Ubuntu 24.04 LTS GNOME Desktop on Azure User Guide

Overview

This guide covers the deployment and configuration of Ubuntu 24.04 LTS with the GNOME desktop on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

Ubuntu is a widely used Linux distribution produced by Canonical. Version 24.04 is a long term support (LTS) release, with standard security maintenance to 2029. This image is Ubuntu Server 24.04 LTS with Ubuntu's own GNOME desktop added (the ubuntu-desktop-minimal package set from the Ubuntu main archive) and GNOME's own remote desktop server, gnome-remote-desktop, set up for remote login: you connect with any RDP client, see the GNOME login screen, and sign in to a full desktop session running on the virtual machine.

The image is built so that a freshly deployed machine exposes nothing but SSH. Remote desktop ships switched off, no account has a password, and nothing listens on the RDP port until you decide to turn it on. A desktop login always needs a password, so the image never ships one: you set your own over SSH, then enable remote desktop with a single command.

What's included:

• Ubuntu 24.04 LTS on the Azure kernel, with the GNOME 46 desktop (GDM login screen, GNOME Shell, Files, Terminal, Text Editor, System Monitor, Settings) from the Ubuntu main archive
• GNOME Remote Desktop 46 in system mode: RDP remote login through the GNOME login screen, with the modern RDP graphics pipeline
• A per-VM RDP credential and a per-VM self signed TLS certificate, generated at first boot and readable by root only
• cloudimg-remote-desktop, a small helper to show the remote desktop state, switch it on and off, and print your VM's RDP credential
• Every available security update applied at build time, with unattended-upgrades armed so the machine keeps patching itself
• The Azure provisioning path unchanged: cloud-init, the Azure Linux Agent and systemd-networkd, exactly as on Ubuntu Server
• Gen2 Hyper V virtual machine support
• 24/7 cloudimg support

What's deliberately NOT included: a web browser (Firefox for Ubuntu is a snap; install it with sudo snap install firefox), NetworkManager (networking is managed by systemd-networkd, the Azure default), printing, Bluetooth, the Avahi service discovery daemon and the GNOME first login wizard. None of these add anything on a cloud server, and several would open network listeners.

Platform: Microsoft Azure (Gen2 Hyper V, x64) Default user: azureuser

Security posture

This image ships with no known credential:

• No account has a password. The root account is locked, and azureuser is created at first boot with only the SSH key you supply.
• SSH is key only (PasswordAuthentication no). Setting an account password for the desktop does not enable password logins over SSH.
• The remote desktop server is installed but disabled: a new virtual machine listens on SSH port 22 only.
• At first boot the machine generates its own RDP credential and its own TLS certificate for the remote desktop server. Nothing is shared between two machines, and nothing is baked into the image.
• Remote desktop cannot be switched on until an administrator account has a password, so the login screen is never exposed with nothing to protect it.
• The machine identity and the SSH host keys are regenerated uniquely on every instance, and AppArmor is enforcing.

There are two secrets on a machine with remote desktop turned on, and you control both: the RDP credential (asked for by your RDP client before anything is drawn, and unique to this VM) and your account password (asked for by the GNOME login screen, and chosen by you).

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for Linux VM access
4. An RDP client: Windows App or Remote Desktop Connection on Windows, Windows App on macOS, or Remmina or FreeRDP on Linux

Recommended VM Size: Standard_B2ms (2 vCPU, 8 GB RAM) or larger. The GNOME desktop needs the 8 GB; for smooth everyday use pick Standard_D4s_v5 or larger. There is no GPU requirement: the desktop renders in software.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

1. Navigate to the Azure Marketplace and search for "Ubuntu 24.04 LTS GNOME Desktop cloudimg"
2. Select the image and click Create
3. Configure the basics:
4. Subscription: Select your Azure subscription
5. Resource Group: Create new or select existing
6. Virtual Machine Name: Enter a name for your VM
7. Region: Select your preferred Azure region
8. Size: Standard_B2ms or larger
9. Under Administrator Account, select SSH public key and enter your key
10. Under Inbound Port Rules, allow SSH (port 22) only. You do not need to open port 3389: the recommended way to reach the desktop is through an SSH tunnel (Step 6)
11. Click Review + Create, then Create

Option B: Azure CLI

cloudimg images carry a Marketplace purchase plan, so accept its terms once per subscription, then create the VM:

az vm image terms accept --urn cloudimg1647283583153:ubuntu-24-04-gui:default:latest

az vm create \
  --resource-group myResourceGroup \
  --name my-ubuntu-desktop \
  --image cloudimg1647283583153:ubuntu-24-04-gui:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-ubuntu-desktop --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the release and the desktop

Check the release, that the machine booted to the graphical target, that the GNOME login screen (GDM) is running, and which desktop packages are installed:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release
systemctl get-default
systemctl is-active gdm
dpkg-query -W -f='${Package} ${Version}\n' ubuntu-desktop-minimal gnome-shell gdm3 gnome-remote-desktop

