[qubes-users] XSA-282 does not affect the security of Qubes OS
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Dear Qubes Community, The Xen Project has published Xen Security Advisory 282 (XSA-282). This XSA does *not* affect the security of Qubes OS, and no user action is necessary. This XSA has been added to the XSA Tracker: https://www.qubes-os.org/security/xsa/#282 This announcement is also available on the Qubes website: https://www.qubes-os.org/news/2018/11/06/xsa-282-qubes-not-affected/ - -- Andrew David Wong (Axon) Community Manager, Qubes OS https://www.qubes-os.org -BEGIN PGP SIGNATURE- iQIzBAEBCgAdFiEEZQ7rCYX0j3henGH1203TvDlQMDAFAlviOC4ACgkQ203TvDlQ MDBnuw//QzKjnmY3MTmmn0icf1G6Zvlqk3g8xdbeRNIigh/wea//TdJWIbfhOX7p BedvHSLsG1Ibe+ENzjyrhQikYkbDZKSkl4L6Ol0xCB+xAvjsDhtAyeCtTNbjLdfv IyNU5Tr1gxvpuWE4Nm40eBJ5dfpn8VPvD44NhcfHD5SWg8J/gzB5v8rehev7uV5r 9/Lsb/MYGAUdEWVAdWai/lQrChohPNwKbKaZTTH9gD2kJzJjv3AXNCSxrLDlVaDr /WcHMPZUlw9I4oT+4n7M1men1jFM6NIqJs5RiiNZXFt8gi2DMUn9EU1omE+NREqF cv/kT5qUhtKABjEc1DgIE5R/sAB5w1kqyDHueu8FIvQpMF5uEoO0uRdygPbXVPjC 88Ub4RbnNKd1G9VITjnSrBV7OJQtQbIjlKbNNSKODcydMrITa70prejWlPtbW6vE 44vVjBO2aT1e0QMXKtNIb9OIwu0qVsVmp79M/Uy23eO3vzFe2h+0auBADjli/3Nt 9TaZoKTdxx1NutAN7QRqwCjJnJvh0h/JJTSRqDbxo2Xb5zAFYXcZdeCDCe1qXV0y VHaGKT0kVccdJWUhLgdVeGAyaIBxtwczzBzvsOOOMIDyrA/PJkAay8mUEtp5AfPS Zwu47Nd1g+IvCnHX46r8rJUezy2gLygQgHJSdkOaClNR0QRvYrY= =F/Eg -END PGP SIGNATURE- -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/6f432c43-88e5-8469-94ea-a05f21445967%40qubes-os.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: Size of HVM VM's
On Mon, Nov 05, 2018 at 06:07:12PM -0800, ma77be...@gmail.com wrote: > > > > I tried it and it worked! Thankyou! > > How did you change the resolution? I only see 800*600 option in Ubuntu HVM. > I tried https://www.qubes-os.org/doc/linux-hvm-tips/, which only enlarge to > 1024-768. > And when I run "X -configure :1", it shows errors, I have to hard code a > xorg.conf file, which is not the right method, I know. > How to change it the larger size? > Thanks > Try this in your HVM, using whatever modes you want to try: sudo apt-get install xvfb xfonts-100dpi xfonts-75dpi xfstt Edit /etc/default/grub, and set: GRUB_GFXMODE=1600x1200,1280x1024,800x600 GRUB_PAYLOAD_LINUX=keep sudo update-grub Then in dom0: qvm-features video-model cirrus You should be able to get at least 1280x1024 unman -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20181107003632.5jka3geeuuangv6d%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Disk Manager does not start
On Tue, Nov 06, 2018 at 04:35:12PM -0600, William Fisher wrote: > The back ups were encrypted but the drive was not. How do I attach the > drive if I can’t use File Manager? > > On Tue, Nov 6, 2018 at 9:34 AM unman wrote: > > > On Mon, Nov 05, 2018 at 03:23:27PM -0800, William Fisher wrote: > > > I have a Widows 7 VM saved on a HDD from my previous Qubes 3.2 and I am > > trying to install it and various other VMs that were “Backed up” On that > > HDD to my Qubes 4.0 installation. The HDD is recognizied by Qubes 4.0 but I > > can’t see it on the Back up/restore list of files and I do not know how to > > start the Disk File Manager tool to “mount” the HDD to access the stored > > VMs. > > > > > > > I think that awokd has suggested the right path. > > Attach the block device to another qube, and then select *that* qube > > in the back up tool. > > > > Was the HDD encrypted? > > What was the partition scheme? > > If so you will need to decrypt it, and mount the relevant partitions in Open a terminal in dom0: use qvm-block to identify the HDD. Then do what awokd suggested: start a qube and use qvm-block to attach the relevant partition to that qubes. Use qvm-block to ensure that the HDD partition is attached. Open a terminal in the qube. Check that the relevant partition appears as /dev/xvdi sudo mount /dev/xvdi /mnt Confirm contents of /mnt Open Qubes restore tool Select qubes, click on ... button. If that doesn't work, then you can try use command line tool: qvm-backup-restore Always watch for errors on commands. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20181107002228.is3ywclhmkbugpfk%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Disk Manager does not start
