

Confirm that SSH is key only, root is locked, no account has a password until you set one, and the host firewall admits SSH only. The SSH values shown are the effective ones (sshd -T), not a configuration file:

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|pubkeyauthentication|allowtcpforwarding) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow
sudo ufw status | grep -E '^(Status|22/tcp |5901)' || true

permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
allowtcpforwarding yes
root L 10/14/2026 0 99999 7 -1
accounts with a password: 0
Status: active
22/tcp                     ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)

After Step 3 the third line reads 1 (your own account). root L means the root password is locked. TCP forwarding stays on because the VNC tunnel depends on it.

GNOME's own screen sharing (GNOME Remote Desktop 42, which uses the FreeRDP 2 library) is locked off for every user with a system policy, so it cannot be switched on from GNOME Settings:

gsettings writable org.gnome.desktop.remote-desktop.rdp enable
gsettings writable org.gnome.desktop.remote-desktop.vnc enable

false
false

To allow it anyway, delete /etc/dconf/db/local.d/60-cloudimg-screen-sharing-off and /etc/dconf/db/local.d/locks/60-cloudimg-screen-sharing-off, then run sudo dconf update.

Known issues

  • TigerVNC's built-in X server. The VNC server (Xtigervnc) contains its own copy of the X.Org server code, taken when Ubuntu built the 22.04 package in January 2024. X.Org server fixes published since then are in Ubuntu's xorg-server packages but not in this copy. Those flaws are reached through the X11 protocol, which only programs inside your own desktop session can speak to Xtigervnc (they hold the session's access cookie); VNC viewers cannot. Xtigervnc runs as your own user, not as root, and listens on localhost only.
  • TigerVNC CVE-2026-34352 affects x0vncserver, a different TigerVNC server that this image does not include (tigervnc-scraping-server is not installed).
  • FreeRDP 2. GNOME Remote Desktop 42 depends on the FreeRDP 2 library, which has open security issues on Ubuntu 22.04. It is installed only because GNOME Settings depends on it; the service never runs and its screen sharing switches are locked off (above).

View the compliance report

The evaluation the build ran is in /usr/share/doc/cloudimg/cis-l1-report.html (HTML), cis-l1-arf.xml (machine-readable ARF) and cis-l1-summary.json (counts, pass rate, threshold, SSG version and checksums) in the same directory. The build host's name and addresses are replaced in the shipped copy.

python3 -c "import json; d=json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json')); print(d['profileLabel'], d['ssgVersion'], '-', d['pass'], 'of', d['scored'], 'scored rules pass', '(' + str(d['ratePct']) + '%)', '- waived', d['waived'])"
python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json'))['failingRules']]"

CIS Level 1 Server 0.1.82 - 348 of 353 scored rules pass (98.6%) - waived 6
ensure_root_access_controlled
service_nftables_enabled
set_nftables_loopback_traffic
set_nftables_table
set_ufw_default_rule

What each rule that does not pass means on this image:

  • ensure_root_access_controlled: the Ubuntu 22.04 version of this check passes only when root has a password hash. A root password on the image would be the same secret on every instance, so root has no password at all and is locked instead (sudo passwd -S root shows L, above). Nobody can log in as root; administrators use sudo.
  • service_nftables_enabled, set_nftables_loopback_traffic and set_nftables_table: these belong to the profile's nftables firewall option. The firewall on this image is ufw, and nftables.service is masked so it can never start and flush ufw's rules at boot.
  • set_ufw_default_rule: the benchmark wants outbound traffic denied by default. Outbound traffic is allowed on purpose: a default-deny outbound policy would cut the SSM agent, cloud-init and the instance metadata service off, and stop DNS, NTP and package updates.

Copy the HTML report to your workstation and open it in a browser:

scp -i ~/.ssh/my-key.pem ubuntu@<public-ip>:/usr/share/doc/cloudimg/cis-l1-report.html .

Re-run the same evaluation on your instance at any time (a few minutes; nothing is changed). oscap exits with status 2 when any rule fails; the report is still written:

sudo oscap xccdf eval --tailoring-file /usr/share/doc/cloudimg/cis-l1-tailoring.xml \
  --profile xccdf_co.cloudimg_profile_cis-l1_ec2_single \
  --report ~/cis-l1-rescan.html /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

Waived rules

These rules of the profile are deselected through the tailoring file /usr/share/doc/cloudimg/cis-l1-tailoring.xml and are not scored; the reasons are in /usr/share/doc/cloudimg/cis-l1-waivers.txt. Everything else the profile selects is remediated and scored. The tailoring also selects ufw as the profile's firewall option and chrony as its time service.

Rule Category Why it is waived on EC2
partition_for_tmp single-volume-partitions The image boots from one EBS root volume, so /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home live on the root filesystem.
grub2_password serial-console-and-boot A boot-loader or root password would have to be baked into the image, giving every instance the same credential. Root stays locked and no password exists.
grub2_uefi_password serial-console-and-boot As above, for the UEFI boot loader.
accounts_maximum_age_login_defs key-only-account-aging Password-age defaults apply to every account cloud-init creates at launch. Those accounts are key-only and have no password, so an age limit would expire them and lock the SSH key out. Accounts that do have a password (yours, after Step 3) are still aged.
account_disable_post_pw_expiration key-only-account-aging As above, for the inactivity default.
sshd_limit_user_access ssh-access-list An AllowUsers/AllowGroups list fixed at build time would refuse SSH to accounts you create with cloud-init user-data. SSH is key-only, root login is refused, and your security group restricts the source addresses.

Networking

The EC2 network interface is configured by cloud-init and systemd-networkd, exactly as on Ubuntu Server:

sudo netplan get network.renderer
networkctl list --no-legend

networkd
  1 lo   loopback carrier  unmanaged
  2 ens5 ether    routable configured

Ubuntu's desktop settings package would normally hand every interface to NetworkManager, which this image does not install. The image keeps systemd-networkd in charge with /etc/netplan/00-network-manager-all.yaml. Do not delete that file unless you have installed NetworkManager and tested the change from the EC2 serial console: without it the instance loses its network connection at the next boot. For the same reason the network panel in GNOME Settings is empty; that is expected.

Turn VNC off, or replace the VNC password

To switch your desktop off again (the setting survives reboots):

sudo cloudimg-vnc disable

To replace the generated VNC password with a new random one (it is handed to vncpasswd on standard input, so it never appears in a log or a process list), then print it:

sudo cloudimg-vnc rotate
sudo cloudimg-vnc credentials

You can also choose your own VNC password at any time by running vncpasswd as ubuntu (without sudo); sudo cloudimg-vnc credentials then still shows the generated one, which no longer applies.

Patching

unattended-upgrades installs security updates automatically. To see how many updates are waiting:

echo "pending upgrades: $(apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade 2>/dev/null | grep -c '^Inst ' || true)"

pending upgrades: 0

To install everything now: sudo apt-get update && sudo apt-get -y dist-upgrade, and reboot if /var/run/reboot-required exists. Ubuntu's "new release available" prompt is switched off (Prompt=never in /etc/update-manager/release-upgrades): a release upgrade would replace the image's desktop and remote access set-up, so move to the Ubuntu 24.04 version of this listing deliberately instead.

Troubleshooting

"Connection refused" on localhost:5901

The tunnel is not up, or the desktop is not running. Check sudo cloudimg-vnc status on the instance, and check that the ssh -N -L command on your workstation is still running.

The viewer says "Authentication failure"

The VNC password is wrong: use VNC_PASSWORD from sudo cloudimg-vnc credentials (or the one you set with vncpasswd). Only the first 8 characters of a VNC password count. After several wrong attempts TigerVNC refuses connections from that address for a short time; wait a minute and try again.

Connecting directly to the instance's address on port 5901 does not work

That is the design. The VNC server binds 127.0.0.1 and ::1 only, and the policy that enforces that is loaded after every user setting. Use the SSH tunnel.

The screen is locked and asks for a password

That is your account password, not your VNC password. The screen locks after 15 minutes of inactivity (CIS Level 1). If you have not set an account password, open an SSH session and run sudo passwd ubuntu. After 4 failed attempts the account is locked for 15 minutes; unlock it early with sudo faillock --user ubuntu --reset.

The desktop does not start

cloudimg-vnc enable refuses when the account has no password or the user has no VNC password, and says which. If both are set and it still fails, read sudo journalctl -u tigervncserver@:1 and the log in the user's ~/.vnc/ directory.

Cannot connect via SSH

  1. Check that port 22 is allowed in the security group from your address.
  2. Use the user ubuntu and the key pair you chose at launch. Password login over SSH is disabled by design.
  3. If you removed or edited /etc/netplan/00-network-manager-all.yaml, the instance may have booted without networking: use the EC2 serial console or Session Manager to restore it.

Emergency access

There is no password on any account until you set one. EC2 Serial Console and single-user recovery need a local password: the one you set in Step 3 works for the serial console. Session Manager (SSM) is the other way in if SSH is unavailable.

Support

cloudimg provides 24/7 technical support for this image by email and live chat: support@cloudimg.co.uk.

Ubuntu is free and open source, assembled from thousands of independently packaged components each under its own licence (see /usr/share/doc/<package>/copyright). No subscription or licence key is required; Ubuntu Pro is neither included nor required. Ubuntu is a registered trademark of Canonical Ltd. GNOME is a trademark of the GNOME Foundation. TigerVNC is free software published by the TigerVNC project. CIS and CIS Benchmarks are trademarks of the Center for Internet Security, Inc. The names are used only to identify the software this image contains; cloudimg is not affiliated with or endorsed by Canonical, the GNOME Foundation, the TigerVNC project or CIS.