Operating Systems Azure

Ubuntu 26.04 LTS with Cinnamon Desktop on Azure User Guide

| Product: Ubuntu 26.04 LTS with Cinnamon Desktop on Azure

Overview

This guide covers the deployment and configuration of Ubuntu 26.04 LTS with the Cinnamon desktop on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

Ubuntu is a widely used Linux distribution produced by Canonical. Version 26.04 is a long term support (LTS) release with standard security maintenance to 29 May 2031. This image is Ubuntu Server 26.04 LTS with the Cinnamon 6.4 desktop added and xrdp 0.10 set up as the remote desktop server: you connect with any RDP client, sign in with your own account name and password, and get a full Cinnamon session running on the virtual machine.

Cinnamon is a traditional desktop: a single panel along the bottom, a familiar applications menu, a window list, a system tray and a clock. If you want a Linux desktop that behaves the way a desktop has always behaved, with no overview screen to learn, this is it. It idles in roughly 740 MB of memory on this build.

The image is built so that a freshly deployed machine exposes nothing but SSH. Remote desktop ships switched off, no account has a password, and nothing listens on the RDP port until you decide to turn it on.

What's included:

  • Ubuntu 26.04 LTS on the Azure kernel, with the Cinnamon 6.4 desktop (Nemo file manager, GNOME Terminal, Text Editor, Calculator, Screenshot, Evince document viewer, Eye of GNOME image viewer and the full Cinnamon System Settings) and the LightDM display manager
  • xrdp 0.10 with xorgxrdp, configured for remote desktop sessions over TLS. The session manager talks to the server over a local UNIX socket, so it adds no network port of its own
  • A per-VM TLS certificate and a per-VM xrdp RSA key, generated at first boot and readable by root only
  • cloudimg-remote-desktop, a small helper to show the remote desktop state, switch it on and off, and print your VM's connection details
  • Every available security update applied at build time, with unattended-upgrades armed so the machine keeps patching itself
  • The Azure provisioning path unchanged: cloud-init, the Azure Linux Agent and systemd-networkd, exactly as on Ubuntu Server
  • Gen2 Hyper V virtual machine support
  • 24/7 cloudimg support

What's deliberately NOT included: a web browser (install one with sudo apt install firefox-esr or sudo snap install firefox), an office suite (sudo apt install libreoffice), printing, Bluetooth, and the Avahi service discovery daemon. None of these add anything on a cloud server by default, and several would open network listeners.

Platform: Microsoft Azure (Gen2 Hyper V, x64) Default user: azureuser Suggested size: Standard_B2ms (2 vCPU, 8 GB)

A note on NetworkManager

Unlike cloudimg's other Ubuntu desktop images, this one has NetworkManager installed. That is not a choice: the Cinnamon desktop depends on it through cinnamon → nm-connection-editor → network-manager, and the desktop cannot be installed without it.

It does not manage your network. On this image:

  • systemd-networkd, driven by netplan, owns eth0 — exactly as on Ubuntu Server and on every other cloudimg image.
  • The netplan renderer is pinned to networkd in /etc/netplan/00-cloudimg-renderer.yaml.
  • NetworkManager is pinned to manage no device at all, in /etc/NetworkManager/conf.d/10-cloudimg-unmanaged.conf.

The result is one network stack in charge, not two. The Cinnamon network applet will show no connections, which is expected and harmless.

Do not delete just one of those two files. If you genuinely want NetworkManager to run the network on this machine, remove /etc/NetworkManager/conf.d/10-cloudimg-unmanaged.conf and set renderer: NetworkManager in /etc/netplan, then sudo netplan apply. Doing only one of the two can leave the VM unreachable after its next reboot.

A note on package support

The Cinnamon desktop, xrdp, xorgxrdp and LightDM all come from the Ubuntu universe archive. Universe is maintained by the Ubuntu community rather than by Canonical, and Canonical's guaranteed security-update commitment for universe packages is only available under an Ubuntu Pro subscription, which is not included with this image and which cloudimg does not hold on your behalf.

