diff --git a/.gitignore b/.gitignore index 2246f6a..8bdc3ac 100644 --- a/.gitignore +++ b/.gitignore @@ -124,3 +124,12 @@ build/*.xdy # WinEdt build/*.bak build/*.sav + +#VScode +.vscode +.vscode/* +settings.json + +#ENV +.aider* +.env diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..457c6e6 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,6 @@ +{ + "workbench.colorCustomizations": { + "titleBar.activeBackground": "#58535bdd", + "activityBar.background": "#4c474faa" + } +} \ No newline at end of file diff --git a/README.md b/README.md index 5fd64af..a3cc213 100644 --- a/README.md +++ b/README.md @@ -4,15 +4,15 @@ This cheat sheet contains commands and examples for [Qubes OS](https://www.qubes ## Downloads -- **Markdown (Text): [qubes-cheatsheet.md](https://github.com/Jeeppler/qubes-cheatsheet/blob/master/qubes-cheatsheet.md)** +- **Markdown (Text): [qubes-cheatsheet.md](https://github.com/netbones/qubes-cheatsheet/blob/master/qubes-cheatsheet.md)** -- **PDF: [qubes-cheatsheet.pdf](https://github.com/Jeeppler/qubes-cheatsheet/raw/master/qubes-cheatsheet.pdf)** +- **PDF: [qubes-cheatsheet.pdf](https://github.com/netbones/qubes-cheatsheet/blob/master/qubes-cheatsheet.pdf)** -- **HTML: [qubes-cheatsheet.html](https://htmlpreview.github.io/?https://github.com/Jeeppler/qubes-cheatsheet/blob/master/qubes-cheatsheet.html)** +- **HTML: [qubes-cheatsheet.html](https://htmlpreview.github.io/?https://github.com/netbones/qubes-cheatsheet/blob/master/qubes-cheatsheet.html)** -- **Text: [qubes-cheatsheet.txt](https://github.com/Jeeppler/qubes-cheatsheet/raw/master/qubes-cheatsheet.txt)** +- **Text: [qubes-cheatsheet.txt](https://github.com/netbones/qubes-cheatsheet/blob/master/qubes-cheatsheet.txt)** -*The files are generated with the help of [`generate.sh`](https://github.com/Jeeppler/qubes-cheatsheet/blob/master/generate.sh)* +*The files are generated with the help of [`generate.sh`](https://github.com/ubuntupunk/qubes-cheatsheet/blob/master/generate.sh)* ## Other formats @@ -26,10 +26,10 @@ Pandoc can generate different files from one [markdown](http://daringfireball.ne pandoc metadata.yaml qubes-cheatsheet.md -s -o qubes-cheatsheet.pdf # outputs the qubes cheat sheet as HTML (HTML5) file -pandoc metadata.yaml qubes-cheatsheet.md -s -S -t html5 -o qubes-cheatsheet.html +pandoc metadata.yaml qubes-cheatsheet.md -s -t html5 -o qubes-cheatsheet.html # outputs the qubes cheat sheet as plain text -pandoc qubes-cheatsheet.md -s -S -t plain -o qubes-cheatsheet.txt +pandoc qubes-cheatsheet.md -s -t plain -o qubes-cheatsheet.txt ``` `qubes-cheatsheet.md` is the input file and `qubes-cheatsheet.xxx` the output file. diff --git a/additional/additional.md b/additional/additional.md new file mode 100644 index 0000000..1aceefe --- /dev/null +++ b/additional/additional.md @@ -0,0 +1,79 @@ + +## Troubleshooting + +SEE: **Qubes VM troubleshooting](https://www.qubes-os.org/doc/vm-troubleshooting/)** + +https://forum.qubes-os.org/t/qubes-salt-beginners-guide/20126 + +### [WARNING] top_file merging strategy is set to 'merge' and multiple top files were found. Merging order in not deterministic, it may be desirable to either set top_file_merging_strategy to 'same' or use the 'env_order' configuration parameter to specify the merging order. + +set these keys in /etc/salt/minion.d/f_defaults.conf: + +``` +top_file_merging_strategy: merge +env_order: ['base', 'user'] +``` + +### [CRITICAL] Specified ext_pillar interface qvm_prefs is unavailable. + +Excute the following commands: + + ``` +qubesctl saltutil.clear_cache +qubesctl saltutil.sync_all refresh=true + +qubesctl saltutil.sync_all + +sudo qubes state.highstate + ``` + + + + ### TLDR + +``` +qubesctl saltutil.clear_cache +qubesctl top.enable qvm.sys-net qvm.sys-firewall qvm.work qvm.personal qvm.untrusted qvm.vault +``` +### for Whonix: +```qubesctl top.enable qvm.sys-whonix qvm.anon-whonix +``` +### for USB VM (sys-usb): +``` +qubesctl top.enable qvm.sys-usb +``` +### apply all the above +``` +qubesctl state.highstate +``` + +### for GUI-vm +``` +qubesctl top.enable qvm.sys-gui +qubesctl top.enable qvm.sys-gui pillar=True +qubesctl --all state.highstate +``` + +### Whonix not starting +There were some recent Kernel updates in Qubes. In the Settings | Advanced for the TemplateVM if I switch from the (new) default 5.13.6-1.fc25 kernel back to an earlier version 5.12.14-1.fc25 then things start working normally again. + +If I leave the AppVM based on this template at 5.12.14-1.fc25, then it works as well. + +It seems that this particular Debian 10 template is the only one that breaks with the newer kernel. This template has some Snaps and other software installed. Other Debian (full & minimal) and Fedora templates appear to be working. + +similer kernal issue, libexenlight fails https://forum.qubes-os.org/t/libxenlight-failed-to-create-new-domain/27032/12 +## Templates, are handled through RPC policies + +1. For example, you could create the file /etc/qubes/policy.d/30-user.policy in dom0 with content similar to the following: + +### HTTP proxy for downloading updates +### Update Whonix templates through sys-whonix +qubes.UpdatesProxy * @tag:whonix-updatevm @default allow target=sys-whonix +### Deny Whonix templates from using any other qube to update +qubes.UpdatesProxy * @tag:whonix-updatevm @anyvm deny +### Update all other templates through sys-firewall and deny everything else +qubes.UpdatesProxy * @type:TemplateVM @default allow target=sys-firewall +qubes.UpdatesProxy * @anyvm @anyvm + +#DNS +https://forum.qubes-os.org/docs?topic=13749 \ No newline at end of file diff --git a/additional/librem/librem_key_documentation.md b/additional/librem/librem_key_documentation.md new file mode 100644 index 0000000..b7ebd3c --- /dev/null +++ b/additional/librem/librem_key_documentation.md @@ -0,0 +1,591 @@ +## About the Librem Key + +The Librem Key is a USB security token that can be used to store GPG keys, manage +passwords, provide multi-factor authentication, and can integrate with the Heads tamperevident BIOS to detect BIOS-level tampering. In this manual we will document how to perform +some of the most common operations with the Librem Key. + +### What is a USB Security Token? + +In case you haven’t heard of USB security tokens before, they are devices typically about the +size of a USB thumb drive that can act as “something you have” for multi-factor +authentication. With so many attacks on password logins, most security experts these days +recommend adding a second form of authentication (often referred to as “2FA” or “multi-factor +authentication”) in addition to your password so that if your password gets compromised the +attacker still has to compromise your second factor. USB security tokens work well as this +second factor because they are “something you have” instead of “something you know” like a +password is, and because they are portable enough you can just keep them in your pocket, +purse, or keychain and use them only when you need to login to a secure site. +In addition to multi-factor authentication, security tokens can also often store your private +GPG keys in a tamper-proof way so you can protect them from attackers who may +compromise your laptop. With your private keys on the security token, you can just insert the +key when you need to encrypt, decrypt, sign, or authenticate and then type in your PIN to +unlock the key. Since your private keys stay on the security token, even if an attacker +compromises your computer, they can’t copy your keys (and even if you leave the key +plugged in, they need to know your PIN to use it). + +### About this Manual + +This manual will guide you through some of the most common things you will do with your +Librem Key including using it to store GPG keys, integrating it with LUKS disk decryption, and +using it with the Heads tamper-evident BIOS. Because the Librem Key was made in +partnership with Nitrokey, it also works with Nitrokey’s own userspace software to perform +2FA and password management functions. + +### Managing GPG Keys + +Most of the tools (like GPG) you need to manage GPG keys on your Librem Key should +already be installed in PureOS or any other Linux distribution you might use with the +exception of scdaemon. This daemon manages OpenPGP smart cards on the system and exception of scdaemon. +This daemon manages OpenPGP smart cards on the system and +may not be installed by default, so use your package manager to install the “scdaemon” +package. If you want to use the command line you can type: +``` +sudo apt install scdaemon +``` +This will be necessary before you proceed to detect your OpenPGP Smart Card. +While your Librem Key can generate GPG keys on the device itself, doing so means you have +no backups. If you plan to use your GPG key for email encryption and signing, then you will +want to generate it on a computer so you can back it up. If you plan to just use the Librem Key +for tamper-evident boot with Heads, then you may not need a backup of the key since you can +still boot into your OS and can replace the current key in Heads with a different one later if you +ever lose the Librem Key. + +### Detecting Your OpenPGP Smart Card + +To detect your OpenPGP Smart Card, open a terminal application (hit the Purism logo key on +your keyboard and type “terminal” in the window that appears) and then type: + +``` +gpg --card-status + +``` + +You will see output like: + +``` + +Reader ...........: 20A0:4108:000000000000000000006143:0 +Application ID ...: D2760001240103030005000061430000 +Version ..........: 3.3 +Manufacturer .....: ZeitControl +Serial number ....: 00006143 +Name of cardholder: [not set] +Language prefs ...: de +Sex ..............: unspecified +URL of public key : [not set] +Login data .......: [not set] +Signature PIN ....: forced +Key attributes ...: rsa2048 rsa2048 rsa2048 +Max. PIN lengths .: 64 64 64 +PIN retry counter : 3 0 3 +Signature counter : 4 +Signature key ....: [none] +Encryption key....: [none] +Authentication key: [none] +General key info..: [none] + +Change or Unblock a PIN on the Librem Key + +``` + +By default the user PIN on the Librem Key is 123456 and the admin PIN is 12345678 which +are easy to guess. When you first get your Librem Key you will want to change the default PIN +to something else. First enter the interactive GPG card edit menu: +gpg --card-edit + +Now in the gpg/card> prompt type admin to enter admin mode and then passwd to change +the PIN on your Librem Key: + +``` +admin +passwd +``` + +If you forget your PIN or enter it incorrectly too many times, the smart card will automatically +block that user PIN and you will have to enter your GPG admin PIN to unlock it. This uses the +same commands as to change the PIN: + +``` +admin +passwd +``` + +Once you are finished, you can type quit to exit. If you get stuck, type help for more +documentation on the available commands. + +### Generate GPG Keys On Your Computer + +For most people facing average threats, it’s better to generate the GPG keys on your +computer, back them up, and then transfer them to your Librem Key instead of generating +them directly on the Librem Key. Otherwise, if you lose the Librem Key you won’t be able to +restore your private GPG keys to a replacement. +The first step is to generate the key itself: + +``` +gpg --gen-key +``` + +This command will generate the master key used to sign any other GPG subkeys. You will be +prompted for the name and email address to use for this key. If you intend on using this key to +encrypt and sign email, be sure you specify the proper email address you intend to use. +When prompted to set an expiration date, either select the default (0) so the key doesn’t +expire, or specify a particular date that the key will expire. The idea behind key expiry is to +protect against an attacker who may have the capability in the future to crack your GPG +private key, given enough time. By setting an expiration date of, for instance, a few years into +the future, you are betting that it will take the attacker longer than that to crack the key or find +a flaw in the current encryption used for the key. By that time you will have switched to a new +key and all communications going forward will be protected. Whether you set an expiration +date or not largely depends on the threats you face personally, and the amount of effort you +are willing to spend to generate fresh keys. + +Your master key will have its own unique long ID you can use to refer to it, in case you have +multiple GPG keys that have the same email address assigned to them: + +``` +gpg -k kyle.rankin@puri.sm +pub +rsa4096/0xBD83B92B2F4BFD99 2018-01-11 [SC] +Key fingerprint = 7B85 0961 8D82 0DF6 3924 1BB6 BD83 B92B 2F4B FD99 +uid +[ unknown] Kyle Rankin +``` + +The first line in the output shows you the key id (in my case 0xBD83B92B2F4BFD99): +pub + +``` +rsa4096/0xBD83B92B2F4BFD99 2018-01-11 [SC] +``` + +In the above example I referred to my key by its email address, but I could also use its id + +``` +0xBD83B92B2F4BFD99: +gpg -k 0xBD83B92B2F4BFD99 +pub + +rsa4096/0xBD83B92B2F4BFD99 2018-01-11 [SC] +Key fingerprint = 7B85 0961 8D82 0DF6 3924 1BB6 BD83 B92B 2F4B FD99 +uid +[ unknown] Kyle Rankin +``` + +### Add Subkeys to Your GPG Keys + +Your Librem Key will not hold your master GPG key. That key will only be used to sign other +GPG keys. When you generate your master key it automatically generates a subkey +specifically for encryption, but you will need to generate additional subkeys for signing, and +authentication and it’s these three subkeys that will get stored and used from the Librem Key. +To generate subkeys, you will need to edit the key you just created: + +``` +gpg --expert --edit-key +``` + +This command will launch an interactive gpg> prompt where you can enter specific +commands. The addkey command will create a new subkey under your master key and walk +you through questions about: +• key type (this will vary depending on which subkey you create) +• key size (use 4096) +• key expiration date (if in doubt, pick a similar expiration date to the one you used for your +master key, or optionally a shorter one as it’s easier to rotate subkeys compared to a +master key). For this example I picked no expiration date (0). + +First create a new signing subkey: + +``` +addkey +4 +4096 +0 +``` + +Then create the authentication subkey. This one is a bit special as you will have to disable +Signing and Encryption capabilities and enable authenticate capabilities to generate this key: + +``` +addkey +8 +S +E +A +Q +4096 +0 +``` + +Now that the subkeys are created, you should set the public key to the ultimate trust level and +then save: + +``` +trust +5 +save +``` + +Now you will be back to a normal terminal prompt. + +### Back Up your GPG Keys + +The act of transferring subkeys over to the Librem Key will erase them on your current +system, so you will want to back them up to removable media like one or two separate USB +thumb drives. Then you can store those keys in a safe, safe-deposit box, or other secure +place. The advantage of backing up on two USB thumb drives is that you can store one onsite and one off-site. +Before you back everything up, you should generate a revocation certificate for your key. With +this backed up somewhere, you will be able to revoke your key in case it’s ever compromised +or you lose it: + +``` +gpg --output revoke.asc --gen-revoke + +``` + +Then you can back up the revoke.asc file that command generates. + +Back Up the Whole GNUPG Directory + +### Back Up the Whole GNUPG Directory + +There are two main ways to back up your GPG keys. The first is to just copy your entire +~/.gnupg directory over to a thumb drive. Let’s say it is mounted at /media/kyle/8439-AFIJ +(your PureOS desktop will automatically mount a thumb drive in a location like that when you +insert it) you could use the GUI file manager to copy and paste the /home/ +yourusername/.gnupg directory over to the thumb drive, or in a terminal you could type: + +``` +cp -a ~/.gnupg /media/kyle/8439-AFIJ/ +cp revoke.asc /media/kyle/8439-AFIJ/ +``` + +Remember to change the destination directory to match wherever your thumb drive was +mounted. If in doubt, you can type the mount command to get a list of the currently mounted +file systems. + +### Back Up Just Your Keys + +If you just want to back up your keys, you can export them separately: + +``` +gpg --armor --output privkey.sec --export-secret-key +gpg --armor --output subkey.sec --export-secret-subkeys +gpg --armor --output pubkey.asc --export +``` + +Now you can copy the privkey.sec, subkey.sec, pubkey.asc and the revoke.asc to a thumb +drive: + +``` +cp privkey.sec subkey.sec pubkey.asc revoke.asc /media/kyle/8439-AFIJ/ +``` + +Once you have backed them up, be sure to delete the privkey.sec, subkey.sec and +revoke.asc files. + +### Move GPG Subkeys Over to The Librem Key + +To transfer your GPG subkeys over to the Librem Key, first insert the Librem Key and make +sure that gpg --card-status shows that it has detected the key: + +``` +gpg --card-status +Reader ...........: 20A0:4108:000000000000000000006143:0 +Application ID ...: D2760001240103030005000061430000 +Version ..........: 3.3 +Manufacturer .....: ZeitControl +Serial number ....: 00006143 +Name of cardholder: [not set] +Language prefs ...: de +Sex ..............: unspecified +URL of public key : [not set] +public key +Login data .......: [not set] +Signature PIN ....: forced +Key attributes ...: rsa2048 rsa2048 rsa2048 +Max. PIN lengths .: 64 64 64 +PIN retry counter : 3 0 3 +Signature counter : 4 +Signature key ....: [none] +Encryption key....: [none] +Authentication key: [none] +General key info..: [none] +``` + +In this output you can see that no signature, encryption or authentication keys have been +loaded: + +``` +Signature key ....: [none] +Encryption key....: [none] +Authentication key: [none] +General key info..: [none] +``` + +To copy keys over, we go back to the interactive GPG menu that shows up when we edit our +key: + +``` +gpg --expert --edit-key +``` + +In the output you will see a few subkeys listed: + +``` +$ gpg --expert --edit-key kyle.rankin@puri.sm +gpg (GnuPG) 2.1.18; Copyright (C) 2017 Free Software Foundation, Inc. +This is free software: you are free to change and redistribute it. +There is NO WARRANTY, to the extent permitted by law. +Secret key is available. +pub + +rsa4096/0xBD83B92B2F4BFD99 +created: 2018-01-11 expires: never +trust: ultimate +validity: ultimate +ssb rsa2048/0x6A6F096B8E4C29C9 +created: 2018-01-11 expires: never +ssb rsa2048/0x555577116BFA74B9 +created: 2018-01-11 expires: never +ssb rsa2048/0x1801C77F078C5DEE +created: 2018-01-11 expires: never +[ unknown] (1). Kyle Rankin + +usage: SC + +usage: E +usage: S +usage: A +``` + +Now inside the gpg> prompt we will type key 1 to select the first subkey which will add an +asterisk next to the “ssb” column for that key in the output: + +``` +key 1 +pub +rsa4096/0xBD83B92B2F4BFD99 +created: 2018-01-11 expires: never +trust: unknown +validity: unknown +ssb* rsa2048/0x6A6F096B8E4C29C9 +created: 2018-01-11 expires: never +ssb rsa2048/0x555577116BFA74B9 +created: 2018-01-11 expires: never +ssb rsa2048/0x1801C77F078C5DEE +created: 2018-01-11 expires: never +[ unknown] (1). Kyle Rankin + +usage: SC + +usage: E +usage: S +usage: A +``` + +Now type the keytocard command to move that key over to the smart card. When prompted +tell it that you want to select 2, your Encryption key: + +``` +keytocard +``` + +Next you will type key 1 to untoggle key 1, then type key 2 to toggle key 2, and type +keytocard to add that to your Librem Key. When prompted tell it that you want to select 1, +your Signature Key: + +``` +key 1 +key 2 +keytocard +``` + +Finally you will type key 2 to untoggle key 2, then type key 3 to toggle key 3, and type +keytocard to add that to your Librem Key. When prompted tell it that you want to select 3, +your Authentication Key. Then save to exit: + +``` +key 2 +key 3 +keytocard +save +``` + +### Factory Reset GPG Keys on The Librem Key + +If you ever want to delete all of the keys, passwords, and settings on the Librem Key you will +need to enter the card edit menu for GPG: + +``` +gpg --card-edit +``` + +Then from the gpg/card> prompt you will type admin to enter admin mode and then factoryreset to erase keys and PINs and refer to factory settings: + +``` +admin + +factory-reset +``` + +### Generate GPG Subkeys on The Librem Key + +If you do decide that you want your GPG keys to only exist on the Librem Key, you can +generate them directly on that device. First enter the GPG card edit menu: + +``` +gpg --card-edit +``` + +Then from the gpg/card> prompt type admin to enter admin mode and then generate to +generate new keys on the device: + +``` +admin +generate +``` + +Follow the interactive prompts to generate the keys. You should be prompted with the option +to export a copy of your keys to back them up, which I recommend you do. Type quit to exit +the menu when you are done: + +``` +quit +``` + +At the very least you will want a copy of your public key, so type: + +``` +gpg --armor --output pubkey.asc --export +``` + +Then you can share pubkey.asc with a public key server or anyone you want to send you +encrypted communications. + +### Change Language Settings on the Librem + +/Key/ +The Librem Key currently defaults to German as its on-board GPG language setting. This +means when you plug it in, you might get a desktop prompt in German instead of English. To +change the default language used by the Librem Key for GPG, first enter the GPG card edit +menu: + +``` +gpg --card-edit +``` + +Then from the gpg/card> prompt type admin to enter admin mode and then lang to change +the language. For instance to change it from German to English, set it to en when you see the + +/Language preferences: prompt:/ + +``` +admin +lang +``` + +Then type quit to exit the menu when you are done: + +``` +quit +``` + +### Decrypt LUKS-encrypted Drives with Librem Key + +PureOS’s cryptsetup-initramfs now has support for using OpenPGP smartcards like the +Librem Key to unlock LUKS-encrypted volumes. This means when you boot, you just insert +your Librem Key and enter your GPG PIN instead of typing in your regular disk encryption +passphrase. If you are interested in trying this out yourself, we are working on adding a script +upstream to automate the process of configuring your root LUKS partition to use a Librem +Key. + +In the mean time we have a basic script in place at https://source.puri.sm/pureos/packages/ +smartcard-key-luks that you can use to automate the whole process (or just to use as a +reference to see what changes you need to make to enable this by hand). The script requires +the scdaemon package be installed and needs you to have an exported GPG public key in a +file on the local system that corresponds to the private key on your Librem Key. Then +download the script, ensure it has execute permissions, then run: + +``` +sudo ./smartcard-key-luks +``` + +This script will also set up the “recovery” Linux boot options in GRUB so that they bypass the +Librem Key and fall back to the passphrase you have already configured for your root volume. +Note that this script does modify the /etc/grub.d/10_linux and /usr/sbin/grub-mkconfig scripts +to allow for this recovery feature. We are working to upstream this patch to grub-common. + +### Automatically Lock the Desktop When Removing the Librem Key + +Through the use of a simple script and udev rules, you can have your computer lock the +screen when you pull out your Librem Key. This integration requires two files: /etc/udev/ +rules.d/85-libremkey.rules and /usr/local/bin/gnome-screensaver-lock : + +**85-libremkey.rules** + +``` +ACTION=="remove", ENV{PRODUCT}=="316d/4c4b/101" RUN+="/usr/local/bin/gnome-screensaver-lock" +``` + +**gnome-screensaver-lock** + +``` +#!/bin/sh +user=`ps aux | egrep "gdm-(wayland|x)-session" | head -n 1 | awk '{print $1}'` + +if [ -n $user ]; then +su $user -c "/usr/bin/dbus-send --type=method_call --dest=org.gnome.ScreenSaver /org +fi + +``` +You will need to trigger udev to reload upon installation so it picks up the new rule. You can +do that this way: + +``` +systemctl restart udev +``` + +### Using the Librem Key with Heads + +TODO: This section will be incomplete until we finalize the initial Heads UI. In the mean time +this blog post describes how the Librem Key integrates with Heads +[The Librem Key Makes Tamper Detection Easy](http://web.archive.org/web/20240927115201/https://puri.sm/posts/the-librem-key-makes-tamper-detection-easy/) + +### Technical Specs +• Key slots: Three key slots supporting RSA 2048-4096 bit and ECC 256-512 bit +• Supported elliptic curves: NIST P-256, P-384, P-521 (secp256r1/prime256v1, +secp384r1/ prime384v1, secp521r1/prime521v1), brainpoolP256r1, brainpoolP384r1, +brainpoolP512r1 +• Protocols: CSP, OpenPGP, S/MIME, X.509, PKCS#11 +• One-time password storage: 3x HOTP (RFC 4226), 15 x TOTP (RFC 6238) +• Integrated password manager: 16 entries +• Random number generator: 40 kbits true random number generator +• Tamper-resistant smart card +• Life expectancy: > 100,000 PIN entries +• Storage time: > 20 years +• USB: USB 2.0, type A +• Dimensions: 48 x 19 x 7 mm +• Weight: 6g +• Safety and environmental compliance: FCC, CE, RoHS, WEEE + +### Other Resources +• [Librem Key Product Page](http://web.archive.org/web/20240927115201/https://puri.sm/products/librem-key) – where to go to order the Librem Key + +• [Introducing the Librem Key](http://web.archive.org/web/20240927115201/https://puri.sm/posts/introducing-the-librem-key/) – a blog post that provides an easy-to-understand overview of +the Librem Key + +• [The Librem Key Makes Tamper Detection Easy](http://web.archive.org/web/20240927115201/https://puri.sm/posts/the-librem-key-makes-tamper-detection-easy/) – a blog post that describes how the Librem Key integrates with Heads + +• [Librem Key firmware code](http://web.archive.org/web/20240927115201/https://github.com/Nitrokey/nitrokey-pro-firmware) + +• [Librem Key HOTP userspace code](http://web.archive.org/web/20240927115201/https://github.com/Nitrokey/nitrokey-hotp-verification) + +• [Supplemental Nitrokey Documentation](http://web.archive.org/web/20240927115201/https://www.nitrokey.com/documentation) + +• [The Heads Project](http://web.archive.org/web/20240927115201/https://github.com/osresearch/heads/) + + +This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License + +2024/10/05, 09:38 + + +```` diff --git a/additional/quirks.md b/additional/quirks.md new file mode 100644 index 0000000..27bebd5 --- /dev/null +++ b/additional/quirks.md @@ -0,0 +1,130 @@ +## Qubes OS Quirks +--- + +### Documentation for the HP EliteBook 820 G3 + +These are current known working configurations for the HP EliteBook 820 G3. + +--- +#### *0. Dom0* + +* Template: + +`AdminVM` + +* Basic + +* Advanced + +`Default Disp template: default-dvm` + +* Firewall Rules + +* Devices + +* Applications + +* Services + +--- + +#### *1. Sys-net* + +* Basic + + Net Qube/Net VM: + `current i.e sys-net` + +* Advanced + + `Initial Mem: 400mb` + + `Max: ` + + `VCPUs: 2` + + Kernel: `provided by Qube (current)` + + `Virtualization: HVM` + +* Firewall Rules + +* Devices + +* Applications + +* Services + + `clocksync` + + `qubes-update-proxy` + + --- + +#### 2. *Sys-firewall* + +* Template: + +`whonix-workstation-17-dvm` + +* Basic + + Net Qube/Net VM: + + `sys-net` + +* Advanced: + + `Initial Mem: 400mb` + + `Max: 4000mb` + + `VCPUs: 2` + + `Default Disp template: whonix-workstation` + + `Kernel 6.1.62-1.fc37` + + `Virtualization: PVH` + ` +* Firewall Rules: + +* Devices: + +* Applications: + +* Services: + +--- + +## Notes + +### To check the IP rules in the qube: + +>**$GURU MEDITATION:** ```sudo nft list ruleset``` + +To allow incoming IPv4 ICMP: + +```sudo nft add rule ip qubes custom-input meta l4proto icmp accept``` + +To make it persistent add it in ```/rw/config/rc.local.``` + +Also check [this Firewall guide]https://www.qubes-os.org/doc/firewall/): + +### Network service qubes + +>**$GURU MEDITATION:** `qvm-ls -n` + +Qubes does not support running any networking services (e.g. VPN, local DNS server, IPS, …) directly in a qube that is used to run the Qubes firewall service (usually sys-firewall) for good reasons. In particular, if you want to ensure proper functioning of the Qubes firewall, you should not tinker with nftables rules in such qubes. + +Instead, you should deploy a network infrastructure such as + +```sys-net <--> sys-firewall-1 <--> network service qube <--> sys-firewall-2 <--> [client qubes]``` + +Thereby sys-firewall-1 is only needed if you have other client qubes connected there, or you want to manage the traffic of the local network service qube. The sys-firewall-2 proxy ensures that: + + Firewall changes done in the network service qube cannot render the Qubes firewall ineffective. + Changes to the Qubes firewall by the Qubes maintainers cannot lead to unwanted information leakage in combination with user rules deployed in the network service qube. + A compromise of the network service qube does not compromise the Qubes firewall. + +If you adopt this model, you should be aware that all traffic will arrive at the network service qube appearing to originate from the IP address of sys-firewall-2 \ No newline at end of file diff --git a/additional/schema.png b/additional/schema.png new file mode 100644 index 0000000..89c823e Binary files /dev/null and b/additional/schema.png differ diff --git a/generate.sh b/generate.sh index d84d822..4cfba83 100755 --- a/generate.sh +++ b/generate.sh @@ -9,10 +9,10 @@ then pandoc metadata.yaml qubes-cheatsheet.md -s -o qubes-cheatsheet.pdf # outputs the qubes cheat sheet as HTML (HTML5) file - pandoc metadata.yaml qubes-cheatsheet.md -s -S -t html5 -o qubes-cheatsheet.html + pandoc metadata.yaml qubes-cheatsheet.md -s -t html5+smart -o qubes-cheatsheet.html # outputs the qubes cheat sheet as plain text - pandoc qubes-cheatsheet.md -s -S -t plain -o qubes-cheatsheet.txt + pandoc qubes-cheatsheet.md -s -t plain+smart -o qubes-cheatsheet.txt else # pandoc is not installed inform the user echo "The command pandoc could not be found in the PATH!\n" diff --git a/qubes-cheatsheet.html b/qubes-cheatsheet.html index dafd44d..a3e6237 100644 --- a/qubes-cheatsheet.html +++ b/qubes-cheatsheet.html @@ -1,28 +1,183 @@ - + - - - + + + Qubes OS Cheatsheet - - + -
+

Qubes OS Cheatsheet

Qubes Cheatsheet

a summary of useful qubes commands

-

version: 3.2

+

version: 3.3

Mini Glossary

  • Xen - Hypervisor
  • VM - Virtual Machine
  • Qube - Qubes OS specific alias for VM
    • -
  • Dom0 - Priviledged Xen VM (runs Qubes Manager)
    • +
  • Dom0 - Privileged Xen VM (runs Qubes Manager)
  • DomU - Normal Xen VM
  • QWT - Qubes Windows Tools
  • PV - Paravirtualized VM
    • @@ -31,7 +186,8 @@

    Mini Glossary

  • GUI - Graphical User Interface

VM Management

-

NOTE: All commands are executed in @Dom0 terminal (Konsole, Terminal, Xterm etc.)

+

NOTE: All commands are executed in @Dom0 terminal +(Konsole, Terminal, Xterm etc.)

qubes-manager

- Graphical VM Manager

usage: qubes-manager

@@ -45,25 +201,32 @@

qvm-block

  • qvm-block -d [options] <vm-name>

    • ---

    -

    qvm-block -A personal dom0:/home/user/extradisks/data.img - attaches an additional storage for the personal-vm

    +

    qvm-block -A personal dom0:/home/user/extradisks/data.img +- attaches an additional storage for the personal-vm

    qvm-clone

    - Clones an existing VM by copying all its disk files

    -

    usage: qvm-clone [options] <existing-vm-name> <new-clone-vm-name>

    +

    usage: +qvm-clone [options] <existing-vm-name> <new-clone-vm-name>

    ---

    -

    qvm-clone fedora-23 fedora-23-dev - create a clone of fedora-23 called fedora-23-dev

    +

    qvm-clone fedora-23 fedora-23-dev - create a clone +of fedora-23 called fedora-23-dev

    qvm-firewall

    - Manage VM firewall rules

    usage: qvm-firewall -l [-n] <vm-name>

    ---

    -

    qvm-firewall -l personal - displays the firewall settings for the personal-vm

    -

    qvm-firewall -l -n fedora-23 - displays the firewall settings for the personal-vm with port numbers

    +

    qvm-firewall -l personal - displays the firewall +settings for the personal-vm

    +

    qvm-firewall -l -n fedora-23 - displays the firewall +settings for the personal-vm with port numbers

    qvm-ls

    - Lists VMs and various information about their state

    usage: qvm-ls [options] <vm-name>

    ---

    qvm-ls - lists all vms

    -

    qvm-ls -n - show network addresses assigned to VMs

    -

    qvm-ls -d - show VM disk utilization statistics

    +

    qvm-ls -n - show network addresses assigned to +VMs

    +

    qvm-ls -d - show VM disk utilization +statistics

    qvm-prefs

    - List/set various per-VM properties

    usage:

    @@ -72,104 +235,160 @@

    qvm-prefs

  • qvm-prefs -s [options] <vm-name> <property> [...]

    • ---

    -

    qvm-prefs win7-copy - lists the preferences of the win7-copy

    -

    qvm-prefs win7-copy -s mac 00:16:3E:5E:6C:05 - sets a new mac for the network card

    -

    qvm-prefs lab-win7 -s qrexec_installed true - sets the qrexec to installed

    -

    qvm-prefs lab-win7 -s qrexec_timeout 120 - usefull for windows hvm based vms

    -

    qvm-prefs lab-win7 -s default_user joanna - sets the login user to joanna

    +

    qvm-prefs win7-copy - lists the preferences of the +win7-copy

    +

    qvm-prefs win7-copy -s mac 00:16:3E:5E:6C:05 - sets +a new mac for the network card

    +

    qvm-prefs lab-win7 -s qrexec_installed true - sets +the qrexec to installed

    +

    qvm-prefs lab-win7 -s qrexec_timeout 120 - usefull +for windows hvm based vms

    +

    qvm-prefs lab-win7 -s default_user joanna - sets the +login user to joanna

    qvm-run

    - Runs a specific command on a vm

    -

    usage: qvm-run [options] [<vm-name>] [<cmd>]

    +

    usage: +qvm-run [options] [<vm-name>] [<cmd>]

    ---

    -

    qvm-run personal xterm - runs xterm on personal

    -

    qvm-run personal xterm --pass-io - runs xterm and passes all sdtin/stdout/stderr to the terminal

    -

    qvm-run personal "sudo dnf update" --pass-io --nogui - pass a dnf update command directly to the VM

    +

    qvm-run personal xterm - runs xterm on +personal

    +

    qvm-run personal xterm --pass-io - runs xterm and +passes all sdtin/stdout/stderr to the terminal

    +

    qvm-run personal "sudo dnf update" --pass-io --nogui - +pass a dnf update command directly to the VM

    qvm-start

    - Starts a vm

    usage: qvm-start [options] <vm-name>

    ---

    qvm-start personal - starts the personal-vm

    -

    qvm-start ubuntu --cdrom personal:/home/user/Downloads/ubuntu-14.04.iso - starts the ubuntu-vm with the ubuntu installation CD

    +

    qvm-start ubuntu --cdrom personal:/home/user/Downloads/ubuntu-14.04.iso +- starts the ubuntu-vm with the ubuntu installation CD

    qvm-shutdown

    - Stops a vm

    usage: qvm-shutdown [options] <vm-name>

    ---

    -

    qvm-shutdown personal - shutdowns the personal-vm

    -

    qvm-shutdown --all - shutdowns all VM’s

    +

    qvm-shutdown personal - shutdowns the +personal-vm

    +

    qvm-shutdown --all - shutdowns all non-nested VM’s +(no wait queue)

    +

    qvm-shudown --all --wait - shutdowns all VM’s +(shutdown is queued by the –wait option and includes nested VM’s, such +as sys-net and sys-firewall. (Currently only tested on Qubes +4.0.)

    qvm-kill

    -

    - Kills a VM - same as pulling out the power cord - immediate shutdown

    +

    - Kills a VM - same as pulling out the power cord - immediate +shutdown

    usage: qvm-kill [options] <vm-name>

    ---

    -

    qvm-kill personal - pull the power cord for the personal-vm - immediate shutdown

    +

    qvm-kill personal - pull the power cord for the +personal-vm - immediate shutdown

    qvm-trim-template

    - Trims the disk space of a template

    usage: qvm-trim-template <template-name>

    ---

    -

    qvm-trim-template debian-8 - helpful after upgrading or removing many packages/files in the template

    +

    qvm-trim-template debian-8 - helpful after upgrading +or removing many packages/files in the template

    qvm-sync-appmenus

    -

    - Updates desktop file templates for given StandaloneVM or TemplateVM

    +

    - Updates desktop file templates for given StandaloneVM or +TemplateVM

    usage: qvm-sync-appmenus [options] <vm-name>

    ---

    -

    qvm-sync-appmenus archlinux-template - useful for custom .desktop files or distributions not using dnf

    +

    qvm-sync-appmenus archlinux-template - useful for +custom .desktop files or distributions not using dnf

    Dom0

    qubes-dom0-update

    -

    - Updates or installes software in dom0

    -

    usage: qubes-dom0-update [--enablerepo][--disablerepo][--clean][--check-only][--gui][--action=*][<pkg list>]

    +

    - Updates or installs software in dom0

    +

    usage: +qubes-dom0-update [--enablerepo][--disablerepo][--clean][--check-only][--gui][--action=*][<pkg list>]

    or

    usage: qubes-dom0-update

    ---

    -

    qubes-dom0-update --check-only - checks if new dom0 updates are available

    +

    qubes-dom0-update --check-only - checks if new dom0 +updates are available

    sudo qubes-dom0-update - updates dom0

    -

    sudo qubes-dom0-update --gui - allows to update dom0 through a graphical window

    +

    sudo qubes-dom0-update --gui - allows to update dom0 +through a graphical window

    ---

    -

    sudo qubes-dom0-update --action=search <search-term> - searches for package in dom0 repositories

    +

    sudo qubes-dom0-update --action=search <search-term> +- searches for package in dom0 repositories

    example:

    -

    sudo qubes-dom0-update --action=search qubes - searches for all qubes package in dom0 repositories

    -

    NOTE: The tool excludes all templates (community and ITL) by default

    +

    sudo qubes-dom0-update --action=search qubes - +searches for all qubes package in dom0 +repositories

    +

    NOTE: The tool excludes all templates (community and ITL) by +default

    ---

    -

    sudo qubes-dom0-update --action=info <package-name> - displays infos about the package

    +

    sudo qubes-dom0-update --action=info <package-name> +- displays infos about the package

    example:

    -

    sudo qubes-dom0-update --action=info qubes-core-dom0 - displays infos about the qubes-core-dom0 package

    +

    sudo qubes-dom0-update --action=info qubes-core-dom0 - +displays infos about the qubes-core-dom0 +package

    qubes-hcl-report

    -

    - Generates a report about the system hardware information

    +

    - Generates a report about the system hardware +information

    usage: qubes-hcl-report [-s] [<vm-name>]

    ---

    -

    qubes-hcl-report - prints the hardware information on the console (terminal)

    -

    qubes-hcl-report personal - sends the hardware information to the personal-vm under /home/user

    -

    qubes-hcl-report -s - prints the hardware information on the console (terminal) and generates more detailed report

    -

    qubes-hcl-report -s personal - sends the detailed hardware information report to the personal-vm

    -

    Note: qubes-hcl-report -s [<vm-name>] generates a more detailed report. This report can contain sensitive information. Please do not upload the report if you do not want to share those information.

