Ubuntu 24.04 LTS with XFCE Desktop on AWS User Guide

Overview

This image is Ubuntu 24.04 LTS with the XFCE desktop, one software version of the cloudimg Hardened Debian & Linux Desktops AMIs listing on AWS Marketplace. Every desktop in the listing is described at /guides/linux-desktop-aws/.

It is Ubuntu Server 24.04 LTS with the XFCE 4.18 desktop and the LightDM display manager added, and xrdp set up as the remote desktop server: you connect with any RDP client, sign in at the xrdp login box with your own account name and password, and get a full XFCE session running on the instance. XFCE is deliberately light: the whole desktop idles in about half a gigabyte of memory.

Remote desktop ships switched off, and no account has a password. xrdp signs you in with your ordinary Linux account password, so there is exactly one password and it is yours: you set it over SSH, then turn remote desktop on with one command. The recommended route is an SSH tunnel, so port 3389 never has to be open to the internet.

What cloudimg does to the image:

• A curated XFCE desktop: Thunar file manager, XFCE Terminal, Mousepad text editor, Task Manager, Application Finder and Settings Manager, installed without the extras that open network listeners or carry identity (no NetworkManager, Avahi, printing, Bluetooth, audio server, screen locker or snap packages).
• xrdp, off until you enable it, hardened. At first boot each instance generates its own self-signed TLS certificate and its own xrdp RSA key, readable by root (and the xrdp service) only. Nothing is shared between two instances and nothing is baked into the image. xrdp accepts TLS only (TLS 1.2 and 1.3), offers only the local Xorg session (the VNC and RDP-forwarding modules that would let the login box open connections to other hosts are removed), refuses root logins and has RDP audio switched off. cloudimg-remote-desktop enable refuses to start until an administrator account has a password, so an RDP login box is never exposed with nothing behind it.
• A patched xrdp. Ubuntu 24.04's own xrdp package (0.9.24) has security vulnerabilities whose only fix for 24.04 is Ubuntu Pro. This image instead carries xrdp 0.10.1 and xorgxrdp 0.10.2 rebuilt by cloudimg, unchanged, from Debian's security-maintained source packages (which carry every published xrdp security fix), compiled from signature-verified sources at build time with the compiler removed again afterwards.
• Remediated with the OpenSCAP CIS Level 1 Server profile. The build applies the SCAP Security Guide 0.1.82 profile cis_level1_server with oscap --remediate after the desktop is installed, then reboots and runs a scored evaluation; the build fails if fewer than 95% of the scored rules pass. The report ships in the image at /usr/share/doc/cloudimg/cis-l1-report.html. This is a measurement made by open-source tooling, not a certification or accreditation by the benchmark's publisher or any other body, and these images are not CIS Hardened Images.
• Fully patched at build time, with automatic security updates left on (unattended-upgrades).
• Key-only SSH as ubuntu. Password login over SSH is off and stays off when you set a desktop password; root login is refused and the root account is locked.
• IMDSv2 only, the ufw host firewall (inbound SSH only), AppArmor enforcing, chrony on the Amazon Time Sync Service and the AWS Systems Manager agent.

A note on package support

The XFCE desktop and LightDM come from the Ubuntu universe archive, which is maintained by the Ubuntu community rather than by Canonical; Canonical's guaranteed security-update commitment for universe packages is available only under an Ubuntu Pro subscription, which is neither included with nor required by this image. The image is fully patched at build time and unattended-upgrades keeps installing what the archive publishes.

xrdp and xorgxrdp are not updated by apt. They are cloudimg's rebuild of Debian's packages (version suffix ~cloudimg24.04.1), so the Ubuntu archive never offers an update for them. cloudimg rebuilds them and releases a new version of this image when Debian publishes a security fix; to pick it up, launch the newer version. If your policy requires a vendor update stream for every package, use a desktop from this listing built entirely from a distribution's main archive.

Connecting to your instance

Connect over SSH as the default login user for the operating system variant you launched:

Operating system variant	SSH login user
Ubuntu 24.04 LTS with XFCE Desktop	ubuntu

Launch from AWS Marketplace

1. Open the listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Once the subscription is active, choose Launch your software.
3. Choose Launch from EC2 Console (or One-click launch), then in Version choose Ubuntu 24.04 LTS with XFCE Desktop - YYYY-MM-DD and your Region.
4. Instance type: m5.large (2 vCPU, 8 GiB) is recommended. XFCE itself idles at about 0.5 GiB, so smaller types work for light use; pick m5.xlarge or larger for heavier desktop work. There is no GPU requirement; the desktop renders in software.
5. Key pair: choose your EC2 key pair. It is the only way in.
6. Security group: allow inbound TCP 22 from your own IP address only. The listing's default security group also offers TCP 3389 for a direct RDP connection; restrict it to your own address too, or remove it and use the SSH tunnel (Step 5).
7. Storage: the root volume is 12 GiB gp3 by default. Choose a larger size if you will install applications; cloud-init grows the root filesystem to fill it on first boot.
8. Leave the metadata settings at their defaults (the image requires IMDSv2), then choose Launch.