In practice that means: this image is fully patched from the public Ubuntu archive at the moment it is built, and unattended-upgrades keeps installing whatever the archive publishes. But the desktop stack does not carry the same support commitment as the packages in Ubuntu's main archive. If your security policy requires a guaranteed fix timeline for every installed package, either attach your own Ubuntu Pro subscription to the VM (sudo pro attach <token>) or choose a desktop image built entirely from main. This is stated plainly here because it is a real difference, not a footnote.

At build time this image carried no package needing an Ubuntu Pro or ESM-only fix: pro security-status reported zero esm-infra updates, zero esm-apps updates and zero standard security updates, and every universe source package in the desktop was checked individually against Ubuntu's security database for 26.04.

xrdp itself has a number of CVEs that Ubuntu's security team has triaged but not fixed in any archive, on any release. They are the same set carried by cloudimg's existing Ubuntu 26.04 XFCE image. Because remote desktop ships off and is reached over an SSH tunnel by default, the exposed surface of a machine you have not deliberately opened is SSH only.

Security posture

This image ships with no known credential:

  • No account has a password. The root account is locked, and azureuser is created at first boot with only the SSH key you supply.
  • SSH is key only (PasswordAuthentication no). Setting an account password for the desktop does not enable password logins over SSH.
  • The remote desktop server is installed but disabled: a new virtual machine listens on SSH port 22 only.
  • At first boot the machine generates its own TLS certificate and key for xrdp, and its own xrdp RSA key. Nothing is shared between two machines, and nothing is baked into the image.
  • Remote desktop cannot be switched on until an administrator account has a password, so an RDP login box is never exposed with nothing to protect it.
  • xrdp-sesman is configured to refuse root logins, and every session module except the local Xorg one has been removed from xrdp.ini, so the RDP login box cannot be used to make your VM open outbound connections elsewhere.
  • The machine identity and the SSH host keys are regenerated uniquely on every instance, and AppArmor is enforcing.

There is only one password, and it is yours. Unlike RDP servers that carry a credential of their own, xrdp authenticates you through PAM against your ordinary Linux account. The password the RDP login box asks for is the one you set with sudo passwd, and until you set it nobody can sign in at all.

Prerequisites

Before deploying this image, ensure you have:

  1. An active Microsoft Azure subscription
  2. An SSH key pair
  3. An RDP client: Windows App or Remote Desktop Connection on Windows, Windows App on macOS, or Remmina / FreeRDP on Linux
  4. Network access to the VM on port 22

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

  1. In the Azure Portal, search the Marketplace for Ubuntu 26.04 LTS with Cinnamon Desktop and select the cloudimg offer.
  2. Choose Create.
  3. Select your subscription and resource group, and a region.
  4. Set a virtual machine name.
  5. Choose a size. Standard_B2ms (2 vCPU, 8 GB) is the recommended starting point for a desktop session.
  6. Set Authentication type to SSH public key, keep the username azureuser, and supply your public key.
  7. Under Inbound port rules, allow SSH (22) only. Do not open 3389: the recommended route to the desktop is an SSH tunnel.
  8. Review and create.

Option B: Azure CLI

cloudimg images carry a Marketplace purchase plan, so accept its terms once per subscription, then create the VM and open SSH only:

az vm image terms accept --urn cloudimg1647283583153:ubuntu-26-04-gui-cinnamon:default:latest

az vm create \
  --resource-group myResourceGroup \
  --name my-ubuntu-cinnamon \
  --image cloudimg1647283583153:ubuntu-26-04-gui-cinnamon:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

az vm open-port --resource-group myResourceGroup --name my-ubuntu-cinnamon --port 22

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-ubuntu-cinnamon --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the release and the desktop

Check the release, that the machine booted to the graphical target, that the LightDM display manager is running, and which desktop packages are installed:

grep -E '^(PRETTY_NAME|VERSION_ID)=' /etc/os-release
systemctl get-default
systemctl is-active lightdm
dpkg-query -W -f='${Package} ${Version}\n' cinnamon cinnamon-desktop-environment cinnamon-session lightdm xrdp xorgxrdp

Expected output:

PRETTY_NAME="Ubuntu 26.04.1 LTS"
VERSION_ID="26.04"
graphical.target
active
cinnamon 6.4.13-2ubuntu0.2
cinnamon-desktop-environment 6.4.2
cinnamon-session 6.4.2-1
lightdm 1.32.0-6ubuntu4
xorgxrdp 1:0.10.2-1build1
xrdp 0.10.1-4.1

Step 4: Check that remote desktop is off

A new virtual machine has remote desktop switched off. The helper shows the whole picture:

sudo cloudimg-remote-desktop status
sudo ss -tln | awk '$1=="LISTEN"{print $4}' | sort

Expected output (the certificate fingerprint is unique to your VM):

remote desktop service: disabled / inactive
session manager: disabled / inactive
listening on 3389: no
per-VM TLS certificate: generated (/etc/xrdp/cert.pem)
TLS certificate SHA-256: 07:0D:1B:D4:A4:D3:EE:61:E8:6B:F6:B4:F3:FD:82:4C:89:7A:95:5E:D8:73:04:8D:D2:FD:6A:2A:D9:35:A6:5F
accounts able to log in at the Cinnamon remote desktop: none (set one with: sudo passwd <user>)
0.0.0.0:22
127.0.0.53%lo:53
127.0.0.54:53
[::]:22

The only listener reachable from outside the machine is SSH on port 22. The two port 53 entries are the local DNS resolver, bound to loopback addresses only.

Step 5: Confirm which stack owns the network

This image ships NetworkManager because Cinnamon requires it, so it is worth seeing for yourself that it is not managing anything:

networkctl list | awk 'NR==1 || /eth0/'
nmcli -t -f DEVICE,STATE device status
netplan get network.renderer

Expected output:

IDX LINK TYPE     OPERATIONAL SETUP
  2 eth0 ether    routable    configured
eth0:unmanaged
lo:unmanaged
networkd

eth0 is routable / configured under systemd-networkd, and NetworkManager reports every device as unmanaged.

Step 6: Set your password and turn remote desktop on

The Cinnamon login box asks for your account password, and a new VM has none. Choose your own. Run this yourself on the VM, and enter the new password twice when prompted:

sudo passwd azureuser

Then turn the remote desktop on:

sudo cloudimg-remote-desktop enable

Expected output:

remote desktop enabled: listening on port 3389
TLS certificate SHA-256: 07:0D:1B:D4:A4:D3:EE:61:E8:6B:F6:B4:F3:FD:82:4C:89:7A:95:5E:D8:73:04:8D:D2:FD:6A:2A:D9:35:A6:5F
sign in with your own account name and the password you set with sudo passwd
safest route: ssh -L 3389:localhost:3389 <user>@<vm-ip>, then point your RDP client at localhost:3389

Setting a password for the desktop does not enable SSH password logins. SSH stays key only.

Step 7: Connect with your RDP client

The recommended route does not open port 3389 to the internet at all. From your own machine, open an SSH tunnel:

ssh -N -L 3389:localhost:3389 azureuser@<vm-ip>

Leave that running, and point your RDP client at localhost:3389. At the xrdp login box, enter azureuser and the password you set in Step 6.

If you would rather connect directly, add an NSG rule for port 3389 scoped to your own address, never to the internet:

az network nsg rule create --resource-group myResourceGroup --nsg-name my-ubuntu-cinnamonNSG \
  --name allow-rdp-from-me --priority 1010 --access Allow --protocol Tcp \
  --direction Inbound --destination-port-ranges 3389 --source-address-prefixes <public-ip>/32

Step 8: Use the desktop

The Cinnamon panel runs along the bottom of the screen:

  • The menu button at the far left opens the applications menu, with a search box and the usual categories.
  • Next to it are quick launchers for Files (Nemo) and Terminal.
  • The middle of the panel is the window list.
  • The right-hand end holds the system tray and the clock.

System Settings (menu → System Settings) is Cinnamon's control centre: backgrounds, panel layout, applets, themes, display resolution, keyboard and mouse.

The screen lock is switched off by default on this image. A lock screen that appears while you are away is the most common support call on a remote desktop, and it protects nothing extra here — xrdp authenticates every new connection through PAM against your account password either way. To turn it on:

gsettings set org.cinnamon.desktop.screensaver lock-enabled true
gsettings set org.cinnamon.desktop.session idle-delay 300

or use System Settings → Screensaver.

