Re: [qubes-users] Re: Is it possible to build any BSD template on QubesOS?

2022-06-10 Thread Demi Marie Obenour
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On Tue, Jun 07, 2022 at 05:34:10PM -0700, J Holsapple wrote:
> Yeah, a more integrated BSD OS would be nice. Something like Windows tools. 
> The only gui I'd be interested in though is macos.
> 
> In this case, I'm just running the cli and using the webapp for management. 
> Sure it's a HVM and is more isolated and more resource hungry. Yet it's a 
> lot like my stand alone pfSense box. It just works. And over the months 
> I've gone back to my integration guide/script and refined it.
> 
> Keep in mind that I answered the OP's question for the use case where "any" 
> means a HVM with a CLI and using a webapp for "gui" management. The 
> integration guide/script is optional for people wanting to replicate my 
> implementation of pfSense/OPNsense.
> 
> BTW, could you expound a little on your concern for xnf(4) (netfront) and 
> xbf(4) (blkfront) drivers? Or point me to a reference? I wish to better 
> understand your concern for threat vectors.

Right now, the OpenBSD netfront and netback drivers are not hardened
against malicious backends, so they can be attacked by malicious
backends.
- -- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmKj3gYACgkQsoi1X/+c
IsHgQRAAqFGBEd8zJCSZ4W8+qbIzbs8/rMojEqrqcZIjBo1PtW4JHgNbl42/PEAc
yRs1FNVu7TVELibYle0INnTVR6emm89P5s3r/ym4x0tghfuUAM3yQeZV8g+g5ivQ
+UP/7kLN+Gu6gPa4YNANMctRs3FP5Y7KwuIyzvO3yhBgEC4cS10sjM3KYaO80Ue4
ZFjjyg504ZvllbOjgid2LR18j4mC4BUe1f/Lf/IviUggfK/ZCAW3rExqlMU5KbGr
i8/3XXRl4YFLXsbrCm20vUvQlW844GkKuECW8OMbjt2gkt3f/2gSeT+Xl8FVd8TD
oAMijumqmRKlsm2dd3i58blQjJ5c1T5Hzfwb0VJybN9YUOCjil+oxGOL9nJqkTig
bUh6eojSDi65Ld8WwE1KL2vYKO7JiXZ0la9whZeUG6bFs68Gx7AWcfZ+xfJ4k9Ga
+FV89WiM79R+HJvVpZphxT1xRdNaVP73rHKIpar88pyUOorZHfM71ANfj1FfOuCY
v8FAU9ByLiwgO4Hv3eS6XXAUsTi9NMlWFNeO/Zg9Pc/1Au0sglBR1+LIOmq/iRtF
N7j0fPoA0Fp5ZnDOgq2iQ45SzPY3IqEw9ra4dTiBlP5Q7l9RG2Nu5aTyWmjtE55x
ASeeo379ZVvPFhDdq8DBzUElTFxURa5zrOWZJoTvltQf2TO66wI=
=5I/r
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/YqPeBkmp21FXJaE9%40itl-email.


Re: [qubes-users] qubes update -- how to hold an old kernel ??

2022-06-10 Thread haaber

Which kernel version do you need to hold?  You can update a subset of
packages by giving them as arguments to qubes-dom0-update, but I would
like to know what the forseeable problems are.


The reason is simple: all (!) 5.x xen kernels I tested so far
crash/freeze my system in less than 5 minutes, often only seconds (open
issue on github since 18 months). Therefore I keep a 4.19 kernel for xen
(only) -- until now the updater respected that: it installed some new
5.x kernel and kernel-latest. Every single time, I bravely try them out,
 and each time they crash: each time I can revert back to 4.19 by a
linux-life usb hack.

Last kernel update wants to remove my 4.19 kernel, and no way I can
accept that, given the history. ( again a curse on Intel and Dell for
their buggy hardware ).

best, Bernhard




--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e20ee310-4d7a-c6d3-d71f-0a02dd5389fe%40web.de.


Re: [qubes-users] Re: sys-firewall freezing on resume from suspend

2022-06-10 Thread Demi Marie Obenour
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On Fri, Jun 03, 2022 at 04:00:20PM +0200, Qubes OS Users Mailing List wrote:
> So, apparently, this is not a sys-firewall, but a clocksync issue. To root
> out any causes, I moved the clocksync service to a separate, brand new qube
> (named sys-clock). And voila: sys-firewall no longer 'crashes' on resume
> from suspend, now it's sys-clock.

https://github.com/QubesOS/qubes-core-admin/pull/473 will (hopefully)
fix this.

- -- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmKjvE8ACgkQsoi1X/+c
IsEWOxAArQT0n0LBpJhoQcDsGhiB0ute7pr5jkGTv2QW02EmSXXrKwdr9+QwZS7P
6xMA1mdcfPHNZfA4Y4z3ZRdUbd943sSn2IYhZ2s75dbVkHEp7hSaL1SJfT1cdSlW
j/CeF7nc2S1OA+sEJcWxKlwiX8gTRgMW3PeDNcRL/v2vxG7fte3Pj/2GSZ8wJFFR
+x19nrmp8KEJ4/Nx5JYSKLs74M75JFJPXrVOsPN4NiPa/e/0r77MY6+KytbXHm9L
i9CitXzVZnAp5voVX/CC4XkPa13M2YGAmQ+WQQFTKy35qUK9Ae97x18M+llxqsLN
eIZIvAGYmwTWPOXYMTadGL8xAveA6lnGIMA4EgYolqWGzxGCg1WyKnoOAXWhe7F+
BHeuTlt7YVwCaENa5XeweYy7gH6cnFXiqh5fcFFUPb9UJmjftlowLwUI4Ggnz112
7aDDOTPz73v0nLdAriRKxMqbf5n259eozsaZDnq1yrg2hdZGV8ptPxs+xvniSB4F
GpCvLBblAAXKDjZWyOeTNGGWA8YjBS4+9ExDTHo1vYU9yVob3Y3QfgFW364EeFeG
wYv/sqiRv6sDSBjw9fsHPX09tx8zRV9pAGy3wHvSWO6+bqsyl8o8usT6NRGNq4Tl
WaGar1+jiNvuEJ4DEtckMnKiO6UhSEsigYLjWlDZkEitO6Tq0sw=
=Bysk
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/YqO8T3pAxkX/sCeZ%40itl-email.


Re: [qubes-users] Re: sys-firewall freezing on resume from suspend

2022-06-10 Thread Demi Marie Obenour
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On Fri, Jun 03, 2022 at 04:00:20PM +0200, Qubes OS Users Mailing List wrote:
> So, apparently, this is not a sys-firewall, but a clocksync issue. To root
> out any causes, I moved the clocksync service to a separate, brand new qube
> (named sys-clock). And voila: sys-firewall no longer 'crashes' on resume
> from suspend, now it's sys-clock.
> 
> The cause is probably somewhere in some logfile, but with the many moving
> parts, Qubes really needs a better bugfixing howto. With relatively many
> minor bugs like this, bugfixing takes too much time. I don't mind spending
> some time fixing bugs, but lately it is really becoming too much, to the
> extend that I am considering switching back to an easier regular Linux
> distro. I have been a paid Linux sysadmin, no total expert, but that is also
> not a requirement to use Qubes. I should be able to diagnose bugs on my own
> laptop (and contribute to the project by properly reporting them).

Indeed, you should be able to.  The fact that you cannot is itself a
bug.  Please report it.

- -- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmKju30ACgkQsoi1X/+c
IsGmFw/+J44uxpsEAEXAD1bVrxv1xA4sOtcZC+EjyWEVRGc61GTy5/uh69pb2ROi
9x0+ynfuxOTn2+9SZHNPyJtt5L5gNC7hSVrwNzzsMQX3OUySBjjh867DRdHHg7Zn
EvESFmPorOm+3LVdSEbA3QssOPTLSoHPrENuEnQ5yfsYURrNONIvSfwB+zCNexfP
Ay8IgyAaH8HKEhigu7VKCIn2XRV1JlRNzSC53fKJPhtwZq/NXc0JX+2NnX6KeOvE
VmxCQwF2Fvr6K2cMLdlm019XGVHifTqMnwi3/qdkbsxD2ntcovTs6kpMC0knWsT5
tMfgN0jS1CXyu+dGbupSjxtt1O9FEoXt45eOnA55oqc1jSZcYqgtaCbeq0QiPBi3
pXOf9ErJJjtrrxHr7CxoNRR3pyyXGb3gGKy2gElsT4Pm1qkioHSb/lEZMNqaU4YT
bI+R5sAE/DgTry8+S1uAwMNZthpS8FG5WjUwQ9SYr1a7jZOQCbDKyuw91n9/sU+6
a0bNoxk2cEnGngZpbQq0oXCT1V18WnU/JdfRCP9+I7NI7WAlVDOjB8QKlen0d1+y
d8WS1BBrfhxuDco1T+XNQCOtftdtuKV1PhzUGjR0hMQtBsuJWvfbsLIIs00/H+ET
x30l8RXDQw/+4s4cnSsd/IKN0d7KCpr18pQkyEWeE2Bp136pLpw=
=fc6P
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/YqO7fUsAEpR%2BzyAl%40itl-email.


