Containing VDI by Falling into a Kasm

Spin up a Linux VM in Azure - does require having a subscription and the under the hood infrastructure goodness.  Here are a few details to keep in mind while creating this virtual machine.  You're going to need a virtual network (with subnetting) to deploy this single vm (or larger subnetting if you are looking deploy the multi-server version). The vnet will require a delegated subnet for the Azure firewall (named appropriately, AzureFirewallSubnet).  Do not add a public IP address to the server, as long as you can use Azure Bastion, or vpn to access it.  For the vm keep the minimum requirements in mind on both the supported OS (Ubuntu, Debian, etc.) and size (my recommendation here would be a Standard D2s v3 or larger).  Lastly, ensure that you meet the storage requirements (because I had to upgrade my virtual hard drive from the default 32 GiB) to Disk tier P6 at 64 GiB, and (if you want to keep this non-ephemeral) add a swap partition (or for Ubuntu).

Deploy an Azure Firewall - follow these instructions, specifically the section for setting up a DNAT rule.  You will need to know the IP address of your server and the Public IP address of this Azure Firewall so save it for creating the policy.  For sake of ease here is a screen from my Firewall Policy.  Keep in mind that the Destination is the Public IP address of the Firewall and Translated Address is the IP address of the virtual machine:

Install and Run Kasm - Following the instructions from here, you can walk through this very quickly.  I did however make a script, the reason being is that the mount point (/mnt) for the swap is ephemeral.  A reboot will kill this installation which candidly is fine by me because I am using this only for testing.  (That being said, creating a swap can be done by editing the /etc/waagent.conf file (please create a backup) and edit the following lines:

• ResourceDisk.Format=y
• ResourceDisk.EnableSwap=y
• ResourceDisk.SwapSizeMB={SIZE_OF_SWAP}

In my case for testing I just created a 2048 sized swap.  See from this script (if have the swap then just comment out swap creation and mounting section).  After running the script or installing it manually you need to remember to enable port 443 on the VM.  Easy as 1, 2, 3 from the command line with az command line, or Cloud shell:

1. az login
2. az account set --subscription "{YOUR_SUBSCRIPTION_NAME}"
3. az vm open-port --resource-group "{VM_RESOURCE_GROUP}" --name "{VM_NAME}" --port 443

Save and run the script but be sure to capture and secure the output.  As a script, I just export the stdout to a file in my home directory (please secure it with chmod 600 kasm_access.txt) like this:

sudo deploy_kasm.sh > ~/kasm_access.txt; chmod 600 ~/kasm_access.txt

Script for reference: