Operating Systems AWS

Ubuntu 24.04 LTS GNOME Desktop on AWS User Guide

| Product: Ubuntu 24.04 LTS GNOME Desktop on AWS

Overview

This image is Ubuntu 24.04 LTS with the GNOME desktop, one software version of the cloudimg Hardened Debian & Linux Desktops AMIs listing on AWS Marketplace. Every desktop in the listing is described at /guides/linux-desktop-aws/.

It is Ubuntu Server 24.04 LTS with Ubuntu's own GNOME 46 desktop added (the ubuntu-desktop-minimal package set from the Ubuntu main archive) and GNOME's own remote desktop server, gnome-remote-desktop, set up for remote login: you connect with any RDP client, see the GNOME login screen, and sign in to a full desktop session running on the instance.

Remote desktop ships switched off, and no account has a password. A desktop login always needs a password, so the image never ships one: you set your own over SSH, then turn remote desktop on with one command. The recommended route is an SSH tunnel, so port 3389 never has to be open to the internet.

What cloudimg does to the image:

  • A curated GNOME desktop: GDM login screen, GNOME Shell, Files, Terminal, Text Editor, System Monitor and Settings from the Ubuntu main archive, installed without the extras that open network listeners or carry identity (no NetworkManager, Avahi, printing, Bluetooth, first-login wizard or snap packages).
  • GNOME Remote Desktop in system mode, off until you enable it. At first boot each instance generates its own RDP credential and its own self-signed TLS certificate, readable by root only. Nothing is shared between two instances and nothing is baked into the image. cloudimg-remote-desktop enable refuses to start until an administrator account has a password, so the login screen is never exposed with nothing behind it.
  • Remediated with the OpenSCAP CIS Level 1 Server profile. The build applies the SCAP Security Guide 0.1.82 profile cis_level1_server with oscap --remediate after the desktop is installed, so its GNOME login screen rules (login banner, no user list, screen lock, no automount) apply to this desktop. It then reboots and runs a scored evaluation; the build fails if fewer than 95% of the scored rules pass. The report ships in the image at /usr/share/doc/cloudimg/cis-l1-report.html. This is a measurement made by open-source tooling, not a certification or accreditation by the benchmark's publisher or any other body, and these images are not CIS Hardened Images.
  • Fully patched at build time, with automatic security updates left on (unattended-upgrades).
  • Key-only SSH as ubuntu. Password login over SSH is off and stays off when you set a desktop password; root login is refused and the root account is locked.
  • IMDSv2 only, the ufw host firewall (inbound SSH only), AppArmor enforcing, chrony on the Amazon Time Sync Service and the AWS Systems Manager agent.

Connecting to your instance

Connect over SSH as the default login user for the operating system variant you launched:

Operating system variant SSH login user
Ubuntu 24.04 LTS GNOME Desktop ubuntu

Launch from AWS Marketplace

  1. Open the listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
  2. Once the subscription is active, choose Launch your software.
  3. Choose Launch from EC2 Console (or One-click launch), then in Version choose Ubuntu 24.04 LTS GNOME Desktop - YYYY-MM-DD and your Region.
  4. Instance type: m5.large (2 vCPU, 8 GiB) is recommended: the GNOME desktop needs the 8 GiB. For smooth everyday use pick m5.xlarge or larger. There is no GPU requirement; the desktop renders in software.
  5. Key pair: choose your EC2 key pair. It is the only way in.
  6. Security group: allow inbound TCP 22 from your own IP address only. The listing's default security group also offers TCP 3389 for a direct RDP connection; restrict it to your own address too, or remove it and use the SSH tunnel (Step 5).
  7. Storage: the root volume is 12 GiB gp3 by default. Choose a larger size if you will install applications; cloud-init grows the root filesystem to fill it on first boot.
  8. Leave the metadata settings at their defaults (the image requires IMDSv2), then choose Launch.

Step 1: Connect over SSH and check the desktop

ssh -i ~/.ssh/my-key.pem ubuntu@<public-ip>

ubuntu has passwordless sudo. There is no password on any account. Confirm the release, that the instance booted to the graphical target with the GNOME login screen (GDM) running, and the installed desktop packages:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release
systemctl get-default
systemctl is-active gdm
dpkg-query -W -f='${Package} ${Version}\n' ubuntu-desktop-minimal gnome-shell gdm3 gnome-remote-desktop

PRETTY_NAME="Ubuntu 24.04.5 LTS"
VERSION_ID="24.04"
graphical.target
active
gdm3 46.2-1ubuntu1~24.04.9
gnome-remote-desktop 46.3-0ubuntu1.2
gnome-shell 46.0-0ubuntu6~24.04.16
ubuntu-desktop-minimal 1.539.2

Step 2: Check that remote desktop is off

A new instance has remote desktop switched off. The helper shows the whole picture:

sudo cloudimg-remote-desktop status
sudo ss -tlnH | awk '{print $4}' | sort

Expected output (the certificate fingerprint is unique to your instance):

remote desktop service: disabled / inactive
RDP backend: disabled
listening on 3389: no
per-instance RDP credential: generated (/root/cloudimg-remote-desktop-credentials.txt)
TLS certificate SHA-256: E3:3D:F6:D4:F6:23:59:6A:99:6E:85:65:B3:C0:11:C5:03:25:F3:58:7C:20:60:94:71:31:93:F7:DB:C0:B8:92
accounts able to log in at the GNOME login screen: none (set one with: sudo passwd <user>)
0.0.0.0:22
127.0.0.1:25
127.0.0.53%lo:53
127.0.0.54:53
[::1]:25
[::]:22

The only listener reachable from outside the instance is SSH on port 22. The other entries are the local DNS resolver and the local mail transfer agent (port 25, for system mail), bound to loopback addresses only.

Step 3: Set your password

The GNOME login screen asks for your account password, and a new instance has none. Choose your own. Run this yourself on the instance and enter the new password twice when prompted:

sudo passwd ubuntu

The image's password policy (part of the CIS Level 1 remediation) requires at least 14 characters with upper case, lower case, a digit and a symbol, no more than 3 identical or sequential characters in a row, and no dictionary words. SSH stays key only: the password works at the GNOME login screen and for nothing else over the network.

Step 4: Turn remote desktop on

sudo cloudimg-remote-desktop enable

Expected output:

remote desktop enabled: listening on port 3389
TLS certificate SHA-256: <your instance's fingerprint>
RDP credential: sudo cloudimg-remote-desktop credentials
recommended route: ssh -N -L 3389:localhost:3389 <user>@<instance-ip>, then point your RDP client at localhost:3389

If no administrator account has a password yet, the helper refuses and tells you which command to run first. The setting survives reboots. Print your instance's RDP credential (you need it in the next step):

sudo cloudimg-remote-desktop credentials

The output lists RDP_USERNAME (ubuntu), RDP_PASSWORD (24 random characters generated at first boot), RDP_PORT and the certificate fingerprints. This credential is used by your RDP client only: it is not an operating system password and it does not work for SSH.

Step 5: Connect with your RDP client

The recommended route keeps port 3389 closed and carries RDP inside your SSH connection (the host firewall already admits it, because the tunnel arrives on the loopback interface). On your workstation, open a tunnel and leave it running:

ssh -i ~/.ssh/my-key.pem -N -L 3389:localhost:3389 ubuntu@<public-ip>

Then point your RDP client at localhost:3389:

  • Windows: Remote Desktop Connection (mstsc) or Windows App, computer localhost:3389
  • macOS: Windows App, add a PC with the name localhost:3389
  • Linux: Remmina (RDP), server localhost:3389, or FreeRDP 3: xfreerdp3 /v:localhost:3389 /u:ubuntu /gfx /bpp:32

When the client asks for credentials, enter RDP_USERNAME and RDP_PASSWORD from Step 4. On first connection the client shows the server's certificate: it is self signed and unique to your instance, so compare its fingerprint with RDP_TLS_SHA256 (or RDP_TLS_SHA1, which Windows shows as the thumbprint) before you accept it.

The GNOME login screen appears with the login banner. It does not list accounts: type ubuntu, press Enter, then enter the password you set in Step 3. The session is handed over to your own desktop. The orange indicator in the top bar shows that the session is viewed remotely; disconnecting your RDP client leaves the session running, and connecting again returns to it.

