On 04/28/2018 08:50 PM, Stuart Perkins wrote:
Hi list.
I'm considering setting up Qubes capable server at my home. What I need, however, is to be able to
remotely control it. Updates...reboot/stop/start system and app vm's etc. Is this even possible
with Qubes? I currently run a Ubuntu powered old laptop as a "server" and have it
hosting a couple of VM's with virtualbox. I can ssh into it and even have an sshuttle setup for
VPN over SSH functionality for when I need to do something "gui" remotely. One of my
VM's is an old XP system which monitors my solar electric. One is a ubuntu install hosting a Drupal
website. One is also installed which is a full blow VPN server for when I need to do more than
just simple things...I rarely use this one.
I will be upgrading my "server" hardware to a real server class platform one of
these days, and I would like something specific to running independent VM's, but the
remote maintenance might be a Qubes eliminating need...
Anybody here attacked a remote console to dom0 before, or does it so completely
violate the philosophy of Qubes that it is an absolute no-way-in-hell thing?
Stuart
Hi Stuart,
Philosophies aside, you can do whatever you want :) Adding networking
to dom0 is certainly defeating a lot of the hardwork/security that went
into qubes. If you wanted to go this route you might consider just
running Xen directly? Especially if you are putting this in your
closet/basement?
There is another issue however, aside from just giving dom0 network
access, and that's the LUKS password. If you needed to reboot the
machine entirely from remote, you'd be stuck if you had LUKS encryption
on the disk with no way to enter it remotely.
Unless.... you do what I did, and hook up a Raspberry Pi to the serial
console of my machine, and update the kernel boot line in grub to use
the serial console (Note: This REQUIRES you to use the serial console to
enter the LUKS password, you lose the ability to enter it from your
keyboard locally).
Stating the obvious, if someone gets access to the Raspberry Pi I'd be
in a bit of trouble, though as long as I remember to log out of the
shell at the serial console on the Pi, someone compromising that machine
does not immediately give them access to the Qubes box, they would have
to guess my password or wait for me to log back in and enter it if I
didn't know they were there and they could capture it. I run OSSEC on
this PI to help combat that issue.
Also considering defense in depth, I can only access that Raspberry Pi
via VPN, I do NOT expose it directly to the internet, it also sits on
it's own VLAN which I leave isolated, so when I do have to do remote
administration I first have to grant access to that VLAN from my router
console.
So at the end of the day, less secure? Yes. Added convenience? Yes.
Added complexity? Yes...
You can draw the line wherever you want :)
Ed
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/pc4lao%24llv%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.