Re: [qubes-users] Problems with announced Fedora 35 templates

2022-06-10 Thread Demi Marie Obenour
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On Wed, Jun 08, 2022 at 10:10:45PM -0700, Viktor Ransmayr wrote:
> Hello Qubes Community,
> 
> Viktor Ransmayr schrieb am Montag, 30. Mai 2022 um 11:31:56 UTC+2:
> 
> > Viktor Ransmayr schrieb am Montag, 30. Mai 2022 um 10:37:56 UTC+2:
> >
> >> stevenlc...@gmail.com schrieb am Sonntag, 29. Mai 2022 um 20:45:29 UTC+2:
> >>
> >>> On Sun, May 29, 2022 at 4:39 AM Viktor Ransmayr  
> >>> wrote:
> >>>
>  stevenlc...@gmail.com schrieb am Samstag, 28. Mai 2022 um 21:54:40 
>  UTC+2:
> 
> >
> > Thanks for your quick reply!
> 
>  However, when I try to list the available templates using the 
>  'qvm-template' command, I get the same error message: 
> 
>  [vr@dom0 ~]$ qvm-template list
>  [Qrexec] /bin/sh: /etc/qubes-rpc/qubes.TemplateSearch: No such file 
>  or directory
>  ERROR: qrexec call 'qubes.TemplateSearch' failed.
>  [vr@dom0 ~]$ 
> 
> 
> 
> >>> I just checked my own system and ran a python3 trace on the command. The 
> >>> file  /etc/qubes-rpc/qubes.TemplateSearch should be on the sys-firewall 
> >>> , assuming the default configuration. If you use a different OS or 
> >>> changed 
> >>> your "Dom0 update qube" in the "Global Settings" for dom0 updates then 
> >>> that 
> >>> update VM may not have this file installed. I would start by looking 
> >>> there.  
> >>>
> >>
> >> I've not modified anything - and - the "Global Settings" look OK.
> >>
> >> I tried to open a console in 'sys-firewall' - but - can't login :-(
> >>
> >> I had expected that I could do so, using my credentials, i.e. user 'vr' 
> >> plus my password ... 
> >>

At least in the default setup (no sys-gui-gpu), your credentials are
specific to dom0.  Everything else will let you log in on the console
as any valid user without a password.  “root” will give you a root
shell, while “user” will give you a shell as the same user that GUI
programs run as.

> > I tried to open a console in 'sys-firewall' - and - could not login.
> >
> > However, I (obviously) could open a terminal in 'sys-firewall' ...
> >
> > Here's the content of /etc/qubes-rpc/ :
> >
> > [user@sys-firewall ~]$ cd /etc/qubes-rpc/
> > [user@sys-firewall qubes-rpc]$ ls
> > qubes.Backup qubes.PdfConvertqubes.SuspendPostAll
> > qubes.ConnectTCP qubes.PostInstall   qubes.SuspendPre
> > qubes.DetachPciDevicequbes.ResizeDiskqubes.SuspendPreAll
> > qubes.Filecopy   qubes.Restore   qubes.USB
> > qubes.GetAppmenusqubes.SaltLinuxVM   qubes.USBAttach
> > qubes.GetDatequbes.SelectDirectory   qubes.USBDetach
> > qubes.GetImageRGBA   qubes.SelectFilequbes.UpdatesProxy
> > qubes.Gpgqubes.SetDateTime   qubes.VMRootShell
> > qubes.GpgImportKey   qubes.SetMonitorLayout  qubes.VMShell
> > qubes.InstallUpdatesGUI  qubes.ShowInTerminalqubes.WaitForSession
> > qubes.OpenInVM   qubes.StartApp
> > qubes.OpenURLqubes.SuspendPost
> > [user@sys-firewall qubes-rpc]$ 
> >
> 
> With Fedora 34 having reached EOL now, is there anything else I can do, 
> other than a complete new installation of Qubes OS R4.1 ? 