Direct connection instead of the tunnel. Allow TCP 3389 in the instance's security group from your own public address only, never from the whole internet, and admit the same address in the host firewall on the instance:

sudo ufw allow from <your-public-ip> to any port 3389 proto tcp

Step 6: Use the desktop

Open Show Apps (bottom of the dock, or press Super and A) to see the installed applications. A terminal is one shortcut away (Ctrl, Alt and T). ubuntu keeps its passwordless sudo, so sudo works in the desktop exactly as it does over SSH.

To add software, use apt in the terminal as on any Ubuntu machine, for example sudo apt install libreoffice. Ubuntu's firefox package installs a snap, and this image ships without snapd: install it with sudo apt install snapd and then sudo snap install firefox, or use Mozilla's own APT repository.

Security posture

Confirm that SSH is key only, root is locked, no account has a password until you set one, and the host firewall admits SSH only:

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|pubkeyauthentication) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow
sudo ufw status | grep -E '^(Status|22/tcp |3389)' || true

permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
root L 2024-04-23 0 99999 7 -1
accounts with a password: 0
Status: active
22/tcp                     ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)

After Step 3 the third line reads 1 (your own account). root L means the root password is locked.

View the compliance report

The evaluation the build ran is in /usr/share/doc/cloudimg/cis-l1-report.html (HTML), cis-l1-arf.xml (machine-readable ARF) and cis-l1-summary.json (counts, pass rate, threshold, SSG version and checksums) in the same directory. The build host's name and addresses are replaced in the shipped copy.

python3 -c "import json; d=json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json')); print(d['profileLabel'], d['ssgVersion'], '-', d['pass'], 'of', d['scored'], 'scored rules pass', '(' + str(d['ratePct']) + '%)', '- waived', d['waived'])"
python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json'))['failingRules']]"

CIS Level 1 Server 0.1.82 - 358 of 362 scored rules pass (98.9%) - waived 6
all_apparmor_profiles_in_enforce_complain_mode
set_nftables_loopback_traffic
set_nftables_table
set_ufw_default_rule

The 4 scored rules that do not pass are listed in the summary's failingRules. The two nftables rules belong to the profile's nftables firewall option, which this image does not use (ufw is the host firewall). set_ufw_default_rule fails because outbound traffic is allowed on purpose: a default-deny outbound policy would cut the SSM agent, cloud-init and the instance metadata service off, and stop DNS, NTP and package updates. all_apparmor_profiles_in_enforce_complain_mode fails because Ubuntu 24.04 loads about 90 of its own AppArmor profiles in unconfined mode (they exist to grant applications user-namespace access, not to confine them), which the rule counts as neither enforce nor complain; AppArmor itself is enabled and enforcing its other profiles (sudo aa-status).

Copy the HTML report to your workstation and open it in a browser:

scp -i ~/.ssh/my-key.pem ubuntu@<public-ip>:/usr/share/doc/cloudimg/cis-l1-report.html .

Re-run the same evaluation on your instance at any time (about 5 to 10 minutes; nothing is changed). oscap exits with status 2 when any rule fails; the report is still written:

sudo oscap xccdf eval --tailoring-file /usr/share/cloudimg/openscap/tailoring.xml \
  --profile xccdf_co.cloudimg_profile_cis-l1_ec2_single \
  --report ~/cis-l1-rescan.html /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

Waived rules

These rules of the profile are deselected through the tailoring file /usr/share/cloudimg/openscap/tailoring.xml and are not scored; the reasons are in /usr/share/doc/cloudimg/cis-l1-waivers.txt. Everything else the profile selects is remediated and scored. The tailoring also selects ufw as the profile's firewall option and chrony as its time service.

Rule Category Why it is waived on EC2
partition_for_tmp single-volume-partitions The image boots from one EBS root volume, so /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home live on the root filesystem.
grub2_password serial-console-and-boot A boot-loader or root password would have to be baked into the image, giving every instance the same credential. Root stays locked and no password exists.
grub2_uefi_password serial-console-and-boot As above, for the UEFI boot loader.
accounts_maximum_age_login_defs key-only-account-aging Password-age defaults apply to every account cloud-init creates at launch. Those accounts are key-only and have no password, so an age limit would expire them and lock the SSH key out. Accounts that do have a password (yours, after Step 3) are still aged.
account_disable_post_pw_expiration key-only-account-aging As above, for the inactivity default.
sshd_limit_user_access ssh-access-list An AllowUsers/AllowGroups list fixed at build time would refuse SSH to accounts you create with cloud-init user-data. SSH is key-only, root login is refused, and your security group restricts the source addresses.