    +

    qubes-hcl-report - prints the hardware information +on the console (terminal)

    +

    qubes-hcl-report personal - sends the hardware +information to the personal-vm under /home/user

    +

    qubes-hcl-report -s - prints the hardware +information on the console (terminal) and generates more detailed +report

    +

    qubes-hcl-report -s personal - sends the detailed +hardware information report to the personal-vm

    +

    Note: +qubes-hcl-report -s [<vm-name>] generates a more +detailed report. This report can contain sensitive information. Please +do not upload the report if you do not want to share those +information.

    virsh

    -

    - Management user tool for libvirt (hypervisor abstraction)

    -

    usage: virsh -c xen:/// <command> [<vm-name>]

    +

    - Management user tool for libvirt (hypervisor +abstraction)

    +

    usage: +virsh -c xen:/// <command> [<vm-name>]

    ---

    -

    virsh -c xen:/// list - list running VM’s with additional information

    -

    virsh -c xen:/// list --all - list all VM’s with additional information

    -

    virsh -c xen:/// dominfo personal - lists status of personal VM

    +

    virsh -c xen:/// list - list running VM’s with +additional information

    +

    virsh -c xen:/// list --all - list all VM’s with +additional information

    +

    virsh -c xen:/// dominfo personal - lists status of +personal VM

    xl

    - Xen management tool, based on LibXenlight

    usage: xl <subcommand> [<args>]

    ---

    -

    xl top - Monitor host and domains in realtime

    +

    xl top - Monitor host and domains in +realtime

    DomU

    qvm-copy-to-vm

    - Copy file from one VM to another VM

    -

    usage: qvm-copy-to-vm <vm-name> <file> [<file+>] - file can be a single file or a folder

    +

    usage: +qvm-copy-to-vm <vm-name> <file> [<file+>] +- file can be a single file or a folder

    ---

    -

    qvm-copy-to-vm work Documents - copy the Documents folder to the work VM

    -

    qvm-copy-to-vm personal text.txt - copy the text.txt file to the personal VM

    +

    qvm-copy-to-vm work Documents - copy the +Documents folder to the work VM

    +

    qvm-copy-to-vm personal text.txt - copy the +text.txt file to the personal VM

    Example

    • Open a terminal in AppVM A (e. g. your personal vm)
      • -
    • Let’s assume we want to copy the Documents folder to AppVM B (e. g. your work VM)
      • -
    • The command would be: qvm-copy-to-vm work Documents
      • +
    • Let’s assume we want to copy the Documents folder to +AppVM B (e. g. your work VM)
      • +
    • The command would be: +qvm-copy-to-vm work Documents

    qvm-open-in-vm

    - Opens file in another VM

    -

    usage: qvm-open-in-vm <vm-name> <file> - file can only be a single file

    +

    usage: qvm-open-in-vm <vm-name> <file> - +file can only be a single file

    ---

    -

    qvm-open-in-vm personal document.pdf - opens document.pdf in the personal VM

    -

    qvm-copy-to-vm personal download.zip - opens download.zip in the personal VM

    +

    qvm-open-in-vm personal document.pdf - opens +document.pdf in the personal VM

    +

    qvm-copy-to-vm personal download.zip - opens +download.zip in the personal VM

    DomU and Dom0

    List Qubes commands

      @@ -182,28 +401,51 @@

      List Qubes commands

      1. Press 2x times TAB
      -

      Output: List of qvm-* or qubes* commands.

      -

      List installed Qubes OS packages

      +

      Output: List of qvm-* or qubes* +commands.

      +

      List installed Qubes OS +packages

      - List all installed Qubes OS packages

      Fedora Dom0

      -

      In VM or Dom0: rpm -qa \*qubes-\* - list (qubes-) installed packages

      -

      Files/Folders from and to Dom0

      +

      In VM or Dom0: rpm -qa \*qubes-\* - list (qubes-) +installed packages

      +

      Files/Folders from and to +Dom0

      Move Dom0 -> VM

      Qubes 3.1+

      - Windows + Linux

      -

      dom0 console: qvm-move-to-vm <vm-name> <file> [<file+>] - file can be a single file or a folder

      +

      dom0 console: +qvm-move-to-vm <vm-name> <file> [<file+>] +- file can be a single file or a folder

      ---

      -

      qvm-move-to-vm work screenshot-qubes-gui.png - moves screenshot-qubes-gui.png to the personal VM into the /home/user/QubesIncoming/dom0 folder

      -

      qvm-move-to-vm personal *.png - moves all .png to the personal VM into the /home/user/QubesIncoming/dom0 folder

      -

      qvm-move-to-vm work Pictures/ - moves the Pictures folder and it’s content to the personal VM into the /home/user/QubesIncoming/dom0 folder

      +

      qvm-move-to-vm work screenshot-qubes-gui.png - moves +screenshot-qubes-gui.png to the personal VM +into the /home/user/QubesIncoming/dom0 folder

      +

      qvm-move-to-vm personal *.png - moves all +.png to the personal VM into the +/home/user/QubesIncoming/dom0 folder

      +

      qvm-move-to-vm work Pictures/ - moves the +Pictures folder and it’s content to the +personal VM into the +/home/user/QubesIncoming/dom0 folder

      Copy Dom0 -> VM

      Qubes 3.1+

      - Windows + Linux

      -

      dom0 console: qvm-copy-to-vm <vm-name> <file> [<file+>] - file can be a single file or a folder

      +

      dom0 console: +qvm-copy-to-vm <vm-name> <file> [<file+>] +- file can be a single file or a folder

      ---

      -

      qvm-copy-to-vm personal screenshot-qubes-gui.png - copies screenshot-qubes-gui.png to the personal VM in the /home/user/QubesIncoming/dom0 folder

      -

      qvm-copy-to-vm personal *.png - copies all .png to the personal VM in the /home/user/QubesIncoming/dom0 folder

      -

      qvm-copy-to-vm work Pictures/ - copies the Pictures folder and it’s content to the personal VM in the /home/user/QubesIncoming/dom0 folder

      +

      qvm-copy-to-vm personal screenshot-qubes-gui.png - +copies screenshot-qubes-gui.png to the +personal VM in the +/home/user/QubesIncoming/dom0 folder

      +

      qvm-copy-to-vm personal *.png - copies all +.png to the personal VM in the +/home/user/QubesIncoming/dom0 folder

      +

      qvm-copy-to-vm work Pictures/ - copies the +Pictures folder and it’s content to the +personal VM in the +/home/user/QubesIncoming/dom0 folder

      Qubes < 3.1

      - Linux only

      cat /path/to/file_in_dom0 |
@@ -228,58 +470,89 @@ 
      Copy text between VM A and B
      
 
    1. CTRL+SHIFT+V
      2. 
 
    2. CTRL+V
      3.
    -

    Install Qubes Windows Tools (QWT)

    +

    Install Qubes Windows Tools +(QWT)

      -
    1. sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-windows-tools - install the windows tools (QWT)
      2. -
    2. qvm-start <windows-vmname> - starts Windows VM
      3. -
    3. open a cmd.exe or PowerShell and type bcdedit /set testsigning on
      4. +
    4. sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-windows-tools +- install the windows tools (QWT)
      5. +
    5. qvm-start <windows-vmname> - starts Windows +VM
      6. +
    6. open a cmd.exe or PowerShell and type +bcdedit /set testsigning on
    7. shutdown VM
      8. -
    8. qvm-start <windows-vmname> --install-windows-tools - starts Windows VM and inserts Qubes Windows Tools installation CD
      9. -
    9. double click on qubes-tools-WIN7x64-<version>.exe - execute and install Qubes OS Windows Tools
      10. +
    10. qvm-start <windows-vmname> --install-windows-tools +- starts Windows VM and inserts Qubes Windows Tools installation +CD
      11. +
    11. double click on qubes-tools-WIN7x64-<version>.exe +- execute and install Qubes OS Windows Tools
    12. restart Windows VM

    Troubleshoot

    -

    Application in VM does not start

    -

    - How to get more information if applications in a VM refuse to start

    -

    qvm-run personal "command" --pass-io - pass command directly to the VM. Returns an error message command fails.

    -

    qvm-run personal "xterm" --pass-io - pass xterm command directly to the VM. Returns an error message or starts xterm.

    +

    Application in VM does not +start

    +

    - How to get more information if applications in a VM refuse to +start

    +

    qvm-run personal "command" --pass-io - pass command +directly to the VM. Returns an error message command fails.

    +

    qvm-run personal "xterm" --pass-io - pass +xterm command directly to the VM. Returns an error message +or starts xterm.

    ---

    -

    qvm-run <vmname> "command" --pass-io --nogui - pass command to VM without using the GUI

    -

    qvm-run personal "ls" --pass-io --nogui - pass ls command directly to the VM. Returns error or output.

    +

    qvm-run <vmname> "command" --pass-io --nogui - +pass command to VM without using the GUI

    +

    qvm-run personal "ls" --pass-io --nogui - pass +ls command directly to the VM. Returns error or +output.

    Console in VM

    - Attach a console to a VM

    -

    virsh -c xen:/// console <vmname> - opens console in <vmname>

    +

    virsh -c xen:/// console <vmname> - opens +console in <vmname>

    ---

    -

    Why? Connect if GUI/qrexec does not work for any reason. This way you can restart/investigate a failed service.

    +

    Why? Connect if GUI/qrexec does not work for any reason. This way +you can restart/investigate a failed service.

      -

    • In Dom0 terminal: virsh -c xen:/// console personal

      • +

    • In Dom0 terminal: +virsh -c xen:/// console personal

    • username: root without a password

    (and when #1130 would be implmented the same for “user”)

    ---

    -

    In console mode press CTRL + ^ + ] on keyboard to escape from console mode.

    +

    In console mode press CTRL + ^ + +] on keyboard to escape from console mode.

    AppVM Log files

    - Log files in AppVMs

    /var/log/qubes - log file directory

    log files per DomU VM:

      -
    • guid.<vmname>.log - graphical information
      • -
    • pacat.<vmname>.log - sound information
      • -
    • qrexec.<vmname>.log - inter VM communication information
      • -
    • qubesdb.<vmname>.log - qubesdb information
      • +
    • guid.<vmname>.log - graphical +information
      • +
    • pacat.<vmname>.log - sound +information
      • +
    • qrexec.<vmname>.log - inter VM communication +information
      • +
    • qubesdb.<vmname>.log - qubesdb +information

    Get Qubes OS Version

    - Get the Qubes OS release version

    -

    cat /etc/qubes-release - prints Qubes release in human readable form

    -

    rpm -qa \*qubes-release\* - prints exact Qubes release number

    +

    cat /etc/qubes-release - prints Qubes release in +human readable form

    +

    rpm -qa \*qubes-release\* - prints exact Qubes +release number

    Get Xen Version

    - Display the Xen version

    -

    xl info | grep xen_version - prints the Xen version

    +

    xl info | grep xen_version - prints the Xen +version

    Qubes OS / Xen Boot

    - Qubes OS and Xen system/kernel messages

    -

    dmesg - prints error, warning and informational messages about device drivers and the kernel during the boot process as well as when we connect a hardware to the system on the fly.

    -

    xl dmesg - prints error, warning and informational messages created during Xen’s boot process

    -

    TIP: use dmesg and xl dmesg in combination with less, cat, tail or head.

    +

    dmesg - prints error, warning and informational +messages about device drivers and the kernel during the boot process as +well as when we connect a hardware to the system on the fly.

    +

    xl dmesg - prints error, warning and informational +messages created during Xen’s boot process

    +

    TIP: use dmesg and xl dmesg in +combination with less, cat, tail +or head.

    Grow disk

    qvm-grow-private

    - Increase private storage capacity of a specified VM

    @@ -290,8 +563,10 @@

    qvm-grow-private

  • In the personal VM: sudo resize2fs /dev/xvdb

    • Enlarge AppVMs TMPFS

    -

    Enlarge /tmp if you run out of space on the default ~200MB

    -

    sudo mount -o remount,size=1024M /tmp - enlarge the space to 1024MB

    +

    Enlarge /tmp if you run out of space on the default +~200MB

    +

    sudo mount -o remount,size=1024M /tmp - enlarge the +space to 1024MB

    Inter VM Networking

    NOTE: Does not expose services to the outside world!

    Make sure:

    @@ -301,13 +576,13 @@

    Inter VM Networking

  • Both VMs are started

    • In Firewall VM terminal:

    -
    $ sudo iptables -I FORWARD 2 -s <IP address of A> -d <IP address of B> -j ACCEPT
    +
    sudo iptables -I FORWARD 2 -s <IP address of A> -d <IP address of B> -j ACCEPT
    • The connection will be unidirectional A -> B
    • Optional: Bidirectional A <-> B

    In Firewall VM terminal:

    -
    $ sudo iptables -I FORWARD 2 -s <IP address of B> -d <IP address of A> -j ACCEPT
    +
    sudo iptables -I FORWARD 2 -s <IP address of B> -d <IP address of A> -j ACCEPT
    • Check your settings (e. g. using ping)
    • Persist your settings:
      • @@ -321,70 +596,98 @@

      Inter VM Networking

      # chmod +x /rw/config/qubes_firewall_user_script

      for bidirectional access:

      # echo "iptables -I FORWARD 2 -s 10.137.2.10 -d 10.137.2.11 -j ACCEPT" >> /rw/config/qubes_firewall_user_script
      -

      Add USB Wifi card to sys-net VM

      +

      Add USB Wifi card to sys-net +VM

      - Attach a USB Wifi card to sys-net VM

      -

      The bus and device number can be different than shown in this example:

      +

      The bus and device number can be different than shown in this +example:

        -
      1. qvm-pci -l sys-net - list all attached pci devices of sys-net
        2. -
      2. lsusb - e. g. Bus 003 Device 003: ID 148f:2870 Ralink Technology, Corp. RT2870 Wireless Adapter
        3. -
      3. readlink /sys/bus/usb/devices/003 - Important Bus 003 -> 003
        4. -
      4. The result of readlink: ../../../devices/pci-0/pci0000:00/0000:00:12.2/usb3 - Important 00:12.2
        5. -
      5. qvm-pci -a sys-net 00:12.2 - attach USB device 00:12.2 to sys-net
        6. -
      6. qvm-pci -l sys-ne - check if device 00:12.2 is
        7. +
      7. qvm-pci -l sys-net - list all attached pci devices +of sys-net
        8. +
      8. lsusb - e. g. Bus 003 +Device 003: ID 148f:2870 Ralink Technology, Corp. RT2870 Wireless +Adapter
        9. +
      9. readlink /sys/bus/usb/devices/003 - Important Bus +003 -> 003
        10. +
      10. The result of readlink: +../../../devices/pci-0/pci0000:00/0000:00:12.2/usb3 - +Important 00:12.2
        11. +
      11. qvm-pci -a sys-net 00:12.2 - attach USB device +00:12.2 to sys-net
        12. +
      12. qvm-pci -l sys-ne - check if device 00:12.2 +is

      Templates

      Fedora

      - Fedora template specific

      Installing the Template

      -

      sudo qubes-dom0-update qubes-template-fedora-26 - installs the Fedora 26 template

      -

      sudo qubes-dom0-update qubes-template-fedora-25 - installs the Fedora 25 template

      -

      sudo qubes-dom0-update qubes-template-fedora-24 - installs the Fedora 24 template

      -

      sudo qubes-dom0-update qubes-template-fedora-23 - installs the Fedora 23 template

      +

      sudo qubes-dom0-update qubes-template-fedora-26 - +installs the Fedora 26 template

      +

      sudo qubes-dom0-update qubes-template-fedora-25 - +installs the Fedora 25 template

      +

      sudo qubes-dom0-update qubes-template-fedora-24 - +installs the Fedora 24 template

      +

      sudo qubes-dom0-update qubes-template-fedora-23 - +installs the Fedora 23 template

      Updating, Searching & Installing Packages

      Fedora > 21

        -
      • installing packages: dnf install <package-name>
        • -
      • search for a package: dnf search <package-or-word>
        • +
      • installing packages: +dnf install <package-name>
        • +
      • search for a package: +dnf search <package-or-word>
      • updating template: dnf update

      Fedora <= 21

        -
      • installing packages: yum install <package-name>
        • -
      • search for a package: yum search <package-or-word>
        • +
      • installing packages: +yum install <package-name>
        • +
      • search for a package: +yum search <package-or-word>
      • updating template: yum update

      Fedora Minimal

      - Fedora minimal template

      Qubes OS:

      -

      sudo qubes-dom0-update qubes-template-fedora-26-minimal - installs the Fedora 26 minimal template

      -

      sudo qubes-dom0-update qubes-template-fedora-25-minimal - installs the Fedora 25 minimal template

      -

      sudo qubes-dom0-update qubes-template-fedora-24-minimal - installs the Fedora 24 minimal template

      -

      sudo qubes-dom0-update qubes-template-fedora-23-minimal - installs the Fedora 23 minimal template

      +

      sudo qubes-dom0-update qubes-template-fedora-26-minimal +- installs the Fedora 26 minimal template

      +

      sudo qubes-dom0-update qubes-template-fedora-25-minimal +- installs the Fedora 25 minimal template

      +

      sudo qubes-dom0-update qubes-template-fedora-24-minimal +- installs the Fedora 24 minimal template

      +

      sudo qubes-dom0-update qubes-template-fedora-23-minimal +- installs the Fedora 23 minimal template

      Debian

      - Debian template

      Installing the Template

        -
      • sudo qubes-dom0-update qubes-template-debian-8 - Debian 8 “Jessie”
        • +
      • sudo qubes-dom0-update qubes-template-debian-8 - +Debian 8 “Jessie”

      Qubes OS <= 3.1:

        -
      • sudo qubes-dom0-update qubes-template-debian-7 - Debian 7 “Wheezy”
        • +
      • sudo qubes-dom0-update qubes-template-debian-7 - +Debian 7 “Wheezy”

      Updating, Searching & Installing Packages

        -
      • installing packages: apt-get install <package-name>
        • -
      • search for a package: apt-cache search <package-or-word>
        • -
      • updating template: +
      • installing packages: +apt-get install <package-name>
        • +
      • search for a package: +apt-cache search <package-or-word>
        • +
      • updating template:
        • +
      1. apt-get update
      2. apt-get dist-upgrade
        3. -
      -
    +

    Qubes OS + Whonix

    -

    - Whonix is an Debian based OS focused on anonymity, privacy and security

    +

    - Whonix is a Debian based OS focused on anonymity, privacy and +security

    Whonix consists of two components:

      -
    1. Whonix-Gateway (uses TOR for all connections to the outside world)
      2. +
    2. Whonix-Gateway (uses TOR for all connections to the outside +world)
    3. Whonix-Workstation (for application)

    Install Whonix

    @@ -399,7 +702,8 @@

    Qubes OS + Whonix

    1. Create a Whonix-gateway ProxyVM, through Qubes VM Manager
    2. Create a Whonix-workstation AppVM, through Qubes VM Manager
      3. -
    3. Update your Whonix-Gateway and Whonix-Workstation TemplateVMs (how to -> see debian)
      4. +
    4. Update your Whonix-Gateway and Whonix-Workstation TemplateVMs (how +to -> see debian)
    5. (Re)Start Whonix-Gateway ProxyVM
    6. Start Whonix-Workstation AppVM
    @@ -409,29 +713,40 @@

    Archlinux

    In Qubes OS 3.2:

    sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-archlinux

    or manually

    -

    Use the following instructions: Archlinux Template

    +

    Use the following instructions: Archlinux +Template

    Updating, Searching & Installing Packages

      -
    • installing packages: pacman -S <package-name> [<package-name-2>...<package-name-n>]
      • -
    • search for a package: pacman -Ss <package-or-word>
      • +
    • installing packages: +pacman -S <package-name> [<package-name-2>...<package-name-n>]
      • +
    • search for a package: +pacman -Ss <package-or-word>
    • updating template: pacman -Syyu

    Removing Templates

    - Which were installed using the package manager

    Remove installed template

    -

    @Dom0: sudo dnf remove [<template-package-name>]

    +

    @Dom0: +sudo dnf remove [<template-package-name>]

    ---

    -

    sudo dnf remove qubes-template-debian-8 - remove the Debian 8 VM and qubes-template-debian-8 package

    +

    sudo dnf remove qubes-template-debian-8 - remove the +Debian 8 VM and qubes-template-debian-8 package

    List all installed templates

    -

    @Dom0: sudo dnf list installed qubes-template-*

    -

    Create VM from VMware or VirtualBox images

    +

    @Dom0: +sudo dnf list installed qubes-template-*

    +

    Create VM from +VMware or VirtualBox images

    1. Download the image in an AppVM
      2. -
    2. Install qemu-img tools - e. g. dnf install qemu-img for fedora
      3. +
    3. Install qemu-img tools - e. g. +dnf install qemu-img for fedora
    4. Convert the image to a raw format:
        -
      • VMware: qemu-img convert ReactOS.vmdk -O raw reactos.img
        • -
      • VirtualBox: qemu-img convert ReactOS.vdi -O raw reactos.img
        • +
      • VMware: +qemu-img convert ReactOS.vmdk -O raw reactos.img
        • +
      • VirtualBox: +qemu-img convert ReactOS.vdi -O raw reactos.img

    Qubes OS Directories

    @@ -439,11 +754,22 @@

    Dom0 (Qubes OS)

    - Qubes OS specific directories

    • /var/log/qubes - Qubes OS VM log files
      • -
    • /var/lib/qubes - Qubes OS VMs and other Qubes OS specific files
      • +
    • /var/lib/qubes - Qubes OS VMs and other Qubes OS +specific files

    Qubes OS Repositories

    +

    Additional Troubleshooting

    +
      +
    1. Launch Application Finder with Alt-F2 or F3, Qube Tools >> +Qube Manager
      2. +
    2. Select Qube >> Settings
      3. +
    3. Check your advanced tab and devices tab for correct settings.
      4. +
    4. Please read: https://www.qubes-os.org/doc/
      5. +
    diff --git a/qubes-cheatsheet.md b/qubes-cheatsheet.md index 532fc12..abd3ef6 100644 --- a/qubes-cheatsheet.md +++ b/qubes-cheatsheet.md @@ -1,14 +1,15 @@ ## Qubes Cheatsheet ## + *a summary of useful qubes commands* -version: 3.2 +version: 3.3 ### Mini Glossary - Xen - *Hypervisor* - VM - *Virtual Machine* - Qube - *Qubes OS specific alias for VM* -- Dom0 - *Priviledged Xen VM (runs Qubes Manager)* +- Dom0 - *Privileged Xen VM (runs Qubes Manager)* - DomU - *Normal Xen VM* - QWT - *Qubes Windows Tools* - PV - *Paravirtualized VM* @@ -21,28 +22,31 @@ version: 3.2 *NOTE: All commands are executed in `@Dom0` terminal (Konsole, Terminal, Xterm etc.)* #### qubes-manager + \- *Graphical VM Manager* usage: `qubes-manager` #### qvm-block + \- *Lists/attaches VM PCI devices* usage: -* `qvm-block -l [options]` +- `qvm-block -l [options]` -* `qvm-block -a [options] ` +- `qvm-block -a [options] ` -* `qvm-block -d [options] ` +- `qvm-block -d [options] ` -* `qvm-block -d [options] ` +- `qvm-block -d [options] ` \-\-\- `qvm-block -A personal dom0:/home/user/extradisks/data.img` - *attaches an additional storage for the personal-vm* #### qvm-clone + \- *Clones an existing VM by copying all its disk files* usage: `qvm-clone [options] ` @@ -52,6 +56,7 @@ usage: `qvm-clone [options] ` `qvm-clone fedora-23 fedora-23-dev` - *create a clone of fedora-23 called fedora-23-dev* #### qvm-firewall + \- *Manage VM firewall rules* usage: `qvm-firewall -l [-n] ` @@ -63,6 +68,7 @@ usage: `qvm-firewall -l [-n] ` `qvm-firewall -l -n fedora-23` - *displays the firewall settings for the personal-vm with port numbers* #### qvm-ls + \- *Lists VMs and various information about their state* usage: `qvm-ls [options] ` @@ -76,13 +82,14 @@ usage: `qvm-ls [options] ` `qvm-ls -d` - *show VM disk utilization statistics* #### qvm-prefs + \- *List/set various per-VM properties* usage: -* `qvm-prefs -l [options] ` +- `qvm-prefs -l [options] ` -* `qvm-prefs -s [options] [...]` +- `qvm-prefs -s [options] [...]` \-\-\- @@ -96,7 +103,16 @@ usage: `qvm-prefs lab-win7 -s default_user joanna` - *sets the login user to `joanna`* + +\-\-\- + + default: + +- `qubes-prefs default_qrexec_timeout` - *shows default timeout for qrexec* +- `qubes-prefs default_qrexec_timeout 120` - *sets the default timeout for qrexec* + #### qvm-run + \- *Runs a specific command on a vm* usage: `qvm-run [options] [] []` @@ -109,8 +125,8 @@ usage: `qvm-run [options] [] []` `qvm-run personal "sudo dnf update" --pass-io --nogui` - *pass a `dnf update` command directly to the VM* - #### qvm-start + \- *Starts a vm* usage: `qvm-start [options] ` @@ -122,6 +138,7 @@ usage: `qvm-start [options] ` `qvm-start ubuntu --cdrom personal:/home/user/Downloads/ubuntu-14.04.iso` - *starts the ubuntu-vm with the ubuntu installation CD* #### qvm-shutdown + \- *Stops a vm* usage: `qvm-shutdown [options] ` @@ -135,6 +152,7 @@ usage: `qvm-shutdown [options] ` `qvm-shudown --all --wait` - *shutdowns all VM's (shutdown is queued by the --wait option and includes nested VM's, such as sys-net and sys-firewall. (Currently only tested on Qubes 4.0.)* #### qvm-kill + \- *Kills a VM - same as pulling out the power cord - immediate shutdown* usage: `qvm-kill [options] ` @@ -144,6 +162,7 @@ usage: `qvm-kill [options] ` `qvm-kill personal` - *pull the power cord for the personal-vm - immediate shutdown* #### qvm-trim-template + \- *Trims the disk space of a template* usage: `qvm-trim-template ` @@ -152,8 +171,8 @@ usage: `qvm-trim-template ` `qvm-trim-template debian-8` - *helpful after upgrading or removing many packages/files in the template* - #### qvm-sync-appmenus + \- *Updates desktop file templates for given StandaloneVM or TemplateVM* usage: `qvm-sync-appmenus [options] ` @@ -165,7 +184,8 @@ usage: `qvm-sync-appmenus [options] ` ### Dom0 #### qubes-dom0-update -\- *Updates or installes software in dom0* + +\- *Updates or installs software in dom0* usage: `qubes-dom0-update [--enablerepo][--disablerepo][--clean][--check-only][--gui][--action=*][]` @@ -200,6 +220,7 @@ example: `sudo qubes-dom0-update --action=info qubes-core-dom0` - *displays infos about the `qubes-core-dom0` package* #### qubes-hcl-report + \- *Generates a report about the system hardware information* usage: `qubes-hcl-report [-s] []` @@ -218,6 +239,7 @@ usage: `qubes-hcl-report [-s] []` Please do not upload the report if you do not want to share those information. #### virsh + \- *Management user tool for libvirt (hypervisor abstraction)* usage: `virsh -c xen:/// []` @@ -231,6 +253,7 @@ usage: `virsh -c xen:/// []` `virsh -c xen:/// dominfo personal` - *lists status of personal VM* #### xl + \- *Xen management tool, based on LibXenlight* usage: `xl []` @@ -242,6 +265,7 @@ usage: `xl []` ### DomU #### qvm-copy-to-vm + \- *Copy file from one VM to another VM* usage: `qvm-copy-to-vm []` - *file* can be a single file or a folder @@ -259,6 +283,7 @@ usage: `qvm-copy-to-vm []` - *file* can be a single file - The command would be: `qvm-copy-to-vm work Documents` #### qvm-open-in-vm + \- *Opens file in another VM* usage: `qvm-open-in-vm ` - *file* can only be a single file @@ -274,13 +299,16 @@ usage: `qvm-open-in-vm ` - *file* can only be a single file #### List Qubes commands 1. Enter in console: - - `qvm-*` - - `qubes*` + +- `qvm-*` +- `qubes*` + 2. Press 2x times `TAB` Output: List of `qvm-*` or `qubes*` commands. #### List installed Qubes OS packages + \- *List all installed Qubes OS packages* **Fedora Dom0** @@ -292,6 +320,7 @@ In VM or Dom0: `rpm -qa \*qubes-\*` - *list (qubes-) installed packages* #### Move Dom0 -> VM ##### Qubes 3.1+ + \- *Windows + Linux* `dom0` console: `qvm-move-to-vm []` - *`file` can be a single file or a folder* @@ -307,6 +336,7 @@ In VM or Dom0: `rpm -qa \*qubes-\*` - *list (qubes-) installed packages* #### Copy Dom0 -> VM ##### Qubes 3.1+ + \- *Windows + Linux* `dom0` console: `qvm-copy-to-vm []` - *file* can be a single file or a folder @@ -320,6 +350,7 @@ In VM or Dom0: `rpm -qa \*qubes-\*` - *list (qubes-) installed packages* `qvm-copy-to-vm work Pictures/` - *copies the `Pictures` folder and it's content to the `personal` VM in the `/home/user/QubesIncoming/dom0` folder* ##### Qubes < 3.1 + \- *Linux only* ~~~ @@ -369,6 +400,7 @@ qvm-run --pass-io ### Troubleshoot #### Application in VM does not start + \- *How to get more information if applications in a VM refuse to start* `qvm-run personal "command" --pass-io` - *pass command directly to the VM. Returns an error message command fails.* @@ -382,6 +414,7 @@ qvm-run --pass-io `qvm-run personal "ls" --pass-io --nogui` - *pass `ls` command directly to the VM. Returns error or output.* #### Console in VM + \- *Attach a console to a VM* `virsh -c xen:/// console ` - *opens console in ``* @@ -401,6 +434,7 @@ qvm-run --pass-io In console mode press `CTRL` + `^` + `]` on keyboard to escape from console mode. #### AppVM Log files + \- *Log files in AppVMs* `/var/log/qubes` - *log file directory* @@ -413,6 +447,7 @@ log files per DomU VM: - `qubesdb..log` - *qubesdb information* #### Get Qubes OS Version + \- *Get the Qubes OS release version* `cat /etc/qubes-release` - *prints Qubes release in human readable form* @@ -420,11 +455,13 @@ log files per DomU VM: `rpm -qa \*qubes-release\*` - *prints exact Qubes release number* #### Get Xen Version + \- *Display the Xen version* `xl info | grep xen_version` - *prints the Xen version* #### Qubes OS / Xen Boot + \- *Qubes OS and Xen system/kernel messages* `dmesg` - *prints error, warning and informational messages about device drivers and the kernel during the boot process as well as when we connect a hardware to the system on the fly.* @@ -436,14 +473,15 @@ log files per DomU VM: ### Grow disk #### qvm-grow-private + \- *Increase private storage capacity of a specified VM* usage: `qvm-grow-private ` **Example** -* In dom0 terminal: `qvm-grow-private personal 40GB` -* In the personal VM: `sudo resize2fs /dev/xvdb` +- In dom0 terminal: `qvm-grow-private personal 40GB` +- In the personal VM: `sudo resize2fs /dev/xvdb` ### Enlarge AppVMs TMPFS @@ -457,27 +495,27 @@ Enlarge `/tmp` if you run out of space on the default ~200MB Make sure: -* Both VMs are connected to the same firewall VM -* Qubes IP addresses are assigned to both VMs -* Both VMs are started +- Both VMs are connected to the same firewall VM +- Qubes IP addresses are assigned to both VMs +- Both VMs are started In Firewall VM terminal: ~~~ -$ sudo iptables -I FORWARD 2 -s -d -j ACCEPT +sudo iptables -I FORWARD 2 -s -d -j ACCEPT ~~~ -* The connection will be unidirectional `A -> B` -* Optional: Bidirectional `A <-> B` +- The connection will be unidirectional `A -> B` +- Optional: Bidirectional `A <-> B` In Firewall VM terminal: ~~~ -$ sudo iptables -I FORWARD 2 -s -d -j ACCEPT +sudo iptables -I FORWARD 2 -s -d -j ACCEPT ~~~ -* Check your settings (e. g. using ping) -* Persist your settings: +- Check your settings (e. g. using ping) +- Persist your settings: ~~~ Assume: @@ -500,6 +538,7 @@ for bidirectional access: ~~~ #### Add USB Wifi card to sys-net VM + \- *Attach a USB Wifi card to sys-net VM* The bus and device number can be different than shown in this example: @@ -514,6 +553,7 @@ The bus and device number can be different than shown in this example: ### Templates #### Fedora + \- *Fedora template specific* **Installing the Template** @@ -541,6 +581,7 @@ Fedora <= 21 - updating template: `yum update` #### Fedora Minimal + \- *Fedora minimal template* Qubes OS: @@ -554,6 +595,7 @@ Qubes OS: `sudo qubes-dom0-update qubes-template-fedora-23-minimal` - *installs the Fedora 23 minimal template* #### Debian + \- *Debian template* **Installing the Template** @@ -569,11 +611,12 @@ Qubes OS <= 3.1: - installing packages: `apt-get install ` - search for a package: `apt-cache search ` - updating template: - 1. `apt-get update` - 2. `apt-get dist-upgrade` + 1. `apt-get update` + 2. `apt-get dist-upgrade` #### Qubes OS + Whonix -\- *Whonix is an Debian based OS focused on anonymity, privacy and security* + +\- *Whonix is a Debian based OS focused on anonymity, privacy and security* Whonix consists of two components: @@ -600,6 +643,7 @@ Whonix-Workstation TemplateVM Binary Install `@Dom0`: 5. Start Whonix-Workstation AppVM #### Archlinux + \- *Archlinux template* **Installing the Template** @@ -619,6 +663,7 @@ Use the following instructions: [Archlinux Template](https://www.qubes-os.org/do - updating template: `pacman -Syyu` #### Removing Templates + \- *Which were installed using the package manager* ***Remove installed template*** @@ -638,12 +683,13 @@ Use the following instructions: [Archlinux Template](https://www.qubes-os.org/do 1. Download the image in an AppVM 2. Install `qemu-img` tools - *e. g. `dnf install qemu-img` for fedora* 3. Convert the image to a raw format: - * VMware: `qemu-img convert ReactOS.vmdk -O raw reactos.img` - * VirtualBox: `qemu-img convert ReactOS.vdi -O raw reactos.img` + - VMware: `qemu-img convert ReactOS.vmdk -O raw reactos.img` + - VirtualBox: `qemu-img convert ReactOS.vdi -O raw reactos.img` ### Qubes OS Directories #### Dom0 (Qubes OS) + \- *Qubes OS specific directories* - `/var/log/qubes` - *Qubes OS VM log files* @@ -652,3 +698,15 @@ Use the following instructions: [Archlinux Template](https://www.qubes-os.org/do ### Qubes OS Repositories - [http://yum.qubes-os.org](http://yum.qubes-os.org) - *Browsable Fedora repositories* + +### Additional Troubleshooting + +1. Launch Application Finder with Alt-F2 or F3, Qube Tools >> Qube Manager +2. Select Qube >> Settings +3. Check your advanced tab and devices tab for correct settings. +4. Please read: [https://www.qubes-os.org/doc/](https://www.qubes-os.org/doc/) + +### Useful Links +[Qubes Forum Docs](https://forum.qubes-os.org/docs) + +[Qubes Salt Beginners Guide](https://forum.qubes-os.org/t/qubes-salt-beginners-guide/20126) \ No newline at end of file diff --git a/qubes-cheatsheet.pdf b/qubes-cheatsheet.pdf index 8be5ea6..b9d5d31 100644 Binary files a/qubes-cheatsheet.pdf and b/qubes-cheatsheet.pdf differ diff --git a/qubes-cheatsheet.txt b/qubes-cheatsheet.txt index 9fe7913..cce371f 100644 --- a/qubes-cheatsheet.txt +++ b/qubes-cheatsheet.txt @@ -1,37 +1,36 @@ - Qubes Cheatsheet -_a summary of useful qubes commands_ +a summary of useful qubes commands -version: 3.2 +version: 3.3 Mini Glossary -- Xen - _Hypervisor_ -- VM - _Virtual Machine_ -- Qube - _Qubes OS specific alias for VM_ -- Dom0 - _Priviledged Xen VM (runs Qubes Manager)_ -- DomU - _Normal Xen VM_ -- QWT - _Qubes Windows Tools_ -- PV - _Paravirtualized VM_ -- HVM - _Hardware Virtual Machine_ -- HVM + PV drivers - _HVM with PV drivers (Windows + QWT)_ -- GUI - _Graphical User Interface_ +- Xen - Hypervisor +- VM - Virtual Machine +- Qube - Qubes OS specific alias for VM +- Dom0 - Privileged Xen VM (runs Qubes Manager) +- DomU - Normal Xen VM +- QWT - Qubes Windows Tools +- PV - Paravirtualized VM +- HVM - Hardware Virtual Machine +- HVM + PV drivers - HVM with PV drivers (Windows + QWT) +- GUI - Graphical User Interface VM Management -_NOTE: All commands are executed in @Dom0 terminal (Konsole, Terminal, -Xterm etc.)_ +NOTE: All commands are executed in @Dom0 terminal (Konsole, Terminal, +Xterm etc.) qubes-manager -- _Graphical VM Manager_ +- Graphical VM Manager usage: qubes-manager qvm-block -- _Lists/attaches VM PCI devices_ +- Lists/attaches VM PCI devices usage: @@ -45,51 +44,51 @@ usage: --- -qvm-block -A personal dom0:/home/user/extradisks/data.img - _attaches an -additional storage for the personal-vm_ +qvm-block -A personal dom0:/home/user/extradisks/data.img - attaches an +additional storage for the personal-vm qvm-clone -- _Clones an existing VM by copying all its disk files_ +- Clones an existing VM by copying all its disk files usage: qvm-clone [options] --- -qvm-clone fedora-23 fedora-23-dev - _create a clone of fedora-23 called -fedora-23-dev_ +qvm-clone fedora-23 fedora-23-dev - create a clone of fedora-23 called +fedora-23-dev qvm-firewall -- _Manage VM firewall rules_ +- Manage VM firewall rules usage: qvm-firewall -l [-n] --- -qvm-firewall -l personal - _displays the firewall settings for the -personal-vm_ +qvm-firewall -l personal - displays the firewall settings for the +personal-vm -qvm-firewall -l -n fedora-23 - _displays the firewall settings for the -personal-vm with port numbers_ +qvm-firewall -l -n fedora-23 - displays the firewall settings for the +personal-vm with port numbers qvm-ls -- _Lists VMs and various information about their state_ +- Lists VMs and various information about their state usage: qvm-ls [options] --- -qvm-ls - _lists all vms_ +qvm-ls - lists all vms -qvm-ls -n - _show network addresses assigned to VMs_ +qvm-ls -n - show network addresses assigned to VMs -qvm-ls -d - _show VM disk utilization statistics_ +qvm-ls -d - show VM disk utilization statistics qvm-prefs -- _List/set various per-VM properties_ +- List/set various per-VM properties usage: @@ -99,99 +98,103 @@ usage: --- -qvm-prefs win7-copy - _lists the preferences of the win7-copy_ +qvm-prefs win7-copy - lists the preferences of the win7-copy -qvm-prefs win7-copy -s mac 00:16:3E:5E:6C:05 - _sets a new mac for the -network card_ +qvm-prefs win7-copy -s mac 00:16:3E:5E:6C:05 - sets a new mac for the +network card -qvm-prefs lab-win7 -s qrexec_installed true - _sets the qrexec to -installed_ +qvm-prefs lab-win7 -s qrexec_installed true - sets the qrexec to +installed -qvm-prefs lab-win7 -s qrexec_timeout 120 - _usefull for windows hvm -based vms_ +qvm-prefs lab-win7 -s qrexec_timeout 120 - usefull for windows hvm based +vms -qvm-prefs lab-win7 -s default_user joanna - _sets the login user to -joanna_ +qvm-prefs lab-win7 -s default_user joanna - sets the login user to +joanna qvm-run -- _Runs a specific command on a vm_ +- Runs a specific command on a vm usage: qvm-run [options] [] [] --- -qvm-run personal xterm - _runs xterm on personal_ +qvm-run personal xterm - runs xterm on personal -qvm-run personal xterm --pass-io - _runs xterm and passes all -sdtin/stdout/stderr to the terminal_ +qvm-run personal xterm --pass-io - runs xterm and passes all +sdtin/stdout/stderr to the terminal -qvm-run personal "sudo dnf update" --pass-io --nogui - _pass a -dnf update command directly to the VM_ +qvm-run personal "sudo dnf update" --pass-io --nogui - pass a dnf update +command directly to the VM qvm-start -- _Starts a vm_ +- Starts a vm usage: qvm-start [options] --- -qvm-start personal - _starts the personal-vm_ +qvm-start personal - starts the personal-vm -qvm-start ubuntu --cdrom personal:/home/user/Downloads/ubuntu-14.04.iso -- _starts the ubuntu-vm with the ubuntu installation CD_ +qvm-start ubuntu --cdrom personal:/home/user/Downloads/ubuntu-14.04.iso - +starts the ubuntu-vm with the ubuntu installation CD qvm-shutdown -- _Stops a vm_ +- Stops a vm usage: qvm-shutdown [options] --- -qvm-shutdown personal - _shutdowns the personal-vm_ +qvm-shutdown personal - shutdowns the personal-vm + +qvm-shutdown --all - shutdowns all non-nested VM's (no wait queue) -qvm-shutdown --all - _shutdowns all VM’s_ +qvm-shudown --all --wait - shutdowns all VM's (shutdown is queued by the +--wait option and includes nested VM's, such as sys-net and +sys-firewall. (Currently only tested on Qubes 4.0.) qvm-kill -- _Kills a VM - same as pulling out the power cord - immediate shutdown_ +- Kills a VM - same as pulling out the power cord - immediate shutdown usage: qvm-kill [options] --- -qvm-kill personal - _pull the power cord for the personal-vm - immediate -shutdown_ +qvm-kill personal - pull the power cord for the personal-vm - immediate +shutdown qvm-trim-template -- _Trims the disk space of a template_ +- Trims the disk space of a template usage: qvm-trim-template --- -qvm-trim-template debian-8 - _helpful after upgrading or removing many -packages/files in the template_ +qvm-trim-template debian-8 - helpful after upgrading or removing many +packages/files in the template qvm-sync-appmenus -- _Updates desktop file templates for given StandaloneVM or TemplateVM_ +- Updates desktop file templates for given StandaloneVM or TemplateVM usage: qvm-sync-appmenus [options] --- -qvm-sync-appmenus archlinux-template - _useful for custom .desktop files -or distributions not using dnf_ +qvm-sync-appmenus archlinux-template - useful for custom .desktop files +or distributions not using dnf Dom0 qubes-dom0-update -- _Updates or installes software in dom0_ +- Updates or installs software in dom0 usage: qubes-dom0-update [--enablerepo][--disablerepo][--clean][--check-only][--gui][--action=*][] @@ -202,123 +205,120 @@ usage: qubes-dom0-update --- -qubes-dom0-update --check-only - _checks if new dom0 updates are -available_ +qubes-dom0-update --check-only - checks if new dom0 updates are +available -sudo qubes-dom0-update - _updates dom0_ +sudo qubes-dom0-update - updates dom0 -sudo qubes-dom0-update --gui - _allows to update dom0 through a -graphical window_ +sudo qubes-dom0-update --gui - allows to update dom0 through a graphical +window --- -sudo qubes-dom0-update --action=search - _searches for -package in dom0 repositories_ +sudo qubes-dom0-update --action=search - searches for +package in dom0 repositories example: -sudo qubes-dom0-update --action=search qubes - _searches for all qubes -package in dom0 repositories_ +sudo qubes-dom0-update --action=search qubes - searches for all qubes +package in dom0 repositories -_NOTE: The tool excludes all templates (community and ITL) by default_ +NOTE: The tool excludes all templates (community and ITL) by default --- -sudo qubes-dom0-update --action=info - _displays infos -about the package_ +sudo qubes-dom0-update --action=info - displays infos +about the package example: -sudo qubes-dom0-update --action=info qubes-core-dom0 - _displays infos -about the qubes-core-dom0 package_ +sudo qubes-dom0-update --action=info qubes-core-dom0 - displays infos +about the qubes-core-dom0 package qubes-hcl-report -- _Generates a report about the system hardware information_ +- Generates a report about the system hardware information usage: qubes-hcl-report [-s] [] --- -qubes-hcl-report - _prints the hardware information on the console -(terminal)_ +qubes-hcl-report - prints the hardware information on the console +(terminal) -qubes-hcl-report personal - _sends the hardware information to the -personal-vm under /home/user_ +qubes-hcl-report personal - sends the hardware information to the +personal-vm under /home/user -qubes-hcl-report -s - _prints the hardware information on the console -(terminal) and generates more detailed report_ +qubes-hcl-report -s - prints the hardware information on the console +(terminal) and generates more detailed report -qubes-hcl-report -s personal - _sends the detailed hardware information -report to the personal-vm_ +qubes-hcl-report -s personal - sends the detailed hardware information +report to the personal-vm -NOTE: qubes-hcl-report -s [] generates a more detailed report. +Note: qubes-hcl-report -s [] generates a more detailed report. This report can contain sensitive information. Please do not upload the report if you do not want to share those information. virsh -- _Management user tool for libvirt (hypervisor abstraction)_ +- Management user tool for libvirt (hypervisor abstraction) usage: virsh -c xen:/// [] --- -virsh -c xen:/// list - _list running VM’s with additional information_ +virsh -c xen:/// list - list running VM's with additional information -virsh -c xen:/// list --all - _list all VM’s with additional -information_ +virsh -c xen:/// list --all - list all VM's with additional information -virsh -c xen:/// dominfo personal - _lists status of personal VM_ +virsh -c xen:/// dominfo personal - lists status of personal VM xl -- _Xen management tool, based on LibXenlight_ +- Xen management tool, based on LibXenlight usage: xl [] --- -xl top - _Monitor host and domains in realtime_ +xl top - Monitor host and domains in realtime DomU qvm-copy-to-vm -- _Copy file from one VM to another VM_ +- Copy file from one VM to another VM -usage: qvm-copy-to-vm [] - _file_ can be a -single file or a folder +usage: qvm-copy-to-vm [] - file can be a single +file or a folder --- -qvm-copy-to-vm work Documents - _copy the Documents folder to the work -VM_ +qvm-copy-to-vm work Documents - copy the Documents folder to the work VM -qvm-copy-to-vm personal text.txt - _copy the text.txt file to the -personal VM_ +qvm-copy-to-vm personal text.txt - copy the text.txt file to the +personal VM -EXAMPLE +Example - Open a terminal in AppVM A (e. g. your personal vm) -- Let’s assume we want to copy the Documents folder to AppVM B (e. g. +- Let's assume we want to copy the Documents folder to AppVM B (e. g. your work VM) - The command would be: qvm-copy-to-vm work Documents qvm-open-in-vm -- _Opens file in another VM_ +- Opens file in another VM -usage: qvm-open-in-vm - _file_ can only be a single -file +usage: qvm-open-in-vm - file can only be a single file --- -qvm-open-in-vm personal document.pdf - _opens document.pdf in the -personal VM_ +qvm-open-in-vm personal document.pdf - opens document.pdf in the +personal VM -qvm-copy-to-vm personal download.zip - _opens download.zip in the -personal VM_ +qvm-copy-to-vm personal download.zip - opens download.zip in the +personal VM DomU and Dom0 @@ -335,11 +335,11 @@ Output: List of qvm-* or qubes* commands. List installed Qubes OS packages -- _List all installed Qubes OS packages_ +- List all installed Qubes OS packages -FEDORA DOM0 +Fedora Dom0 -In VM or Dom0: rpm -qa \*qubes-\* - _list (qubes-) installed packages_ +In VM or Dom0: rpm -qa \*qubes-\* - list (qubes-) installed packages Files/Folders from and to Dom0 @@ -347,48 +347,47 @@ Move Dom0 -> VM Qubes 3.1+ -- _Windows + Linux_ +- Windows + Linux -dom0 console: qvm-move-to-vm [] - _file can be a -single file or a folder_ +dom0 console: qvm-move-to-vm [] - file can be a +single file or a folder --- -qvm-move-to-vm work screenshot-qubes-gui.png - _moves +qvm-move-to-vm work screenshot-qubes-gui.png - moves screenshot-qubes-gui.png to the personal VM into the -/home/user/QubesIncoming/dom0 folder_ +/home/user/QubesIncoming/dom0 folder -qvm-move-to-vm personal *.png - _moves all .png to the personal VM into -the /home/user/QubesIncoming/dom0 folder_ +qvm-move-to-vm personal *.png - moves all .png to the personal VM into +the /home/user/QubesIncoming/dom0 folder -qvm-move-to-vm work Pictures/ - _moves the Pictures folder and it’s -content to the personal VM into the /home/user/QubesIncoming/dom0 -folder_ +qvm-move-to-vm work Pictures/ - moves the Pictures folder and it's +content to the personal VM into the /home/user/QubesIncoming/dom0 folder Copy Dom0 -> VM Qubes 3.1+ -- _Windows + Linux_ +- Windows + Linux -dom0 console: qvm-copy-to-vm [] - _file_ can be -a single file or a folder +dom0 console: qvm-copy-to-vm [] - file can be a +single file or a folder --- -qvm-copy-to-vm personal screenshot-qubes-gui.png - _copies +qvm-copy-to-vm personal screenshot-qubes-gui.png - copies screenshot-qubes-gui.png to the personal VM in the -/home/user/QubesIncoming/dom0 folder_ +/home/user/QubesIncoming/dom0 folder -qvm-copy-to-vm personal *.png - _copies all .png to the personal VM in -the /home/user/QubesIncoming/dom0 folder_ +qvm-copy-to-vm personal *.png - copies all .png to the personal VM in +the /home/user/QubesIncoming/dom0 folder -qvm-copy-to-vm work Pictures/ - _copies the Pictures folder and it’s -content to the personal VM in the /home/user/QubesIncoming/dom0 folder_ +qvm-copy-to-vm work Pictures/ - copies the Pictures folder and it's +content to the personal VM in the /home/user/QubesIncoming/dom0 folder Qubes < 3.1 -- _Linux only_ +- Linux only cat /path/to/file_in_dom0 | qvm-run --pass-io @@ -408,12 +407,12 @@ VM -> Dom0 Copy text between VM A and B -_On VM A (source):_ +On VM A (source): 1. CTRL+C 2. CTRL+SHIFT+C -_On VM B (destination):_ +On VM B (destination): 3. CTRL+SHIFT+V 4. CTRL+V @@ -421,52 +420,52 @@ _On VM B (destination):_ Install Qubes Windows Tools (QWT) 1. sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-windows-tools - - _install the windows tools (QWT)_ -2. qvm-start - _starts Windows VM_ + install the windows tools (QWT) +2. qvm-start - starts Windows VM 3. open a cmd.exe or PowerShell and type bcdedit /set testsigning on 4. shutdown VM -5. qvm-start --install-windows-tools - _starts Windows - VM and inserts Qubes Windows Tools installation CD_ -6. double click on qubes-tools-WIN7x64-.exe - _execute and - install Qubes OS Windows Tools_ +5. qvm-start --install-windows-tools - starts Windows + VM and inserts Qubes Windows Tools installation CD +6. double click on qubes-tools-WIN7x64-.exe - execute and + install Qubes OS Windows Tools 7. restart Windows VM Troubleshoot Application in VM does not start -- _How to get more information if applications in a VM refuse to start_ +- How to get more information if applications in a VM refuse to start -qvm-run personal "command" --pass-io - _pass command directly to the VM. -Returns an error message command fails._ +qvm-run personal "command" --pass-io - pass command directly to the VM. +Returns an error message command fails. -qvm-run personal "xterm" --pass-io - _pass xterm command directly to the -VM. Returns an error message or starts xterm._ +qvm-run personal "xterm" --pass-io - pass xterm command directly to the +VM. Returns an error message or starts xterm. --- -qvm-run "command" --pass-io --nogui - _pass command to VM -without using the GUI_ +qvm-run "command" --pass-io --nogui - pass command to VM +without using the GUI -qvm-run personal "ls" --pass-io --nogui - _pass ls command directly to -the VM. Returns error or output._ +qvm-run personal "ls" --pass-io --nogui - pass ls command directly to +the VM. Returns error or output. Console in VM -- _Attach a console to a VM_ +- Attach a console to a VM -virsh -c xen:/// console - _opens console in _ +virsh -c xen:/// console - opens console in --- -_Why? Connect if GUI/qrexec does not work for any reason. This way you -can restart/investigate a failed service._ +Why? Connect if GUI/qrexec does not work for any reason. This way you +can restart/investigate a failed service. - In Dom0 terminal: virsh -c xen:/// console personal -- username: ROOT without a password +- username: root without a password -_(and when #1130 would be implmented the same for “user”)_ +(and when #1130 would be implmented the same for "user") --- @@ -475,54 +474,53 @@ mode. AppVM Log files -- _Log files in AppVMs_ +- Log files in AppVMs -/var/log/qubes - _log file directory_ +/var/log/qubes - log file directory log files per DomU VM: -- guid..log - _graphical information_ -- pacat..log - _sound information_ -- qrexec..log - _inter VM communication information_ -- qubesdb..log - _qubesdb information_ +- guid..log - graphical information +- pacat..log - sound information +- qrexec..log - inter VM communication information +- qubesdb..log - qubesdb information Get Qubes OS Version -- _Get the Qubes OS release version_ +- Get the Qubes OS release version -cat /etc/qubes-release - _prints Qubes release in human readable form_ +cat /etc/qubes-release - prints Qubes release in human readable form -rpm -qa \*qubes-release\* - _prints exact Qubes release number_ +rpm -qa \*qubes-release\* - prints exact Qubes release number Get Xen Version -- _Display the Xen version_ +- Display the Xen version -xl info | grep xen_version - _prints the Xen version_ +xl info | grep xen_version - prints the Xen version Qubes OS / Xen Boot -- _Qubes OS and Xen system/kernel messages_ +- Qubes OS and Xen system/kernel messages -dmesg - _prints error, warning and informational messages about device +dmesg - prints error, warning and informational messages about device drivers and the kernel during the boot process as well as when we -connect a hardware to the system on the fly._ +connect a hardware to the system on the fly. -xl dmesg - _prints error, warning and informational messages created -during Xen’s boot process_ +xl dmesg - prints error, warning and informational messages created +during Xen's boot process -_TIP: use dmesg and xl dmesg in combination with less, cat, tail or -head._ +TIP: use dmesg and xl dmesg in combination with less, cat, tail or head. Grow disk qvm-grow-private -- _Increase private storage capacity of a specified VM_ +- Increase private storage capacity of a specified VM usage: qvm-grow-private -EXAMPLE +Example - In dom0 terminal: qvm-grow-private personal 40GB - In the personal VM: sudo resize2fs /dev/xvdb @@ -531,11 +529,11 @@ Enlarge AppVMs TMPFS Enlarge /tmp if you run out of space on the default ~200MB -sudo mount -o remount,size=1024M /tmp - _enlarge the space to 1024MB_ +sudo mount -o remount,size=1024M /tmp - enlarge the space to 1024MB Inter VM Networking -_NOTE: Does not expose services to the outside world!_ +NOTE: Does not expose services to the outside world! Make sure: @@ -545,14 +543,14 @@ Make sure: In Firewall VM terminal: - $ sudo iptables -I FORWARD 2 -s -d -j ACCEPT + sudo iptables -I FORWARD 2 -s -d -j ACCEPT - The connection will be unidirectional A -> B - Optional: Bidirectional A <-> B In Firewall VM terminal: - $ sudo iptables -I FORWARD 2 -s -d -j ACCEPT + sudo iptables -I FORWARD 2 -s -d -j ACCEPT - Check your settings (e. g. using ping) - Persist your settings: @@ -573,41 +571,41 @@ for bidirectional access: Add USB Wifi card to sys-net VM -- _Attach a USB Wifi card to sys-net VM_ +- Attach a USB Wifi card to sys-net VM The bus and device number can be different than shown in this example: -1. qvm-pci -l sys-net - _list all attached pci devices of sys-net_ -2. lsusb - _e. g._ BUS 003 _Device 003: ID 148f:2870 Ralink - Technology, Corp. RT2870 Wireless Adapter_ -3. readlink /sys/bus/usb/devices/003 - _Important Bus 003 -> 003_ +1. qvm-pci -l sys-net - list all attached pci devices of sys-net +2. lsusb - e. g. Bus 003 Device 003: ID 148f:2870 Ralink Technology, + Corp. RT2870 Wireless Adapter +3. readlink /sys/bus/usb/devices/003 - Important Bus 003 -> 003 4. The result of readlink: - ../../../devices/pci-0/pci0000:00/0000:00:12.2/usb3 - _Important - 00:12.2_ -5. qvm-pci -a sys-net 00:12.2 - _attach USB device 00:12.2 to sys-net_ -6. qvm-pci -l sys-ne - _check if device 00:12.2_ is + ../../../devices/pci-0/pci0000:00/0000:00:12.2/usb3 - Important + 00:12.2 +5. qvm-pci -a sys-net 00:12.2 - attach USB device 00:12.2 to sys-net +6. qvm-pci -l sys-ne - check if device 00:12.2 is Templates Fedora -- _Fedora template specific_ +- Fedora template specific -INSTALLING THE TEMPLATE +Installing the Template -sudo qubes-dom0-update qubes-template-fedora-26 - _installs the Fedora -26 template_ +sudo qubes-dom0-update qubes-template-fedora-26 - installs the Fedora 26 +template -sudo qubes-dom0-update qubes-template-fedora-25 - _installs the Fedora -25 template_ +sudo qubes-dom0-update qubes-template-fedora-25 - installs the Fedora 25 +template -sudo qubes-dom0-update qubes-template-fedora-24 - _installs the Fedora -24 template_ +sudo qubes-dom0-update qubes-template-fedora-24 - installs the Fedora 24 +template -sudo qubes-dom0-update qubes-template-fedora-23 - _installs the Fedora -23 template_ +sudo qubes-dom0-update qubes-template-fedora-23 - installs the Fedora 23 +template -UPDATING, SEARCHING & INSTALLING PACKAGES +Updating, Searching & Installing Packages Fedora > 21 @@ -623,53 +621,53 @@ Fedora <= 21 Fedora Minimal -- _Fedora minimal template_ +- Fedora minimal template Qubes OS: -sudo qubes-dom0-update qubes-template-fedora-26-minimal - _installs the -Fedora 26 minimal template_ +sudo qubes-dom0-update qubes-template-fedora-26-minimal - installs the +Fedora 26 minimal template -sudo qubes-dom0-update qubes-template-fedora-25-minimal - _installs the -Fedora 25 minimal template_ +sudo qubes-dom0-update qubes-template-fedora-25-minimal - installs the +Fedora 25 minimal template -sudo qubes-dom0-update qubes-template-fedora-24-minimal - _installs the -Fedora 24 minimal template_ +sudo qubes-dom0-update qubes-template-fedora-24-minimal - installs the +Fedora 24 minimal template -sudo qubes-dom0-update qubes-template-fedora-23-minimal - _installs the -Fedora 23 minimal template_ +sudo qubes-dom0-update qubes-template-fedora-23-minimal - installs the +Fedora 23 minimal template Debian -- _Debian template_ +- Debian template -INSTALLING THE TEMPLATE +Installing the Template -- sudo qubes-dom0-update qubes-template-debian-8 - _Debian 8 “Jessie”_ +- sudo qubes-dom0-update qubes-template-debian-8 - Debian 8 "Jessie" Qubes OS <= 3.1: -- sudo qubes-dom0-update qubes-template-debian-7 - _Debian 7 “Wheezy”_ +- sudo qubes-dom0-update qubes-template-debian-7 - Debian 7 "Wheezy" -UPDATING, SEARCHING & INSTALLING PACKAGES +Updating, Searching & Installing Packages - installing packages: apt-get install - search for a package: apt-cache search - updating template: - 1. apt-get update - 2. apt-get dist-upgrade + +1. apt-get update +2. apt-get dist-upgrade Qubes OS + Whonix -- _Whonix is an Debian based OS focused on anonymity, privacy and -security_ +- Whonix is a Debian based OS focused on anonymity, privacy and security Whonix consists of two components: 1. Whonix-Gateway (uses TOR for all connections to the outside world) 2. Whonix-Workstation (for application) -INSTALL WHONIX +Install Whonix Whonix-Gateway TemplateVM Binary Install @Dom0: @@ -680,7 +678,7 @@ Whonix-Workstation TemplateVM Binary Install @Dom0: 1. export UPDATES_MAX_BYTES=$[ 4 * 1024 ** 3 ] 2. sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-ws -NEXT STEPS +Next Steps 1. Create a Whonix-gateway ProxyVM, through Qubes VM Manager 2. Create a Whonix-workstation AppVM, through Qubes VM Manager @@ -691,9 +689,9 @@ NEXT STEPS Archlinux -- _Archlinux template_ +- Archlinux template -INSTALLING THE TEMPLATE +Installing the Template In Qubes OS 3.2: @@ -703,7 +701,7 @@ or manually Use the following instructions: Archlinux Template -UPDATING, SEARCHING & INSTALLING PACKAGES +Updating, Searching & Installing Packages - installing packages: pacman -S [...] @@ -712,25 +710,25 @@ UPDATING, SEARCHING & INSTALLING PACKAGES Removing Templates -- _Which were installed using the package manager_ +- Which were installed using the package manager -_REMOVE INSTALLED TEMPLATE_ +Remove installed template @Dom0: sudo dnf remove [] --- -sudo dnf remove qubes-template-debian-8 - _remove the Debian 8 VM and -qubes-template-debian-8 package_ +sudo dnf remove qubes-template-debian-8 - remove the Debian 8 VM and +qubes-template-debian-8 package -_LIST ALL INSTALLED TEMPLATES_ +List all installed templates @Dom0: sudo dnf list installed qubes-template-* Create VM from VMware or VirtualBox images 1. Download the image in an AppVM -2. Install qemu-img tools - _e. g. dnf install qemu-img for fedora_ +2. Install qemu-img tools - e. g. dnf install qemu-img for fedora 3. Convert the image to a raw format: - VMware: qemu-img convert ReactOS.vmdk -O raw reactos.img - VirtualBox: qemu-img convert ReactOS.vdi -O raw reactos.img @@ -739,11 +737,19 @@ Qubes OS Directories Dom0 (Qubes OS) -- _Qubes OS specific directories_ +- Qubes OS specific directories -- /var/log/qubes - _Qubes OS VM log files_ -- /var/lib/qubes - _Qubes OS VMs and other Qubes OS specific files_ +- /var/log/qubes - Qubes OS VM log files +- /var/lib/qubes - Qubes OS VMs and other Qubes OS specific files Qubes OS Repositories -- http://yum.qubes-os.org - _Browsable Fedora repositories_ +- http://yum.qubes-os.org - Browsable Fedora repositories + +Additional Troubleshooting + +1. Launch Application Finder with Alt-F2 or F3, Qube Tools >> Qube + Manager +2. Select Qube >> Settings +3. Check your advanced tab and devices tab for correct settings. +4. Please read: https://www.qubes-os.org/doc/