Step 1: Connect over SSH and check the desktop

ssh -i ~/.ssh/my-key.pem ubuntu@<public-ip>

ubuntu has passwordless sudo. There is no password on any account. Confirm the release, that the instance booted to the graphical target with the LightDM display manager running, and the installed desktop and remote desktop packages:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release
systemctl get-default
systemctl is-active lightdm
dpkg-query -W -f='${Package} ${Version}\n' xfce4 xfce4-session lightdm xrdp xorgxrdp

PRETTY_NAME="Ubuntu 24.04.5 LTS"
VERSION_ID="24.04"
graphical.target
active
lightdm 1.30.0-0ubuntu14
xfce4 4.18
xfce4-session 4.18.3-1build2
xorgxrdp 1:0.10.2-1~cloudimg24.04.1
xrdp 0.10.1-3.1+deb13u2~cloudimg24.04.1

Step 2: Check that remote desktop is off

A new instance has remote desktop switched off. The helper shows the whole picture:

sudo cloudimg-remote-desktop status
sudo ss -tlnH | awk '{print $4}' | sort

Expected output (the certificate fingerprint is unique to your instance):

remote desktop service: disabled / inactive
session manager: disabled / inactive
listening on 3389: no
per-instance TLS certificate: generated (/etc/xrdp/cert.pem)
TLS certificate SHA-256: 09:4D:EE:68:EB:57:A3:FC:96:8E:B7:11:4D:E2:DC:29:85:24:51:83:8F:B0:2C:AA:6D:32:0F:4C:2C:F6:B1:AD
accounts able to log in at the XFCE remote desktop: none (set one with: sudo passwd <user>)
0.0.0.0:22
127.0.0.1:25
127.0.0.53%lo:53
127.0.0.54:53
[::1]:25
[::]:22

The only listener reachable from outside the instance is SSH on port 22. The other entries are the local DNS resolver and the local mail transfer agent (port 25, for system mail), bound to loopback addresses only.

Step 3: Set your password

The xrdp login box asks for your account password, and a new instance has none. Choose your own. Run this yourself on the instance and enter the new password twice when prompted:

sudo passwd ubuntu

The image's password policy (part of the CIS Level 1 remediation) requires at least 14 characters with upper case, lower case, a digit and a symbol, no more than 3 identical or sequential characters in a row, and no dictionary words. SSH stays key only: the password works at the xrdp login box (and for the EC2 serial console) and for nothing else over the network.

Step 4: Turn remote desktop on

sudo cloudimg-remote-desktop enable

Expected output:

remote desktop enabled: listening on port 3389
TLS certificate SHA-256: <your instance's fingerprint>
sign in with your own account name and the password you set with sudo passwd
recommended route: ssh -N -L 3389:localhost:3389 <user>@<instance-ip>, then point your RDP client at localhost:3389

If no administrator account has a password yet, the helper refuses and tells you which command to run first. The setting survives reboots. Under the hood it enables and starts xrdp.service, which starts the session manager with it. Print your instance's connection details:

sudo cloudimg-remote-desktop credentials

The output lists RDP_USERNAME (ubuntu), RDP_PORT and the certificate fingerprints. There is no separate remote desktop password: RDP_PASSWORD_SOURCE records that the password is your own account password.

Step 5: Connect with your RDP client

The recommended route keeps port 3389 closed and carries RDP inside your SSH connection (the host firewall already admits it, because the tunnel arrives on the loopback interface). On your workstation, open a tunnel and leave it running:

ssh -i ~/.ssh/my-key.pem -N -L 3389:localhost:3389 -o ServerAliveInterval=60 ubuntu@<public-ip>

Then point your RDP client at localhost:3389:

• Windows: Remote Desktop Connection (mstsc) or Windows App, computer localhost:3389
• macOS: Windows App, add a PC with the name localhost:3389
• Linux: Remmina (RDP), server localhost:3389, or FreeRDP 3: xfreerdp3 /v:localhost:3389 /u:ubuntu /gfx /bpp:32

On first connection the client shows the server's certificate: it is self signed and unique to your instance, so compare its fingerprint with RDP_TLS_SHA256 (or RDP_TLS_SHA1, which Windows shows as the thumbprint) before you accept it. If your client asks for credentials before connecting, you can enter ubuntu and your password there and skip the login box.

The xrdp login box appears. The Session list has one entry, Xorg, which is the one you want. Enter ubuntu and the password you set in Step 3:

The XFCE desktop appears:

Disconnecting your RDP client leaves the session running on the instance; connect again with the same account and you return to it. xrdp asks for your password again every time you connect, so a disconnected session is not left unprotected.