Networking

The EC2 network interface is configured by cloud-init and systemd-networkd, exactly as on Ubuntu Server:

sudo netplan get network.renderer
networkctl list --no-legend

networkd
  1 lo   loopback carrier  unmanaged
  2 ens5 ether    routable configured

Ubuntu's desktop settings package would normally hand every interface to NetworkManager, which this image does not install. The image keeps systemd-networkd in charge with /etc/netplan/00-network-manager-all.yaml. Do not delete that file unless you have installed NetworkManager and tested the change from the EC2 serial console: without it the instance loses its network connection at the next boot. For the same reason the network panel in GNOME Settings is empty; that is expected.

Turn remote desktop off, or replace the RDP credential

To switch remote desktop off again (the setting survives reboots):

sudo cloudimg-remote-desktop disable

To replace the generated RDP password with a new random one (it is handed to the remote desktop server on standard input, so it never appears in a log or a process list), then print it:

sudo cloudimg-remote-desktop rotate
sudo cloudimg-remote-desktop credentials

Patching

unattended-upgrades installs security updates automatically. To see how many updates are waiting:

echo "pending upgrades: $(apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade 2>/dev/null | grep -c '^Inst ' || true)"

pending upgrades: 0

To install everything now: sudo apt-get update && sudo apt-get -y dist-upgrade, and reboot if /var/run/reboot-required exists.

Troubleshooting

The RDP client connects, then the screen stays black or disconnects

GNOME Remote Desktop requires the RDP graphics pipeline. Current Windows and macOS clients support it. With FreeRDP pass /gfx /bpp:32; without them the server logs "Client did not advertise support for the Graphics Pipeline" and closes the connection. Check the server side with:

sudo journalctl -u gnome-remote-desktop --no-pager -n 20

The RDP client says the credentials are wrong

The client wants the RDP credential from sudo cloudimg-remote-desktop credentials, not your account password. The account password is only for the GNOME login screen that appears afterwards.

The login screen does not accept my password

The login screen does not list accounts: type ubuntu (or your account name), then your password. If the account has no password yet, set it with sudo passwd ubuntu over SSH. After 4 failed attempts the account is locked for 15 minutes (part of the CIS Level 1 remediation); unlock it early with sudo faillock --user ubuntu --reset.

Software Updater offers Ubuntu 26.04 LTS

Ubuntu's Software Updater tells desktop users when a newer LTS release is available. This image is Ubuntu 24.04 LTS, which keeps receiving security updates; you can close the notice. To stop it appearing, set Prompt=never in /etc/update-manager/release-upgrades.

The session locked while I was away

The screen locks after 15 minutes of inactivity (CIS Level 1). Unlock it with your account password.

Cannot connect via SSH

  1. Check that port 22 is allowed in the security group from your address.
  2. Use the user ubuntu and the key pair you chose at launch. Password login over SSH is disabled by design.
  3. If you removed or edited /etc/netplan/00-network-manager-all.yaml, the instance may have booted without networking: use the EC2 serial console or Session Manager to restore it.

Emergency access

There is no password on any account until you set one. EC2 Serial Console and single-user recovery need a local password: the one you set in Step 3 works for the serial console. Session Manager (SSM) is the other way in if SSH is unavailable.

Support

cloudimg provides 24/7 technical support for this image by email and live chat: support@cloudimg.co.uk.

Ubuntu is free and open source, assembled from thousands of independently packaged components each under its own licence (see /usr/share/doc/<package>/copyright). No subscription or licence key is required; Ubuntu Pro is neither included nor required. Ubuntu is a registered trademark of Canonical Ltd. GNOME is a trademark of the GNOME Foundation. CIS and CIS Benchmarks are trademarks of the Center for Internet Security, Inc. The names are used only to identify the software this image contains; cloudimg is not affiliated with or endorsed by Canonical, the GNOME Foundation or CIS.