Step 9: Verify the security posture

echo "root password state: $(sudo passwd -S root | awk '{print $2}')"
sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin)'
sudo aa-status --enabled && echo "AppArmor: enforcing"

Expected output:

root password state: L
permitrootlogin prohibit-password
passwordauthentication no
AppArmor: enforcing

L means the root password is locked.

Step 10: Check the patch level

echo "pending upgrades: $(sudo apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade 2>/dev/null | grep -cE '^Inst ' || true)"
sudo pro security-status --format=json | python3 -c "import json,sys;s=json.load(sys.stdin)['summary'];print('esm-infra updates:',s['num_esm_infra_updates'],' esm-apps updates:',s['num_esm_apps_updates'],' standard security updates:',s['num_standard_security_updates'])"

Expected output on a freshly deployed VM:

pending upgrades: 0
esm-infra updates: 0  esm-apps updates: 0  standard security updates: 0

Step 11: Turn remote desktop off again

sudo cloudimg-remote-desktop disable

Expected output:

remote desktop disabled: nothing listening on port 3389

To change your desktop password later, sudo passwd azureuser. To print this VM's connection details at any time, sudo cloudimg-remote-desktop credentials.

Common Use Cases

  • A Linux desktop in the cloud for developers who want a conventional, menu-driven environment
  • A remote workstation reachable from a laptop or tablet over RDP
  • Browser and GUI application testing on a clean Ubuntu desktop
  • Training and demonstration machines that can be created and destroyed per session
  • A jump host with a graphical environment for tools that have no command line equivalent

Troubleshooting

The RDP client connects but the screen is black, or the session closes immediately

Check that a session actually started:

sudo journalctl -u xrdp -u xrdp-sesman --since "-10 min" --no-pager | tail -30

Look for Access permitted for user: followed by session is available on display. If PAM refused you, you will see AUTHFAIL instead: the password is wrong, or you have not set one yet.

I connected a second time and was immediately disconnected

Cinnamon's session manager allows one session per account. Closing an RDP client does not end the session, so reconnecting reattaches to the session you left, which is what you usually want. But opening a second, simultaneous connection as the same user will be dropped. Disconnect the first client, or log in as a different account.

The RDP login box will not accept my password

Set one first: sudo passwd azureuser. A new VM has no password on any account by design.

I get "connection refused" on localhost:3389

Your SSH tunnel is not running, or remote desktop is off. Check sudo cloudimg-remote-desktop status on the VM, and that the ssh -N -L 3389:localhost:3389 command is still running locally.

The network applet shows no connections

That is expected. See "A note on NetworkManager" above: systemd-networkd owns the NIC on this image and NetworkManager is deliberately managing nothing.

The desktop resolution is wrong

Set the session size in your RDP client before connecting, or use System Settings → Display once you are in.

Cannot connect via SSH

Confirm the NSG allows port 22 from your address and that you are using the key you supplied at deployment. SSH is key only on this image.

Azure agent not running

sudo systemctl status walinuxagent

The Azure Linux Agent is installed and enabled on this image and coexists with the desktop. If it is not running, sudo systemctl restart walinuxagent.

Important Notes

  • Ubuntu 26.04 LTS receives standard security maintenance until 29 May 2031.
  • The Cinnamon desktop, LightDM and xrdp come from the Ubuntu universe archive; see "A note on package support" above.
  • Remote desktop ships disabled. Nothing listens on 3389 until you enable it.
  • There is no default password on this image, and no RDP credential of its own: the only password is the one you set.
  • The per-VM TLS certificate and xrdp RSA key are generated at first boot and are unique to your machine.
  • Do not delete /etc/netplan/00-cloudimg-renderer.yaml or /etc/NetworkManager/conf.d/10-cloudimg-unmanaged.conf unless you are deliberately switching the machine to NetworkManager, and then change both.
  • cloudimg charges nothing for the software. Azure bills the compute and storage the VM consumes at their normal rates.

Support

cloudimg provides 24/7 support for this image. Contact support@cloudimg.co.uk with your Azure region, VM size and a description of the issue.