Backdoors/reverse shells in AppVMs using the default templates are prevented by the hardening in Kicksecure 18 and Whonix Workstation 18

[FranklyFlawless]

@deadbeef

The default behavior seems what Qubes team agreed to be true for the majority of people. I suppose it is expected that if that’s not your threat model, you are likely to have the skills to tweak the template to fit your needs.

See also:

To SUDO or not to SUDO?

What is the best practice with regards to SUDO on minimal qubes installs? Is installing qubes-core-agent-passwordless-root really necessary or secure? What about removing SUDO or alternatives such as DOAS? I find things like the sys-maint solution offered on Whonix to be very frustrating and over-complicated. Just using -u root to start a terminal on the VM from dom0 seems to me to be the best option. (I have seen a few opinions floating about but these just make me more of an idiot qubed.…