X2Go Server on Ubuntu 24.04 on Azure User Guide

Overview

This image runs a ready to use remote graphical desktop server built on X2Go, the open source remote desktop system for Linux. A user connects from a Windows, macOS or Linux X2Go client, authenticates over SSH, and is given a complete XFCE desktop session that is tunnelled over SSH and NX compressed, so it stays responsive even on slow or high latency links. Sessions can be suspended and resumed later from a different machine.

You connect to the desktop as the administrator account you create when you deploy the VM, using the same SSH key (or password) you chose in the Azure portal. The image ships with no other login account and no password of any kind. When you want to give someone a separate, non administrator desktop, one command (x2go-add-desktop-user) creates that user on your VM with a strong password generated there.

A built in tool, x2go-session-selftest, establishes a real X2Go desktop session against the server and confirms a full XFCE desktop actually starts, so you can verify the server end to end at any time.

What is included:

• X2Go Server (x2goserver, Ubuntu 24.04 noble universe) with a light XFCE desktop
• Log in to the desktop as your own administrator account, with your SSH key or password
• No preset accounts or passwords in the image
• x2go-add-desktop-user to create extra non administrator desktop users, each with its own password
• Built in x2go-session-selftest that proves a real XFCE session starts
• Session suspend and resume, NX compression for low bandwidth links
• 24/7 cloudimg support

Prerequisites

Before you deploy this image you need:

• An active Microsoft Azure subscription where you can create virtual machines
• An SSH key pair (recommended) or a password for the administrator account; you use the same credential for SSH and for the X2Go desktop
• A virtual network and subnet in the target region, with a network security group (NSG) allowing inbound port 22 from the networks your desktop users and administrators connect from
• The Azure CLI installed locally if you plan to deploy from the command line, and an X2Go client on your own computer (X2Go Client for Windows, macOS or Linux)

Standard_B2s (2 vCPU / 4 GiB RAM) comfortably runs a single XFCE desktop session. Each additional concurrent desktop session needs more memory, so size the VM up (for example Standard_B2ms or larger) if several users will connect at once. X2Go rides on the SSH port, so only inbound port 22 is required on the NSG.

Step 1: Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for X2Go Server by cloudimg. Select the listing and choose Create.

On the Basics tab pick your subscription and resource group, a region, and a VM size (Standard_B2s or larger). Under Administrator account select SSH public key (recommended) or Password, and set the username. This account is the one you log in to the desktop with. Under Inbound port rules allow SSH (22). Select Review + create, then Create. First-boot initialisation completes within a few seconds of the VM reaching the Running state.

Step 2: Deploy from the Azure CLI

The following block creates a VM from the cloudimg X2Go Server image into an existing VNet and subnet. Replace the placeholders with your own values.

az vm create \
  --resource-group <your-rg> \
  --name x2go-server \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Open inbound SSH (port 22) on the VM's network security group, restricted to the networks your users connect from.

Step 3: Connect as the Administrator over SSH

Connect to the VM as the administrator with the credential you chose at deployment:

ssh azureuser@<your-vm-public-ip>

The login banner summarises how to connect a desktop client. The server address recorded at first boot is in a root only file:

sudo cat /root/x2go-connection.txt

Step 4: Connect from an X2Go Client to Your Desktop

Install X2Go Client on your own computer, then create a new session:

Session name : my-cloud-desktop
Host         : <your-vm-public-ip>
Login        : azureuser
SSH port     : 22
Session type : XFCE

Use the administrator username you set when you deployed the VM. If you deployed with an SSH key, tick Use RSA/DSA key for ssh connection in the session settings and select your private key file; if you deployed with a password, enter it when prompted. A full XFCE desktop opens in the X2Go window. You can suspend the session and resume it later, from the same or a different machine, without losing your running applications.

Step 5: Verify the Server Can Start a Desktop Session

The image ships with a built in self-test. It creates a temporary account with a one time SSH key, logs in over SSH the way an X2Go client does, starts a real XFCE session, and then deletes the temporary account. Run it as root:

sudo x2go-session-selftest

Expected output:

Part A OK: SSH login works (the X2Go transport)
Part B OK: XFCE desktop session 'x2go-selftest-50-...' running on display :50
OK: X2Go desktop session established and torn down

You can list your own active X2Go sessions at any time. A session in state R is running:

x2golistsessions

Step 6: Add More Desktop Users

To give another person their own non administrator desktop with a password, run:

sudo x2go-add-desktop-user alice

The command creates the user alice without sudo rights, generates a strong password on your VM, prints it once and saves it to /root/x2go-users/alice.txt (readable by root only). It also enables SSH password login for that one user through a drop in file, /etc/ssh/sshd_config.d/60-x2go-user-alice.conf. Every other account is unchanged. The user then connects an X2Go client with alice and that password, session type XFCE. To set a password of your own choosing later:

sudo passwd alice

To remove the user again:

sudo userdel -r alice
sudo rm /etc/ssh/sshd_config.d/60-x2go-user-alice.conf /root/x2go-users/alice.txt
sudo systemctl reload ssh

Each concurrent desktop session uses additional memory, so size the VM to the number of simultaneous users you expect.

Step 7: Authentication and Security Model

The image contains no login account other than the administrator you create at deployment, and no password. SSH password authentication is off by default (PasswordAuthentication no); Azure turns it on for the administrator only if you choose a password at deployment. Extra desktop users get password login only when you create them with x2go-add-desktop-user. You can check the effective setting for any user:

sudo sshd -T -C user=azureuser | grep -i passwordauthentication

Expected output for a VM deployed with an SSH key:

passwordauthentication no

Step 8: Desktop Audio

The server does not run a PulseAudio sound daemon. X2Go clients can forward sound from the remote session to your computer's own PulseAudio server; enable Sound support in the client session settings if you need it.

Step 9: What Is Installed

The X2Go server, the XFCE desktop and the session housekeeping daemon are all installed and enabled. You can review versions and service state at any time:

dpkg-query -W -f='${Package} ${Version}\n' x2goserver xfce4-session xfce4-terminal
systemctl is-active ssh x2goserver x2go-server-firstboot

Expected output:

x2goserver     4.1.0.6-1.1build1
xfce4-session  4.18.3-1build2
xfce4-terminal 1.1.3-1build1
active
active
active

Hardening Notes

• The image ships with no preset accounts or passwords. You log in as the administrator you create at deployment, and password logins exist only for users you add with x2go-add-desktop-user.
• Prefer SSH keys for the administrator account, and remove desktop users you no longer need.
• Restrict inbound port 22 on the network security group to the networks your users connect from, and consider a VPN or bastion for remote access.
• Users created with x2go-add-desktop-user have no sudo rights; administration is done through the administrator account.
• Keep the OS current: unattended security upgrades are enabled, and x2goserver and the XFCE packages are updated through the normal Ubuntu package path.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating X2Go Server, contact the cloudimg support team listed on the Azure Marketplace listing.