The back ups were encrypted but the drive was not. How do I attach the drive if I can’t use File Manager? On Tue, Nov 6, 2018 at 9:34 AM unman wrote: > On Mon, Nov 05, 2018 at 03:23:27PM -0800, William Fisher wrote: > > I have a Widows 7 VM saved on a HDD from my previous Qubes 3.2 and I am > trying to install it and various other VMs that were “Backed up” On that > HDD to my Qubes 4.0 installation. The HDD is recognizied by Qubes 4.0 but I > can’t see it on the Back up/restore list of files and I do not know how to > start the Disk File Manager tool to “mount” the HDD to access the stored > VMs. > > > > I think that awokd has suggested the right path. > Attach the block device to another qube, and then select *that* qube > in the back up tool. > > Was the HDD encrypted? > What was the partition scheme? > If so you will need to decrypt it, and mount the relevant partitions in > the qube to which you attach the device. > > -- > You received this message because you are subscribed to a topic in the > Google Groups "qubes-users" group. > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/qubes-users/8jcUCKxJoU4/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > qubes-users+unsubscr...@googlegroups.com. > To post to this group, send email to qubes-users@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/qubes-users/20181106153417.iyqhrkhaobnrbcif%40thirdeyesecurity.org > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/CAJyh_i-738oH65dwD%2B7ZGkTK3cqP1KO4roZ-naGNGwa4Tep2xg%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: Qubes 3.2: No Internet Connection, neither with Wi-Fi, neither with Ethernet. HELP PLEASE!
Ok on first boot after install Qubes will show the kernel failure and bypass and boot into dom0. Once there, in the Qubes manager dom0 has green state. Lol ok don’t laugh too hard. So I checked devices like have been, sys-net as you mentioned. Both Ethernet and WiFi devices are there. So I just removed my Ethernet from device selection and bingo sys-net green state! So I will try now to run system updates for dom0 and fedora. Thanks again for point things out. Sometimes you look at something so crazy and just need a second thought. So, can you show me how to check logs if I run into issues? Lol please and thanks On Tue, Nov 6, 2018 at 4:09 PM 'awokd' via qubes-users < qubes-users@googlegroups.com> wrote: > > LMiller M: > > Update: Kernel failure during boot install OS 4.0 > > > > After the install booted into dom0, checking Qubes kernel package to see > > what three were stored or available. Mine only list one kernel. > > > > 4.14.18-1 > > > > I checked using the rpm -qa ‘kernel-Qubes-vm*’ > > > > Using the install update option I get: > > > > Unable to reset pci device :03:00.2: > > > > Trying to apply the device to the selected box: error: device tab: can’t > > attach pci device to VM in pvh mode > > > > Does that mode need to be changed? > > > > Stupid question but because honestly I don’t know. How do you check the > > logs? I’m the terminal? > > > > I downloaded the new kernel to cd, can install from the cd? I don’t see > > anything on the Qubes kernel page except download from internet throw > > Qubes. With internet I can’t. > > > > > > On Tue, Nov 6, 2018 at 10:39 AM LMiller M <56lmil...@gmail.com> wrote: > > > >> So, after looking more into the kernel issue. I see on the Qubes site > some > >> instructions for trying to change the kernel. I’m going to do a > reinstall > >> of the 4.0 os to get back into Dom0 and try it out. I will post back > >> hopefully with success.. > >> On Mon, Nov 5, 2018 at 8:02 PM LMiller M <56lmil...@gmail.com> wrote: > >> > >>> Ok so one more if I can please, this is on a Asus K56c laptop and it > has > >>> a kernel failure on boot with Qubes Os 4.0. On the first install it > shows > >>> the kernel failure and it boots to the OS don0. If I turn off or > reboot it > >>> shows my kernel failure and won’t load into the os. > >>> > Glad you got your other computer working at least! So on this one, where > are you getting this kernel failure exactly? If it's booting to dom0, > I'm not following where you're having trouble. There's a message on boot > about failed to load kernel modules that can be safely ignored. > > To update dom0, you want to use "sudo qubes-dom0-update". You should > rarely need to update the kernel by itself. > > Is that when you are getting the PCI reset error? Is your sys-net > started? Check in Qube Manager. Then, check sys-net's Qube > Settings/Devices to see what's attached there and if 03:00.2 is one of > the devices. If so, see what it is. > > -- > You received this message because you are subscribed to a topic in the > Google Groups "qubes-users" group. > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/qubes-users/sEh2LQFiOxI/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > qubes-users+unsubscr...@googlegroups.com. > To post to this group, send email to qubes-users@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/qubes-users/326f794c-5658-c3bb-a8c7-7ed43b1d63ee%40danwin1210.me > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/CAOugA3paUbTFaWvTxW%2BM%2Bnb0yX9QbTR%3D5qmqpRuuBBeH70OTng%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: Qubes 3.2: No Internet Connection, neither with Wi-Fi, neither with Ethernet. HELP PLEASE!
LMiller M: Update: Kernel failure during boot install OS 4.0 After the install booted into dom0, checking Qubes kernel package to see what three were stored or available. Mine only list one kernel. 4.14.18-1 I checked using the rpm -qa ‘kernel-Qubes-vm*’ Using the install update option I get: Unable to reset pci device :03:00.2: Trying to apply the device to the selected box: error: device tab: can’t attach pci device to VM in pvh mode Does that mode need to be changed? Stupid question but because honestly I don’t know. How do you check the logs? I’m the terminal? I downloaded the new kernel to cd, can install from the cd? I don’t see anything on the Qubes kernel page except download from internet throw Qubes. With internet I can’t. On Tue, Nov 6, 2018 at 10:39 AM LMiller M <56lmil...@gmail.com> wrote: So, after looking more into the kernel issue. I see on the Qubes site some instructions for trying to change the kernel. I’m going to do a reinstall of the 4.0 os to get back into Dom0 and try it out. I will post back hopefully with success.. On Mon, Nov 5, 2018 at 8:02 PM LMiller M <56lmil...@gmail.com> wrote: Ok so one more if I can please, this is on a Asus K56c laptop and it has a kernel failure on boot with Qubes Os 4.0. On the first install it shows the kernel failure and it boots to the OS don0. If I turn off or reboot it shows my kernel failure and won’t load into the os. Glad you got your other computer working at least! So on this one, where are you getting this kernel failure exactly? If it's booting to dom0, I'm not following where you're having trouble. There's a message on boot about failed to load kernel modules that can be safely ignored. To update dom0, you want to use "sudo qubes-dom0-update". You should rarely need to update the kernel by itself. Is that when you are getting the PCI reset error? Is your sys-net started? Check in Qube Manager. Then, check sys-net's Qube Settings/Devices to see what's attached there and if 03:00.2 is one of the devices. If so, see what it is. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/326f794c-5658-c3bb-a8c7-7ed43b1d63ee%40danwin1210.me. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: Qubes 3.2: No Internet Connection, neither with Wi-Fi, neither with Ethernet. HELP PLEASE!
Update: Kernel failure during boot install OS 4.0 After the install booted into dom0, checking Qubes kernel package to see what three were stored or available. Mine only list one kernel. 4.14.18-1 I checked using the rpm -qa ‘kernel-Qubes-vm*’ Using the install update option I get: Unable to reset pci device :03:00.2: Trying to apply the device to the selected box: error: device tab: can’t attach pci device to VM in pvh mode Does that mode need to be changed? Stupid question but because honestly I don’t know. How do you check the logs? I’m the terminal? I downloaded the new kernel to cd, can install from the cd? I don’t see anything on the Qubes kernel page except download from internet throw Qubes. With internet I can’t. On Tue, Nov 6, 2018 at 10:39 AM LMiller M <56lmil...@gmail.com> wrote: > So, after looking more into the kernel issue. I see on the Qubes site some > instructions for trying to change the kernel. I’m going to do a reinstall > of the 4.0 os to get back into Dom0 and try it out. I will post back > hopefully with success.. > On Mon, Nov 5, 2018 at 8:02 PM LMiller M <56lmil...@gmail.com> wrote: > >> Ok so one more if I can please, this is on a Asus K56c laptop and it has >> a kernel failure on boot with Qubes Os 4.0. On the first install it shows >> the kernel failure and it boots to the OS don0. If I turn off or reboot it >> shows my kernel failure and won’t load into the os. >> >> I seen something saying I should be able to change the kernel (maybe >> during the install) don’t remember. I found the kernels on the Qubes site >> that are excepted, I just don’t see how the change it. Maybe I’m >> overlooking, I’m not a major Linux person. I know a small bit of ubantu >> >> In this Asus I have the Acronis Loader, I don’t think that has anything >> to do with it. Just putting it out there. >> >> Qubes OS is the only os install on this laptop drive. All virtual options >> are enabled. Boots to my login password then stalls. >> >> Any ideas? >> On Mon, Nov 5, 2018 at 7:37 PM LMiller M <56lmil...@gmail.com> wrote: >> >>> I want to thank you both. Sorry for the late reply I wasn’t able to make >>> the necessary adjustments till now. >>> >>> I feel like a fool, I didn’t think about treating my desktop as a >>> virtual box fresh install. Which completely makes sense because of the >>> Qubes basic idea of the OS! Lol omg... >>> >>> Anyway, seeing there is nothing explaining this. This is the fix for the >>> issue I had with installing 4.0 os and having that main install error. >>> After setting both virtual options in the PC bios everything loaded as >>> needed on reboot. Network connection connected on boot-up. Everything works >>> fine! >>> >>> Thank you and I look forward to being apart the Qubes community! Amazing >>> OS! >>> On Sat, Nov 3, 2018 at 11:57 AM 'awokd' via qubes-users < >>> qubes-users@googlegroups.com> wrote: >>> LMiller M: > Ok doing some research about this as much as I can learn about. I’m redoing > the os 4.0 install. I got the warning that my machine doesn’t have > HVM/VT-x/amd-v. Link from Qubes site. Basically no vms will work with > anything. Can you help explain how I’m supposed virt-type to PV? Or should > I just install the os 3.2? Enable the virtualization options in your BIOS setup. > The main problem I was having was. After running lookup qvm-pci I see my > devices fine. The nic card shows up in the listing. In the network > connections add connection. Everything is grayed out can’t add anything no > vms work 1) Enabling virtualization may fix your sys-net issue. 