Expected output:

PRETTY_NAME="Ubuntu 24.04.5 LTS"
VERSION_ID="24.04"
graphical.target
active
gdm3 46.2-1ubuntu1~24.04.9
gnome-remote-desktop 46.3-0ubuntu1.2
gnome-shell 46.0-0ubuntu6~24.04.14
ubuntu-desktop-minimal 1.539.2

Step 4: Check that remote desktop is off

A new virtual machine has remote desktop switched off. The helper shows the whole picture:

sudo cloudimg-remote-desktop status
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort

Expected output (the certificate fingerprint is unique to your VM):

remote desktop service: disabled / inactive
RDP backend: disabled
listening on 3389: no
per-VM RDP credential: generated (/root/cloudimg-remote-desktop-credentials.txt)
TLS certificate SHA-256: 2A:36:FB:5B:62:CC:99:4D:B5:81:D1:A1:3D:F4:AC:F6:46:D0:12:5C:51:EB:21:FA:23:7F:89:DA:ED:D6:CD:BF
accounts able to log in at the GNOME login screen: none (set one with: sudo passwd <user>)
0.0.0.0:22
127.0.0.53%lo:53
127.0.0.54:53
[::]:22

The only listener reachable from outside the machine is SSH on port 22. The two port 53 entries are the local DNS resolver, bound to loopback addresses only.

Step 5: Set your password and turn remote desktop on

The GNOME login screen asks for your account password, and a new VM has none. Choose your own. Run this yourself on the VM, and enter the new password twice when prompted:

sudo passwd azureuser

Your SSH access is unaffected: SSH remains key only. Now switch remote desktop on:

sudo cloudimg-remote-desktop enable

Expected output:

remote desktop enabled: listening on port 3389
TLS certificate SHA-256: 2A:36:FB:5B:62:CC:99:4D:B5:81:D1:A1:3D:F4:AC:F6:46:D0:12:5C:51:EB:21:FA:23:7F:89:DA:ED:D6:CD:BF
RDP credential: sudo cloudimg-remote-desktop credentials
safest route: ssh -L 3389:localhost:3389 <user>@<vm-ip>, then point your RDP client at localhost:3389

If no administrator account has a password yet, the helper refuses and tells you which command to run first. The setting survives reboots. Under the hood it runs grdctl --system rdp enable and systemctl enable --now gnome-remote-desktop.service.

Print your VM's RDP credential (you will need it in the next step):

sudo cloudimg-remote-desktop credentials

The output lists RDP_USERNAME (your admin account name), RDP_PASSWORD (24 random characters generated at first boot), RDP_PORT and the certificate fingerprints. This credential is used by your RDP client only. It is not an operating system password and it does not work for SSH.

Step 6: Connect with your RDP client

The recommended route keeps port 3389 closed to the internet and carries RDP inside your SSH connection. On your workstation, open a tunnel and leave it running:

ssh -N -L 3389:localhost:3389 azureuser@<vm-ip>

Then point your RDP client at localhost:3389:

• Windows: Remote Desktop Connection (mstsc) or Windows App, computer localhost:3389
• macOS: Windows App, add a PC with the name localhost:3389
• Linux: Remmina (RDP), server localhost:3389, or FreeRDP 3: xfreerdp3 /v:localhost:3389 /u:azureuser /gfx /bpp:32

When the client asks for credentials, enter RDP_USERNAME and RDP_PASSWORD from Step 5. On first connection the client shows the server's certificate: it is self signed and unique to your VM, so compare its fingerprint with RDP_TLS_SHA256 (or RDP_TLS_SHA1, which is what Windows displays as the thumbprint) before you accept it.

The GNOME login screen appears:

Select your account and enter the password you set in Step 5. The session is handed over to your own desktop:

The orange indicator in the top bar shows that the session is being viewed remotely. Disconnecting your RDP client leaves the session running; connect again and you return to it.

If you prefer a direct connection instead of the tunnel, allow port 3389 in the VM's network security group from your own public address only, never from the whole internet. For example, from your workstation (replace the placeholders):

az network nsg rule create --resource-group myResourceGroup --nsg-name my-ubuntu-desktopNSG \
  --name allow-rdp-from-me --priority 1010 --access Allow --protocol Tcp \
  --direction Inbound --destination-port-ranges 3389 --source-address-prefixes <your-public-ip>/32

Step 7: Use the desktop

Open Show Apps (bottom of the dock, or press Super and A) to see the installed applications:

A terminal is one shortcut away (Ctrl, Alt and T). azureuser keeps its Azure administrator rights, so sudo works in the desktop exactly as it does over SSH:

To add software, use apt in the terminal as on any Ubuntu machine, for example sudo apt install libreoffice. For a web browser, sudo snap install firefox.