Direct connection instead of the tunnel. Allow TCP 3389 in the instance's security group from your own public address only, never from the whole internet, and admit the same address in the host firewall on the instance:

sudo ufw allow from <your-public-ip> to any port 3389 proto tcp

Step 6: Use the desktop

Open the Applications menu at the top left to see what is installed:

A terminal is in the dock at the bottom, and in Applications under Terminal Emulator. ubuntu keeps its passwordless sudo, so sudo works in the desktop exactly as it does over SSH:

To add software, use apt in the terminal as on any Ubuntu machine, for example sudo apt install libreoffice. There is no web browser: Ubuntu's firefox package installs a snap and this image ships without snapd, so install it with sudo apt install snapd and then sudo snap install firefox, or use Mozilla's own APT repository. The Web Browser and Mail Reader entries in the Applications menu (and the browser icon in the dock) do nothing until you install a browser or a mail client.

Settings live in Applications, then Settings, then Settings Manager. The display resolution of a remote session is set by your RDP client, not by the instance. Sound is not redirected (the image has no audio server and xrdp's audio channel is off). Log Out offers no Suspend or Hibernate: an EC2 instance must never put itself to sleep.

Security posture

Confirm that SSH is key only (and forwards no X11: use the RDP desktop), root is locked, no account has a password until you set one, and the host firewall admits SSH only:

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|pubkeyauthentication|x11forwarding) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow
sudo ufw status | grep -E '^(Status|22/tcp |3389)' || true

permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
x11forwarding no
root L 2024-04-23 0 99999 7 -1
accounts with a password: 0
Status: active
22/tcp                     ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)

After Step 3 the third line reads 1 (your own account). root L means the root password is locked. And confirm the xrdp hardening:

grep -E '^(security_layer|ssl_protocols|rdpsnd)=' /etc/xrdp/xrdp.ini
grep -E '^\[(Xorg|Xvnc|vnc-any|neutrinordp-any)\]' /etc/xrdp/xrdp.ini
grep -E '^AllowRootLogin=' /etc/xrdp/sesman.ini

security_layer=tls
ssl_protocols=TLSv1.2, TLSv1.3
rdpsnd=false
[Xorg]
AllowRootLogin=false

View the compliance report

The evaluation the build ran is in /usr/share/doc/cloudimg/cis-l1-report.html (HTML), cis-l1-arf.xml (machine-readable ARF) and cis-l1-summary.json (counts, pass rate, threshold, SSG version and checksums) in the same directory. The build host's name and addresses are replaced in the shipped copy.

python3 -c "import json; d=json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json')); print(d['profileLabel'], d['ssgVersion'], '-', d['pass'], 'of', d['scored'], 'scored rules pass', '(' + str(d['ratePct']) + '%)', '- waived', d['waived'])"
python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json'))['failingRules']]"

CIS Level 1 Server 0.1.82 - 348 of 352 scored rules pass (98.9%) - waived 6
all_apparmor_profiles_in_enforce_complain_mode
set_nftables_loopback_traffic
set_nftables_table
set_ufw_default_rule

The 4 scored rules that do not pass are listed in the summary's failingRules. The two nftables rules belong to the profile's nftables firewall option, which this image does not use (ufw is the host firewall). set_ufw_default_rule fails because outbound traffic is allowed on purpose: a default-deny outbound policy would cut the SSM agent, cloud-init and the instance metadata service off, and stop DNS, NTP and package updates. all_apparmor_profiles_in_enforce_complain_mode fails because Ubuntu 24.04 loads about 90 of its own AppArmor profiles in unconfined mode (they exist to grant applications user-namespace access, not to confine them), which the rule counts as neither enforce nor complain; AppArmor itself is enabled and enforcing its other profiles (sudo aa-status). The profile's GNOME login-screen rules do not apply to this image (it has no GNOME display manager), which is why it scores fewer rules than the GNOME desktop. The local display's X server writes its log to /run/lightdm/Xorg.0.log rather than /var/log, because Xorg always creates that file world-readable.

Copy the HTML report to your workstation and open it in a browser:

scp -i ~/.ssh/my-key.pem ubuntu@<public-ip>:/usr/share/doc/cloudimg/cis-l1-report.html .

Re-run the same evaluation on your instance at any time (about 5 to 10 minutes; nothing is changed). oscap exits with status 2 when any rule fails; the report is still written:

sudo oscap xccdf eval --tailoring-file /usr/share/cloudimg/openscap/tailoring.xml \
  --profile xccdf_co.cloudimg_profile_cis-l1_ec2_single \
  --report ~/cis-l1-rescan.html /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

Waived rules

These rules of the profile are deselected through the tailoring file /usr/share/cloudimg/openscap/tailoring.xml and are not scored; the reasons are in /usr/share/doc/cloudimg/cis-l1-waivers.txt. Everything else the profile selects is remediated and scored. The tailoring also selects ufw as the profile's firewall option and chrony as its time service.

