X2Go Server on Ubuntu 24.04 on Azure User Guide

Overview

This image runs a ready to use remote graphical desktop server built on X2Go, the open source remote desktop system for Linux. A user connects from a Windows, macOS or Linux X2Go client, authenticates over SSH, and is given a complete XFCE desktop session that is tunnelled over SSH and NX compressed, so it stays responsive even on slow or high latency links. Sessions can be suspended and resumed later from a different machine.

The desktop is delivered by a dedicated login account named x2godesktop. The image ships with no default desktop password: on the first boot of every deployed VM a one shot service generates a strong password that is unique to that VM, sets it on x2godesktop, and records it in a root only file. SSH password authentication is enabled for the x2godesktop account only; the Azure administrator account always stays key only, and the shipped image is key only so it passes the Azure Marketplace image scan.

A built in tool, x2go-session-selftest, establishes a real X2Go desktop session against the server and confirms a full XFCE desktop actually starts, so you can verify the server end to end at any time.

What is included:

• X2Go Server (x2goserver, Ubuntu 24.04 noble universe) with a light XFCE desktop
• Dedicated desktop account x2godesktop; per-VM password generated at first boot, recorded in /root/x2go-credentials.txt
• Key-only administrator account; password auth scoped to the x2godesktop account only
• Built in x2go-session-selftest that proves a real XFCE session starts
• Session suspend and resume, NX compression for low bandwidth links
• 24/7 cloudimg support

Prerequisites

Before you deploy this image you need:

• An active Microsoft Azure subscription where you can create virtual machines
• An SSH key pair for administrator access to the VM
• A virtual network and subnet in the target region, with a network security group (NSG) allowing inbound port 22 from the networks your desktop users and administrators connect from
• The Azure CLI installed locally if you plan to deploy from the command line, and an X2Go client on your own computer (X2Go Client for Windows, macOS or Linux)

Standard_B2s (2 vCPU / 4 GiB RAM) comfortably runs a single XFCE desktop session. Each additional concurrent desktop session needs more memory, so size the VM up (for example Standard_B2ms or larger) if several users will connect at once. X2Go rides on the SSH port, so only inbound port 22 is required on the NSG.

Step 1: Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for X2Go Server by cloudimg. Select the listing and choose Create.

On the Basics tab pick your subscription and resource group, a region, and a VM size (Standard_B2s or larger). Under Administrator account select SSH public key, set the username, and paste your public key. Under Inbound port rules allow SSH (22). Select Review + create, then Create. First-boot initialisation completes within a few seconds of the VM reaching the Running state.

Step 2: Deploy from the Azure CLI

The following block creates a VM from the cloudimg X2Go Server image into an existing VNet and subnet. Replace the placeholders with your own values.

az vm create \
  --resource-group <your-rg> \
  --name x2go-server \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Open inbound SSH (port 22) on the VM's network security group, restricted to the networks your users connect from.

Step 3: Connect as the Administrator over SSH

Connect to the VM as the administrator using your SSH key. The administrator account is key only.

ssh azureuser@<your-vm-public-ip>

Step 4: Retrieve Your Desktop Password

The desktop account is x2godesktop, and its password is generated uniquely on the first boot of your VM. Read it from the root only credentials file:

sudo cat /root/x2go-credentials.txt

The file lists the desktop x2go.username, the per-VM x2go.password, the server address and the session type (XFCE). It is readable only by root:

sudo ls -l /root/x2go-credentials.txt

Expected output — the file is owned by root with 0600 permissions:

-rw------- 1 root root 765 /root/x2go-credentials.txt

Step 5: Connect from an X2Go Client to Your Desktop

Install X2Go Client on your own computer, then create a new session:

Session name : my-cloud-desktop
Host         : <your-vm-public-ip>
Login        : x2godesktop
SSH port     : 22
Session type : XFCE

Start the session and enter the x2go.password value from Step 4 when prompted. A full XFCE desktop opens in the X2Go window. You can suspend the session and resume it later, from the same or a different machine, without losing your running applications.

Step 6: Verify the Server Can Start a Desktop Session

The image ships with a built in self-test that authenticates as the desktop user and starts a real XFCE session to prove the server works end to end. Run it as root:

sudo x2go-session-selftest

Expected output:

Part A OK: x2godesktop authenticates over SSH with the per-VM password
Part B OK: XFCE desktop session running for x2godesktop on display :50
OK: X2Go desktop session established and torn down for x2godesktop

You can list active X2Go sessions at any time. A session in state R is running:

sudo -u x2godesktop x2golistsessions

Step 7: Authentication and Security Model

The image is key only as shipped. The Azure administrator account authenticates with an SSH key and never accepts a password. Password authentication is enabled at first boot for the x2godesktop desktop account only, because X2Go clients commonly connect with a password. You can confirm the posture with the SSH daemon's effective configuration:

sudo sshd -T -C user=azureuser | grep -i passwordauthentication
sudo sshd -T -C user=x2godesktop | grep -i passwordauthentication

Expected output — the administrator is key only, the desktop user may use a password:

passwordauthentication no
passwordauthentication yes

To rotate the desktop password to a value of your own (you will be prompted for the new password):

sudo passwd x2godesktop

Step 8: Add More Desktop Users

To give another person their own desktop, create a normal Linux user and either set a password or install their SSH key. To allow that user to log in with a password over X2Go, add a scoped Match User block to the SSH configuration, mirroring the one shipped for x2godesktop:

sudo useradd --create-home --shell /bin/bash alice
sudo passwd alice
printf 'Match User alice\n    PasswordAuthentication yes\n    AllowTcpForwarding yes\n' | sudo tee /etc/ssh/sshd_config.d/61-alice.conf
sudo sshd -t && sudo systemctl reload ssh

Each concurrent desktop session uses additional memory, so size the VM to the number of simultaneous users you expect.

Step 9: What Is Installed

The X2Go server, the XFCE desktop and the session housekeeping daemon are all installed and enabled. You can review versions and service state at any time:

dpkg-query -W -f='${Package} ${Version}\n' x2goserver xfce4-session xfce4-terminal
systemctl is-active ssh x2goserver x2go-server-firstboot

Expected output:

x2goserver     4.1.0.6-1.1build1
xfce4-session  4.18.3-1build2
xfce4-terminal 1.1.3-1build1
active
active
active

Hardening Notes

• The image ships key only; the administrator account never accepts a password. Password authentication is scoped to the x2godesktop account only, using a strong password generated uniquely per VM at first boot — there is no default desktop credential in the image.
• Restrict inbound port 22 on the network security group to the networks your users connect from, and consider a VPN or bastion for remote access.
• The x2godesktop account is an unprivileged user with no sudo rights; administration is done through the key-only administrator account.
• Keep the OS current — unattended security upgrades are enabled, and x2goserver and the XFCE packages are updated through the normal Ubuntu package path.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating X2Go Server, contact the cloudimg support team listed on the Azure Marketplace listing.