Installing “qubes-core-agent-dom0-updates” in sys-firewall’s template
should fix the problem.
- -- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmKjutoACgkQsoi1X/+c
IsGWOhAAolEkyR9ouRejSxMZi1MFngp04eHAUa4r2eARrD74FVkHNaiJ5h3d90JT
fEEO+e+zFnIRvXGxXG8ITtjJsep9ohuYSOY0kiIHWYkAU+FSHrCO8QDnLlqCt5Nx
9rBbgfgKAmpU8/wJxWOm8++rrCuW/7jp79hQ1VwcrPsZuc0fkvq9FB8WgbCPiV+X
qcOmWdeP5OVu/QQ8Rb7HPARLDqYVjiuYaDkVklmgsaEKlI87dsgRryVYIl3SmLyL
8ga4fJoiGaKAu57FcgkvEiXLS06qdBMYYJUwtc+c3EFnnaVbILKfJopa9dDeDsEa
J8JOjJr+ZKpnnxVQMIffaPmWVGlTcirAuqv4QV88Z6tEdqAO2OwIvjieefQ28REc
h3/DnpjAtbo6rDnz2QLkcawNp7kETA+GYuhC6HNrUML4RnxTaN4BJI+DzQEyWHsX
FNhV6ce2pLv4lzNXAQby8NRSqQdHd2bhCiMNFcdKR4QZIX0ZzS0bQmGyBJYQu5vt
LHjTLb+582mpNZowL8X0caCrYNUWCQhfUn75a/5pUqAbA3ud1Hwfgo9025eogha4
F0MWiRhnCOfpGY/eCJqo34vMv+RVG9MReSlzO4mLxFKuFlrjJMVVZ8qeXJUc8gdk
qwUsNDhB7h+7EudL4Vl8SOIKJxCfCeQ7bye1vz7LOaJlj68QEoM=
=19/c
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/YqO620Nyzmj%2Be4Y7%40itl-email.


Re: [qubes-users] qubes update -- how to hold an old kernel ??

2022-06-10 Thread Demi Marie Obenour
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On Fri, Jun 10, 2022 at 08:55:41AM +0200, haaber wrote:
> Recent QSB made me run the qubes-update. Regrettably, it wants to remove
> a kernel version that I need to hold (in case of foreseeable problems
> with newer ones). How can I freeze that older version and forbid its
> uninstall?

Which kernel version do you need to hold?  You can update a subset of
packages by giving them as arguments to qubes-dom0-update, but I would
like to know what the forseeable problems are.  I am not aware of any
way to do what you want given how DNF works.

- -- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmKjs1wACgkQsoi1X/+c
IsGmqw//euPsJPLo1LiC4OuzMWuHWgqNS3xtxyCaVbX8FmSlSSWDB1V8iyxSVajp
SDoGY7qU1x9hgEe0PIvrt8DAOG0XnkRcPzzlQv2xkjj0qTn8boFum3LigUQ6/lAr
P7xkc3ELnd+sXAP2Urn1XtmgcMN9oLexUNpQCN2LOaFtvzpCCQpjeVLW9U5dCqN0
dFKtH/iwxGBsMKcizkSnCmExm67lVhG5qD/oSLcvrE1VpR+nw61nLXlKTC1OFG0y
Bue6m+0FNpoRGGnDFOkUktrybLLu1RHmUkBs5Hxyzn16eL8HFx1/o4JqF4RjXgq5
dj17uugo9azVmEX7Z/Ngq9uKnUeC/328sT/7Cu/Zy9op0IdMPTHtZ+wzQwfOjM4w
JpXWxE96a+gXnqPD0Q13nbTwiurvD3vrr5rgv0QqWn6xUa9+SHHyXJQR45nR8YVe
sOGRifKoZgCtcOemF6A6hveFF8fwALb55CIKgGwM6K4Q6FXNMip/FqJl2mwVxXn7
jNYG4qQveRRyzSsGdN1O4yDgTFDC36EZSPOtxKVnYs1VFbXfcCpQW7rKQPDy+S8w
tnykq7Qdvg2lK/uztgDtfs2iEqZJlt1KHN2UrU0cHRF16h/cZQm2L+RBgY6l8tvY
f2QRoBYzof29dj4Ald8JskKvBlo7sQ5tZhXEySB6T4Vq86xIOzU=
=ormh
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/YqOzXSFhnImIAK5f%40itl-email.


Re: [qubes-users] Force a flatpaked application to open attachments, links etc. in a dismVM?