Rule	Category	Why it is waived on EC2
partition_for_tmp	single-volume-partitions	The image boots from one EBS root volume, so /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home live on the root filesystem.
grub2_password	serial-console-and-boot	A boot-loader or root password would have to be baked into the image, giving every instance the same credential. Root stays locked and no password exists.
grub2_uefi_password	serial-console-and-boot	As above, for the UEFI boot loader.
accounts_maximum_age_login_defs	key-only-account-aging	Password-age defaults apply to every account cloud-init creates at launch. Those accounts are key-only and have no password, so an age limit would expire them and lock the SSH key out. Accounts that do have a password (yours, after Step 3) are still aged.
account_disable_post_pw_expiration	key-only-account-aging	As above, for the inactivity default.
sshd_limit_user_access	ssh-access-list	An AllowUsers/AllowGroups list fixed at build time would refuse SSH to accounts you create with cloud-init user-data. SSH is key-only, root login is refused, and your security group restricts the source addresses.

Networking

The EC2 network interface is configured by cloud-init and systemd-networkd, exactly as on Ubuntu Server. Unlike a GNOME desktop, the XFCE package set does not hand your interface to NetworkManager, so no override file is needed and none is shipped:

networkctl list --no-legend

  1 lo   loopback carrier  unmanaged
  2 ens5 ether    routable configured

Because NetworkManager is not installed, there is no network panel in the XFCE settings; that is expected.

Turn remote desktop off, or change your password

To switch remote desktop off again (the setting survives reboots):

sudo cloudimg-remote-desktop disable

To change the password the xrdp login box asks for, change your account password: they are the same thing.

sudo passwd ubuntu

To use a certificate of your own instead of the generated one, write it to /etc/xrdp/cert.pem and its key to /etc/xrdp/key.pem (owner root, group xrdp, mode 0640) and run sudo systemctl restart xrdp.

Patching

unattended-upgrades installs security updates automatically. To see how many updates are waiting:

echo "pending upgrades: $(apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade 2>/dev/null | grep -c '^Inst ' || true)"

pending upgrades: 0

To install everything now: sudo apt-get update && sudo apt-get -y dist-upgrade, and reboot if /var/run/reboot-required exists. xrdp and xorgxrdp are not part of this (see "A note on package support").

Troubleshooting

The RDP client connects but the screen is black, or the session closes immediately

Check what the remote desktop services recorded:

sudo journalctl -u xrdp -u xrdp-sesman --no-pager -n 20

If you see an authentication failure, the password is wrong or the account has none yet: set it with sudo passwd ubuntu over SSH and try again. XFCE allows one desktop session per account: if you are already signed in to a session (for example a second RDP client), disconnect it first, then connect again to return to it.

The client refuses the connection or reports a security negotiation error

This image accepts TLS only. Every current RDP client supports it; very old clients that only offer the legacy RDP security layer are refused. Update the client.

The login box does not accept my password

The username is your Linux account name (ubuntu), not an email address. If the account has no password yet, set it with sudo passwd ubuntu over SSH. After 4 failed attempts the account is locked for 15 minutes (part of the CIS Level 1 remediation); unlock it early with sudo faillock --user ubuntu --reset.

I get "connection refused" on localhost:3389

The tunnel is not up, or remote desktop is still off. Check sudo cloudimg-remote-desktop status on the instance, and confirm your ssh -N -L 3389:localhost:3389 command is still running on your workstation.

Cannot connect via SSH

1. Check that port 22 is allowed in the security group from your address.
2. Use the user ubuntu and the key pair you chose at launch. Password login over SSH is disabled by design.

Emergency access

There is no password on any account until you set one. EC2 Serial Console and single-user recovery need a local password: the one you set in Step 3 works for the serial console. Session Manager (SSM) is the other way in if SSH is unavailable.

Support

cloudimg provides 24/7 technical support for this image by email and live chat: support@cloudimg.co.uk.

Ubuntu is free and open source, assembled from thousands of independently packaged components each under its own licence (see /usr/share/doc/<package>/copyright). XFCE is free software under the GPL and LGPL; xrdp and xorgxrdp are under the Apache License 2.0. No subscription or licence key is required; Ubuntu Pro is neither included nor required. Ubuntu is a registered trademark of Canonical Ltd. Xfce is a project of the Xfce development team. CIS and CIS Benchmarks are trademarks of the Center for Internet Security, Inc. The names are used only to identify the software this image contains; cloudimg is not affiliated with or endorsed by Canonical, the Xfce project or CIS.