Step 8: Verify the security posture

Confirm that SSH is key only, root is locked, and no account has a password until you set one:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow

Expected output on a new VM (after Step 5 the last line reads 1, your own account):

permitrootlogin without-password
passwordauthentication no
root L 2009-12-22 -1 -1 -1 -1
accounts with a password: 0

without-password is how OpenSSH reports the prohibit-password setting: root may not authenticate with a password. L means the root account is locked.

Step 9: Networking

The Azure network interface is configured by cloud-init and systemd-networkd, exactly as on Ubuntu Server:

netplan get network.renderer
networkctl list --no-legend | awk '$2=="eth0"'

Expected output:

networkd
  2 eth0 ether    routable configured

Ubuntu's desktop settings package would normally hand every interface to NetworkManager, which this image does not install. The image keeps systemd-networkd in charge with /etc/netplan/00-network-manager-all.yaml. Do not delete that file unless you have installed NetworkManager and tested the change from the Azure serial console: without it the VM loses its network connection at the next boot. For the same reason the network panel in GNOME Settings is empty; that is expected.

The Azure Network Security Group is the enforced firewall. ufw is installed but inactive, the Ubuntu default. If you enable it, allow SSH first (sudo ufw allow OpenSSH), and allow 3389 only if you connect directly rather than through the tunnel.

Step 10: Turn remote desktop off, or change the RDP credential

To switch remote desktop off again (the setting survives reboots), run this yourself:

sudo cloudimg-remote-desktop disable

To replace the generated RDP credential with one of your own:

sudo grdctl --system rdp set-credentials azureuser '<new-rdp-password>'
sudo systemctl restart gnome-remote-desktop.service

cloudimg-remote-desktop credentials keeps showing the first boot values, so update or remove /root/cloudimg-remote-desktop-credentials.txt if you change it.

Step 11: Check the patch level

The image is fully updated at build time. Confirm no upgrades are pending (grep -c exits non-zero on a zero count, hence the || true):

echo "pending upgrades: $(apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c '^Inst ' || true)"

Expected output:

pending upgrades: 0

unattended-upgrades installs security updates automatically. You can still update on your own schedule with sudo apt-get update && sudo apt-get -y dist-upgrade, and reboot if a new kernel was installed.

Common Use Cases

• A cloud workstation for Linux development with a full GNOME desktop, reachable from any RDP client
• Running graphical administration and data tools close to your Azure resources
• Training labs and demonstrations that need a desktop rather than a shell
• A secure jump desktop, reachable only through an SSH tunnel

Troubleshooting

The RDP client connects, then the screen stays black or disconnects

GNOME Remote Desktop requires the RDP graphics pipeline. Current Windows and macOS clients support it. With FreeRDP pass /gfx /bpp:32; without them the server logs "Client did not advertise support for the Graphics Pipeline" and closes the connection. Check the server side with:

sudo journalctl -u gnome-remote-desktop --no-pager -n 20

The RDP client says the credentials are wrong

The client wants the RDP credential from sudo cloudimg-remote-desktop credentials, not your account password. The account password is only for the GNOME login screen that appears afterwards.

The login screen does not accept my password

The account has no password yet, or the password was set for a different account. Set it again with sudo passwd azureuser over SSH, then retry. After a few failed attempts GNOME briefly delays further tries.

The session locked while I was away

Unlock it with your account password. To change the idle lock, open Settings, then Privacy and Security, then Screen Lock.

Cannot connect via SSH

1. Verify the VM is in Running state in the Azure Portal
2. Check that port 22 is allowed in the Network Security Group
3. Ensure you are using the correct username: azureuser
4. Verify your SSH key matches the one you supplied at create time. Password login over SSH is disabled by design.

If you removed or edited /etc/netplan/00-network-manager-all.yaml, the VM may have booted without networking: use the Azure serial console to restore it.

Azure agent not running

sudo systemctl status walinuxagent --no-pager

If it is not running, start it yourself with sudo systemctl enable --now walinuxagent.

Important Notes

Ubuntu is free and open source. It is not covered by a single licence: it is a distribution assembled from thousands of independently packaged components, each carrying its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL. The GNOME desktop and GNOME Remote Desktop are free software from the Ubuntu main archive. Every package's terms are readable with dpkg -s <package> and under /usr/share/doc/<package>/copyright. No subscription or licence key is required to run this image; Ubuntu Pro is an optional Canonical subscription that is neither included nor required here.

Ubuntu 24.04 LTS receives standard security maintenance until 2029. Plan a move to a newer LTS image before that date for workloads that need to outlive it.

Ubuntu is a trademark of Canonical Ltd. GNOME is a trademark of the GNOME Foundation. The names are used here nominatively, only to identify the software this image contains. cloudimg is not affiliated with, endorsed by or sponsored by Canonical Ltd. or the GNOME Foundation.

Support

For assistance with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• Product Catalogue: www.cloudimg.co.uk/products
• User Guides: www.cloudimg.co.uk/guides
• SLA: 24 hour response guaranteed