2022-06-10 Thread Demi Marie Obenour
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On Fri, Jun 03, 2022 at 10:51:53AM +0200, Johannes Graumann wrote:
> On Mon, 2022-05-30 at 14:11 -0400, Demi Marie Obenour wrote:
> > On Sat, May 28, 2022 at 12:56:42PM +0200, Johannes Graumann wrote:
> > > On Tue, 2022-05-24 at 12:35 -0400, Demi Marie Obenour wrote:
> > > > On Tue, May 24, 2022 at 10:37:18AM +0200, Qubes OS Users Mailing
> > > > List
> > > > wrote:
> > > > > https://www.qubes-os.org/doc/how-to-use-disposables/#making-a-particular-application-open-everything-in-a-disposable
> > > > > states:
> > > > > >  To do this [make a particular application open everything in
> > > > > > a 
> > > > > > disposable VM], enable a service named app-dispvm.X in that
> > > > > > qube, 
> > > > > > where X is the application ID.
> > > > > 
> > > > > and invokes `app-dispvm.thunderbird` as an example.
> > > > > 
> > > > > How would you do that for an application installes and run
> > > > > through
> > > > > flatpak?
> > > > 
> > > > Flatpak-installed applications still have an application ID,
> > > > which is
> > > > what gets passed to qubes.StartApp to launch the application.
> > > 
> > > Thank you for your answer. Lengthy googling has dug up no answer to
> > > what an "application ID" actually is or how to look it up. Could
> > > you
> > > please help with that? Given a running program, how do I identify
> > > it?
> > 
> > It is the name of the .desktop file the application has within the
> > VM.
> > For Flatpak apps, I believe it will always be the ID of the flatpak
> > (the
> > reverse-DNS name).
> 
> Thank you.
> I did the following:
> 1) in `dom0`:
> > qvm-service task-privcom app-dispvm.org.gnome.Evolution on
> 
> 2) restart task-privcom
> 
> This does not work: neither *.pdf, nor *.jpeg, etc. get opened in a
> dispvm when opening (double clicking) from within Evolution ...

That is not good.

Does it work if you set XDG_DATA_DIRS to /usr/share/qubes/xdg-override
in the launch script for the flatpak?

- -- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmKjsAsACgkQsoi1X/+c
IsHwWBAAyWtn+ogxFSf7Y9Y3QN762ePZzx9X3aPSRbVIWiSsY0H51VTzQRJBG6tS
Np3yRPSjZrj9iDRv3zaEWMKZ+1ekvH18JkXTulv9W/r6ia1UkfrsIC8fwLrkNE7o
lg1RvLcJLNXu0JkOEor1fRzFyY0VZTLRlnFjxVL7JNugF+56iIigrMUYwsIP2JLx
zS38N3cG+aRtXV9ujWJQtRFULH+CVcPFmAM7NGy4uLeYRApObAsosPasxdNPZPYy
pbTLxBYz0O7WKi5Q0n/aFW8ootdtoZZxHNPosw5wWhAPrVny69/MqxMg839piSQW
umPAdTqpUHdXZKPfM/5exuphg9RBJCPxkukurS6tvDLz9RYg8yLHVFuc5wdc7jvQ
HU9nCnSNsSzunowosks0z68pp8XTE7ruUf+HLZkcGrc5e733cE0UbLp5E8d34+eJ
JDgwC/zCj5NwIoUdtIE9pe3G3oDhUNlL6YyCNvIHkuhydN2sUkIC+uxHOMIZeHS1
Dw73E2M22oRud7s4QOeQGQwpv9QYpQ5WBHlsUECJiqJWm4oeW2yMThuxgEHBuh5i
lVH/UIvHmO5XXXA2J/28h+QZBcqO1z1EF5CTdSX+DIWqNO+u7KL5ohgYEMeKhYZW
OldqpRTMH6uYPQSinbrSWlXy9Ucb6yjibGt1moWZapeZidSftwU=
=/nkQ
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/YqOwDMZb2s4NZwi/%40itl-email.


Re: [qubes-users] yggdrasil & qubes netvm question

2022-06-10 Thread Demi Marie Obenour
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On Fri, Jun 10, 2022 at 04:29:08PM +0300, Oleg Artemiev wrote:
> 1) Has anyone succeeded in enabling the yggdrasil network in NetVM qube?
> I'm thinking about Qubes standalone PC as a server machine with the
> ability to use NetVM as a shell box via yggdrasil IP.

I suggest not running the server in sys-net if possible, and instead
running it in a qube attached to sys-net.  sys-net has lots of attack
surface against the hypervisor via the PCI devices attached to it.