2) You shouldn't have to add connections manually in most cases. What does connection info say? 3) Like unman said, switch sys-net to use the Debian template (shut sys-net down and change in Qube Setting/General tab). 4) If that doesn't fix it, see if your NIC needs additional firmware, then install that to the template you use for sys-net. -- You received this message because you are subscribed to a topic in the Google Groups "qubes-users" group. To unsubscribe from this topic, visit https://groups.google.com/d/topic/qubes-users/sEh2LQFiOxI/unsubscribe. To unsubscribe from this group and all its topics, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/629219b4-1dd6-f9dc-2bd3-805825a02116%40danwin1210.me . For more options, visit https://groups.google.com/d/optout. >>> -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to
Re: [qubes-users] Using an OnlyKey
On Monday, November 5, 2018 at 11:16:59 AM UTC-5, pkra...@gmail.com wrote: > On Monday, October 15, 2018 at 9:37:48 AM UTC-4, John Maher wrote: > > On Friday, October 12, 2018 at 1:17:37 AM UTC-4, awokd wrote: > > > g80vmgm...@riseup.net wrote on 10/12/18 5:07 AM: > > > > John Maher: > > > >> I have an OnlyKey and have been unable to figure out how to make use > > > >> of it in Qubes OS 4.0. > > > >> > > > >> Relevant info: > > > >> > > > >> * OnlyKey requires either its app being opened on the computer or > > > >> one's ability to go to https://apps.crp.to (simply via a browser) in > > > >> order to set its time. > > > >> * I used info from this page > > > >> https://www.qubes-os.org/doc/usb/#how-to-use-a-usb-keyboard to get the > > > >> OnlyKey to operate as a USB keyboard. Doing this resulted in the > > > >> OnlyKey being attached to sys-usb and outputting text (password info) > > > >> in dom0 and any other qube. > > > >> * Although the OnlyKey can output like a USB keyboard in any qube, it > > > >> cannot get its time set without being specifically attached to an > > > >> appVM that either has the OnlyKey app or can access > > > >> https://apps.crp.to, so TOTP will not function. > > > >> * Using the yellow drop down icon to attach the OnlyKey to a qube that > > > >> has the app results in (1) the time on the OnlyKey being set, and (2) > > > >> the OnlyKey no longer working as a USB keyboard anywhere. > > > >> * Detaching from the qube does not restore the OnlyKey's ability to > > > >> function as a USB keyboard. > > > >> > > > >> Short of installing the OnlyKey app in sys-usb, is there anything else > > > >> I can try? (And I don't even know if that would work.) > > > >> > > > >> Even if I decided it was ok to install the app in sys-usb, sys-usb is > > > >> based on Fedora, and OnlyKey only has a deb package. Installing on > > > >> Fedora has proven to be very problematic. > > > >> > > > >> Thanks for any help you can provide. > > > >> > > > >> John > > > >> > > > > > > > > Hi John, > > > > > > > > I don't have an OnlyKey and unfortunately probably can't really help you > > > > to debug the issues with it not being able to act again as an HID device > > > > after attaching it directly to a VM. > > > > > > > > However, you can absolutely use a Debian-based VM as your sys-usb qube; > > > > just install the Debian 9 template and set your sys-usb qube to use it > > > > as its template. Also make sure the qubes-usb-proxy package is > > > > installed. > > > > > > > > As for the HID issues, I do have one suggestion: have you tried not only > > > > detaching the device from the AppVM, but also physically removing the > > > > USB device and re-inserting it? > > > > > > No OnlyKey either, but I think it is possible to have two USB > > > "keyboards" in Qubes if you edit the file described here: > > > https://www.qubes-os.org/doc/usb/#r32-manual. > > > > Thanks for your responses. I figured out a solution. > > > > I figured out a way to use OnlyKey with Qubes OS. I suspect I've violated > > some basic security principles relative to how Qubes is intended to be > > used, but I accept the compromise, which I think (hope) is minimal. > > > > Because an OnlyKey needs a time source in order for its TOTP feature to > > function, either the OnlyKey app (standalone or Chrome extension) or > > navigating to https://apps.crp.to, after the OnlyKey is inserted into a USB > > port, need to be available. In Qubes, I discovered that inserting the > > OnlyKey (and unlocking it with the PIN) and attaching it to the appVM where > > I want to use it resulted in the OnlyKey not functioning as a keyboard, > > which is needed to do its job. In dom0, adding this line to the top of > > /etc/qubes-rpc/policy/qubes.InputKeyboard (see > > https://www.qubes-os.org/doc/usb/#how-to-use-a-usb-keyboard) allowed the > > OnlyKey to operate as a keyboard in all VMs (without attaching the OnlyKey > > to a VM): > > > > sys-usb dom0 allow,user=root > > > > However, to use TOTP it still needed access to the app or to > > https://apps.crp.to. But, again, when I attached the OnlyKey to an appVM, > > the OnlyKey stopped functioning as a keyboard, even when I detached it from > > the appVM. > > > > So, I did the following: > > > > 1. Temporarily provided Internet access to sys-usb. > > 2. Opened Chrome and installed the OnlyKey extension. > > 3. Disabled the sys-usb VM's Internet access. > > > > Now, after inserting the OnlyKey and entering its PIN, I can open the > > OnlyKey Chrome app (which does not need Internet access to function), > > resulting in the OnlyKey getting its time set. Because of the previous edit > > of "qubes.InputKeyboard", the OnlyKey functions as a keyboard and all is > > well. > > > > I'm happy to hear comments or cautions regarding this. > > > > John > > John, > > As I understood your setup for OnlyKey consists of two parts: first - make it > work as a keyboard, second -
Re: [qubes-users] Re: SSD hardware encryption vulnerabilities (Radbound University)
On Tuesday, November 6, 2018 at 10:13:38 AM UTC-5, Holger Levsen wrote: > On Tue, Nov 06, 2018 at 07:09:52AM -0800, jonbrx...@gmail.com wrote: > > Does this effect Qubes OS? > > no. (Qubes OS uses software encryption. You can however manually enable > hardware encryption like you can on any OS.) Correct, it does not directly impact Qubes OS. Based on my threat model (mostly laptop/data theft and criminal spyware...not things like NSA firmware implants), I have been considering utilizing OPAL/sedutil to enforce strict data separation on a dual booting QubesOS/Windows 10 system without having to pull hardware...where each booted system cannot see the existence of the other OS as the boot drive would appear to be a smaller physical drive to the OS. The tiny, linux-based, *read-only* Pre-boot Authorization or PBA environment would require two different passwords to unlock the user-area of each OS to boot, and each OS area would be hardware encrypted with a key bound to the password used to unlock it (when properly implemented by the manufacturer!). Without that kind of separation, I would never consider dual booting. If I had some different threats, dual-booting would likely not be appropriate, even with hardware-enforced separation on storage. Therefore, attacks on TCG OPAL SSD implementations are interesting, to this QubesOS user anyway. Brendan PS - contemporary SATA/NVMe drives all come with this hardware capability and sedutil/PBA is free for personal use. The good-ish news that came out of the paper is that Samsung may have their OPAL stuff implemented securely in their 850/860/960/970 series devices. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/4b1b82e9-c2ec-4db7-816c-55d14f9bc72c%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: Qubes 3.2: No Internet Connection, neither with Wi-Fi, neither with Ethernet. HELP PLEASE!
So, after looking more into the kernel issue. I see on the Qubes site some instructions for trying to change the kernel. I’m going to do a reinstall of the 4.0 os to get back into Dom0 and try it out. I will post back hopefully with success.. On Mon, Nov 5, 2018 at 8:02 PM LMiller M <56lmil...@gmail.com> wrote: > Ok so one more if I can please, this is on a Asus K56c laptop and it has a > kernel failure on boot with Qubes Os 4.0. On the first install it shows the > kernel failure and it boots to the OS don0. If I turn off or reboot it > shows my kernel failure and won’t load into the os. > > I seen something saying I should be able to change the kernel (maybe > during the install) don’t remember. I found the kernels on the Qubes site > that are excepted, I just don’t see how the change it. Maybe I’m > overlooking, I’m not a major Linux person. I know a small bit of ubantu > > In this Asus I have the Acronis Loader, I don’t think that has anything to > do with it. Just putting it out there. > > Qubes OS is the only os install on this laptop drive. All virtual options > are enabled. Boots to my login password then stalls. > > Any ideas? > On Mon, Nov 5, 2018 at 7:37 PM LMiller M <56lmil...@gmail.com> wrote: > >> I want to thank you both. Sorry for the late reply I wasn’t able to make >> the necessary adjustments till now. >> >> I feel like a fool, I didn’t think about treating my desktop as a virtual >> box fresh install. Which completely makes sense because of the Qubes basic >> idea of the OS! Lol omg... >> >> Anyway, seeing there is nothing explaining this. This is the fix for the >> issue I had with installing 4.0 os and having that main install error. >> After setting both virtual options in the PC bios everything loaded as >> needed on reboot. Network connection connected on boot-up. Everything works >> fine! >> >> Thank you and I look forward to being apart the Qubes community! Amazing >> OS! >> On Sat, Nov 3, 2018 at 11:57 AM 'awokd' via qubes-users < >> qubes-users@googlegroups.com> wrote: >> >>> LMiller M: >>> > Ok doing some research about this as much as I can learn about. I’m >>> redoing >>> > the os 4.0 install. I got the warning that my machine doesn’t have >>> > HVM/VT-x/amd-v. Link from Qubes site. Basically no vms will work with >>> > anything. Can you help explain how I’m supposed virt-type to PV? Or >>> should >>> > I just install the os 3.2? >>> >>> Enable the virtualization options in your BIOS setup. >>> >>> > The main problem I was having was. After running lookup qvm-pci I see >>> my >>> > devices fine. The nic card shows up in the listing. In the network >>> > connections add connection. Everything is grayed out can’t add >>> anything no >>> > vms work >>> >>> 1) Enabling virtualization may fix your sys-net issue. >>> 2) You shouldn't have to add connections manually in most cases. What >>> does connection info say? >>> 3) Like unman said, switch sys-net to use the Debian template (shut >>> sys-net down and change in Qube Setting/General tab). >>> 4) If that doesn't fix it, see if your NIC needs additional firmware, >>> then install that to the template you use for sys-net. >>> >>> -- >>> You received this message because you are subscribed to a topic in the >>> Google Groups "qubes-users" group. >>> To unsubscribe from this topic, visit >>> https://groups.google.com/d/topic/qubes-users/sEh2LQFiOxI/unsubscribe. >>> To unsubscribe from this group and all its topics, send an email to >>> qubes-users+unsubscr...@googlegroups.com. >>> To post to this group, send email to qubes-users@googlegroups.com. >>> To view this discussion on the web visit >>> https://groups.google.com/d/msgid/qubes-users/629219b4-1dd6-f9dc-2bd3-805825a02116%40danwin1210.me >>> . >>> For more options, visit https://groups.google.com/d/optout. >>> >> -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/CAOugA3oGWKmMzyAU0eteLiGTjfcAvj1LwrLT7%3Dw8wqxH2-EggA%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Disk Manager does not start
On Mon, Nov 05, 2018 at 03:23:27PM -0800, William Fisher wrote: > I have a Widows 7 VM saved on a HDD from my previous Qubes 3.2 and I am > trying to install it and various other VMs that were “Backed up” On that HDD > to my Qubes 4.0 installation. The HDD is recognizied by Qubes 4.0 but I can’t > see it on the Back up/restore list of files and I do not know how to start > the Disk File Manager tool to “mount” the HDD to access the stored VMs. > I think that awokd has suggested the right path. Attach the block device to another qube, and then select *that* qube in the back up tool. Was the HDD encrypted? What was the partition scheme? If so you will need to decrypt it, and mount the relevant partitions in the qube to which you attach the device. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20181106153417.iyqhrkhaobnrbcif%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Qubes 4: Unable to get any DVM app to ever launch
On Mon, Nov 05, 2018 at 01:56:00PM -0800, Otto Kratik wrote: > > Thanks for the extensive troubleshooting. > > > > It looks as if there's a problem *either* with the service *or* with the > > desktop files on fedoratest. > > Can you check the contents of /etc/qubes/rpc/policy/qubes.StartApp to > > make sure that you dont have a "deny" statement at the top of that file? > > You could temporarily insert a line at the top: > > dom0 $anyvm allow > > $anyvm $anyvm allow > > > > Just concentrate on using: > > qvm-run -a --service --dispvm=fedoratest -- qubes.StartApp+firefox (or > > gedit) > > Check the log file in /var/log/qubes : you should see a log created for > > whatever dispVM is atrted and qubes.log updated. > > > > unman > > > So during testing, even though I'd stopped all other VMs from running, I > started noticing some odd slowdowns and other memory-related issues, wondered > if RAM shortage was affecting my attempts, and decided to reboot and try > again from scratch with no autostart VMs enabled. > > After that, I am now able to run pretty much any app in a Debian or Whonix > based DispVM without issue. In Fedora based DVMs, some apps like Firefox, > Filezilla, Calculator etc all run fine from the DVM menu, while other apps > such as Gedit and Nautilus/Files simply don't seem to want to act as the > "launch leaders" for DispvM's. > > Meaning, the DispVM gets launched, but those apps don't open, and then the > DVM halts again a minute or so later, as previously described. If I launch > Firefox instead first in a Fedora DVM, and then from the widget select "Run > terminal" for that very same already-open DVM, I can then launch Gedit or > Nautilus or any other app from the command line without any problem. But > those apps won't open as the initial "launch-apps" for Fedora DVMs. > > By contrast, in Debian DVM's I can launch KWrite or Dolphin or whatever other > equivalents easily, a well as Firefox or Tor Browser, and so far haven't > found one that refuses to launch. > > Thus it seems like a bit of an interoperability quirk between Fedora26 and > the DVM system, so far as I can tell. Results are the same whether trying > from gui menu or dom0 command line, though admittedly with some apps like > Gedit, I am unsure which of the following I should be typing: > > qvm-run -a --service --dispvm=fedoratest -- qubes.StartApp+gedit > qvm-run -a --service --dispvm=fedoratest -- qubes.StartApp+org.gnome.gedit > qvm-run -a --service --dispvm=fedoratest -- "qubes.StartApp+Text Editor" > > All of them fail in the same way, however.. so I'm not sure it makes much > difference. > > Out of curiosity for comparison, are you able to launch Gedit or > Nautilus/Files in a Fedora based DVM without issue, as the initial launch-app > either from the menu or command line? > I'm glad that some progress is being made. I wonder if there's some issue with the desktop files in Fedora which are preventing those applications from running? Those symptoms are exactly those that fit with problems with the desktop files. I dont have Fedora here to test, I'm afraid: Debian and BSD only. If you open a Fedora based qube, do the applications work if you try to open files that would use them? I mean create text file, and then double click on it in nautilus, etc etc unman -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20181106152947.7u5idnqomx5g3pmm%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Updates to all recommends Vms on Qubes 4.0
On Mon, Nov 05, 2018 at 12:43:05PM -0800, Black Beard wrote: > Hey, > > i tried to following the tutorial to upgrade Whonix 13 to 14. > > https://www.whonix.org/wiki/Qubes/Install > > I first start to uninstall the old Version of Whonix with Option B. > > When i tried to install the dummy template with following command "sudo > qubes-dom0-update qubes-template-dummy i become some error message "unable to > find a match". So i cant start to upgrade. > > Can anybody says me how to update the Debian 9 Template? > > Probleme 2 > > When i upgrade Fedora 26 to 28 my Windows7 HVM dont have some internet > connection. I deleted the old Version of Fedora26 and saw, that my Windows7 > HVM works with fedora 26-dvm. I think there's the probleme. Can someone tell > me, how can i fix the probleme with the internet-connection? > > I would be happy about your helpful answers. > > regards > I've looked at that page, and cant see any reference to uninstalling old version with Option B, so I dont know what instructions you are following. You cant start to upgrade because there is no package called "qubes-template-dummy" in the repositories. I assume (perhaps wrongly) that you should create a dummy template by cling an existing one, and use that anywhere you currently use a whonix template. If you could explan what you are tring to do I might be able to help more. To update a Debian template, open a terminsla in the template and then run (either using suod or as root) 'apt update' and 'apt upgrade' or 'apt full-upgrade' I dont know what you mean by your HVM works with fedora 26-dvm. Check what IP address is allocated to the netvm used by your HVM, and what IP address is allocated to the HVM. Make sure that the right IP address and gateway are set in Windows. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20181106152252.raxv5466edmbbdsz%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: SSD hardware encryption vulnerabilities (Radbound University)
On Tue, Nov 06, 2018 at 07:09:52AM -0800, jonbrownmaste...@gmail.com wrote: > Does this effect Qubes OS? no. (Qubes OS uses software encryption. You can however manually enable hardware encryption like you can on any OS.) -- cheers, Holger --- holger@(debian|reproducible-builds|layer-acht).org PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20181106151333.jj3anhucjkq2nitt%40layer-acht.org. For more options, visit https://groups.google.com/d/optout. signature.asc Description: PGP signature
[qubes-users] Re: SSD hardware encryption vulnerabilities (Radbound University)
Does this effect Qubes OS? On Monday, November 5, 2018 at 8:11:51 AM UTC-6, Brendan Hoar wrote: > [Note: my position is that hardware disk encryption is useful for protecting > against opportunistic attacks, whereas software disk encryption is best for > protecting against targeted attacks. Use both.] > > 1. PR Notice: > https://www.ru.nl/english/news-agenda/news/vm/icis/cyber-security/2018/radboud-university-researchers-discover-security/ > 2. Advisory: https://www.ru.nl/publish/pages/909275/advisory.pdf > 3. Paper draft, very exciting read!: > https://www.ru.nl/publish/pages/909282/draft-paper.pdf > > There are two CVEs here, which I will attempt to summarize: > > CVE-2018-12037: user supplied password is not (or not entirely) used to > encrypt the disk encryption key stored in the flash. Key can be extracted via > various techniques. Examples given: > - ATA password (Maximum and High modes) on internal SSDs such as Crucial > MX100,MX200,MX300 > - ATA password (only in HIGH mode) on internal SSDs such as Samsung 840 EVO > and 850 EVO > - Proprietary unlock software on portable SSDs such as Samsung T3 and T5 > > CVE-2018-12038: user supplied password (or bitlocker(!)/OPAL key) *IS* used > to encrypt the disk encryption key stored in the flash. However, care was not > taken in firmware design to mitigate the logical->physical translation. > Therefore the original unencrypted key (before reconfiguration) may still be > recoverable somewhere in the flash if the original flash block was not erased > fully as part of the wrapping of the key in the user-provided password/key. > - Samsung 840 EVO was vulnerable > > Mitigations: > 0. As suggested in the article (and in discussions on this list): always use > software-based encryption. Note that Microsoft's Bitlocker utilizes hardware > encryption when available by default for performance (using eDrive, a simple > variant of OPAL). This can be disabled via group-policy, but it will not > change the configuration of an already configured drive. > 1. Don't use the Crucial MX100 and MX200. Oh, the horror. MX300 not much > better either, so avoid. > 2. If using ATA security on the Samsung drives, always set both the User > *AND* Master passwords (utilize Maximum security mode). > 3. TCG Opal implementation looks pretty solid on the Samsung drives. However > 840 has a wear-leveling vulnerability in old key storage, so 850 or higher > series is preferred. > 4. Samsung claims their portable drive issues are resolved when moving to the > v1.6.2 release of the unlocker. I'm doubtful. > 5. Did I mention: always use software encryption as well? > > My opinions: > 1. Crucial and Samsung may have some excitement in their FIPS compliance > workstreams. > 2. I'm fairly certain the TCG Opal standards are written to require > manufacturers to address these two issues: a) wrap the damn keys correctly > and b) ensure old key material is erased. This is a failure of engineering, > testing and compliance. > c) I've been peeved that the Samsung T3 and T5 drives, internally, are not > TCG Opal, instead using a custom Samsung mechanism to lock/unlock their > hardware encryption capabilities. The reason I was peeved: these are the only > sources of 2TB mSATA drives which I would have loved to use with sedutil. Now > I have a second reason to be peeved, which is that the custom mechanism was > as crappy as Y2K-era ATA password protection. > > Happy Monday, > Brendan -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/7dbaf55e-e55b-45ee-baad-47191421156d%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Whonix upgrade failure
Hey Community, i tried to following the tutorial to upgrade Whonix 13 to 14. https://www.whonix.org/wiki/Qubes/Install I first start to try uninstall the old Version of Whonix with Option B. When i tried to install the dummy template with following command "sudo qubes-dom0-update qubes-template-dummy" i become some error message "unable to find a match". So i cant create the template and upgrade Whonix. Can anybody says me how to update the Debian 9 Template? I found some tutorials but always become an error message. Did some profi how to fix the probleme? About a message i would be happy. regards -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/fd2a74af-2d8d-49f5-ba62-1609ef22ba92%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Windows7 HVM with no internet connection
Hey guys, since i upgrade my Fedora 26 to 28 my windows7 vm has no internet connection anymore. The old Version of Fedora i deleted completly and i saw that the configuration run over Fedora-26-dvm. The other option is Whonix. Whonix i want upgrade in the next days, but before i want fix the probleme with the connectivity. Over Debian9 and Fedora i can use the internet. Did anyone know to fix the probleme, or can post the correct configs? About every message i would be happy. regards -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/7925f44b-ed2c-43cb-9c57-f7cebf590099%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Test message, please ignore.
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 10/22/18 11:10 PM, Zrubi wrote: > This is the message. > I just need more tests. - -- Zrubi -BEGIN PGP SIGNATURE- iQIzBAEBCAAdFiEEmAe1Y2qfQjTIsHwdVjGlenYHFQ0FAlvhX5QACgkQVjGlenYH FQ39QBAApSAgoaTk/5HpVaMs16KZC+JGuQ3MnTAcSkDdFJIVYyKU/sat5BwqXt6Z xi4s1JtEdA8CVUv0tTD5OyNleLd+YrgqUzlin4XeWRkTyM4UuTGrxjOFAD6zKPFx Hp1mHuHxZY4bSxTIvM7ZzrN6VKFbt5OnGn9DrvuHQU+O9HoDbg4Sg3tLMV+ppl8l R5AhfAqwwleIh9QxkvR/AfdEKzbeFx/uNEBpX7SnlaF16LTj62UPKFhjMUDmHXCp 92SixbtFMDjYz0UuQ3OM46212Qpux7KDHVcS//aWk3SVhz6J0UXx1OBjZ6gk8q5f F2mf5p0Az7Xj3cjxtC9RQnpq7Re8iLJi3CyGyM7u9TZC3ZMYjhlBcc5+kMyn8aF8 BzY25DhxKm/PVpRDQpbyr8TMxi5e2o4JOwl9c93Vu8s0zUqdm8zZZO4q5RG5Goo+ UBAq5reU3S03zwNf+IVvZFWqa5XnXtwh0BRMrOQ0IxQ6jDw36HT4r/UCekNKcEuR Q4zACAVKyjrdy/UVjIvy35igK4LBW/L8mgqBdh/5wxFnUnd631gzR94FCKzwqm/N M+GUq+2AwSTszhdwPK8R5Q9RculwNy7jADHh7qV2tGhA782/e2eX7+1mLUT81k1U FaZbXn2wBrf0TgnUy/i35zUM6YSFqVK7lDoaPwvHKnkgETAPHxE= =Yenl -END PGP SIGNATURE- -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/9b0a9c8d-eb26-5afa-c05c-a6366f87a508%40zrubi.hu. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Re: Any ideas about blank white video in Simplescreenrecorder and OBS in appvm (including standalone)
See this issue for details: https://github.com/QubesOS/qubes-issues/issues/4351 -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/176.5be15273%40qubes-os.info. For more options, visit https://groups.google.com/d/optout.