- -- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmKjfCMACgkQsoi1X/+c
IsHGBRAAstI3qMSbYWwTr5Hfq235YJwNtZFyePXaYcze5mhWfje7fH0eZiM6V8RA
qbcQ2V4LLuHIGELemK7wrk9ELt9So3LThNaW+Xx+YFIzpzkcQp+mxwbDx8Je4xnQ
VkuXlzBLp6rLN/R6Ezs4xgTiaM1Xq+UR3s4pUYriYX7mOUM8tF7BeSlHnEJ7+/It
JPpBdX+GuA/EUxH9BF4IumkUvSdEU9R82cF4Gw/XGdfAg+rmethL9ZAn3BxYVRf0
uaHlOD0Cm3lKGzzhgXfAKToRbNUcOIG0JrYZ3dNafsu+6RWGhhfEb2f0R9q0gnZ8
L0uO/n7+GedtRExhTD9t/t2PO9wRu4UeLAADVz9y6ROgyd15tn3/U1H6DHTqsN2A
j86l/7rQNEN1gkE1udA+KQafGudb9IVg7/SOC66sMEhcLehSP9/Vj7bSYfSVL+8w
8kINXDOpHA9asOu6AKLxEnFTKBA8yLTZzuMEUouUN8mk9rjdkvVmA8hkL5KXkyy3
Q9w/4bLwDD5Bt7XweLXgD6m7yOj+zgKR1SHGRODlUrPZ8LH99SzsnLk9NL5WiQIe
eTm9/HS2WSNlqSRMt4GONob9GIlg3mHIbNtXdDVxWy5R7HmODaZnXCkRYoGUcJJT
hqaENpR0iXSWWpzMLOwDrbIC1pm02oWVRRU3BaSuJoPquH4slNo=
=RKYH
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/YqN8JHiC3Mv82GVa%40itl-email.


[qubes-users] yggdrasil & qubes netvm question

2022-06-10 Thread Oleg Artemiev
1) Has anyone succeeded in enabling the yggdrasil network in NetVM qube?
I'm thinking about Qubes standalone PC as a server machine with the
ability to use NetVM as a shell box via yggdrasil IP.

2) BTW: it should open an attack surface on the NetVM. Is it right
that this will open the attack surface to the NetVM only or yggdrasils
multicast announces are about to interfere with other qubes?

-- 
Bye.
https://keybase.io/grey_olli
Blog keys (the blog is mostly in Russian): http://grey-olli.livejournal.com/tag/

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CABunX6PX2DrmmaKOs%2BQ29tSTpPCCTdHxpP7e6UZ1PDksUpm6Qg%40mail.gmail.com.


Re: [qubes-users] Problems with announced Fedora 35 templates

2022-06-10 Thread Catacombs
With Fedora 34 having reached EOL now, is there anything else I can do, 
other than a complete new installation of Qubes OS R4.1 ? 

With kind regards,

Viktor

 
HI, I am not an extremely knowledgeable Qubes user, but, I did not want 
your post to go on like no one cared.  I am pretty sure the developers do 
care, they just need to spend their time working on --- stuff.  And that 
might include exactly what will be helpful to you.

I had some problems installing and using Fedora 35, and then updating it 
later.  Sigh.   

When I originally installed Qubes 4.1, I chose the option to update over 
Tor.  Used to be I needed to start the Tor Browser for that to work.  If 
nothing else, Tor Browser downloads really slowly.  I once started to 
download an iso of like a gigabyte, and it would take hours.  I am 
suggesting that in some cases, trying to download can have timing issues 
where some things drop out.   And I can guess the system set up by our 
Qubes developers is not supposed to do that.  and I can not prove that it 
does.   Just when it rains here.  My connection hiccups.   I am just 
tolerant and try again.

I like the solution I think the developers are working on right now. 

https://github.com/QubesOS/qubes-issues/issues/7544

Which explains itself.



>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ba2ce0fc-e567-4867-a95b-d787b863e2ecn%40googlegroups.com.


[qubes-users] qubes update -- how to hold an old kernel ??

2022-06-10 Thread haaber

Recent QSB made me run the qubes-update. Regrettably, it wants to remove
a kernel version that I need to hold (in case of foreseeable problems
with newer ones). How can I freeze that older version and forbid its
uninstall?

best, Bernhard

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/768dacc5-75d6-cd28-0792-622d19078238%40web.de.