Create a HardenedBSD template

drtduit · July 13, 2022, 12:16pm

If any of you have the skills to create and maintain a HardenedBSD template, that would be great. There is currently no single Qubes OS template that is based on BSD.

fsflover · July 19, 2022, 8:52am

github.com/QubesOS/qubes-issues

Add First-Class Support for OpenBSD

opened 06:53AM - 27 Nov 18 UTC

esote

T: enhancement help wanted C: templates P: default

This issue serves as a way to track possible [OpenBSD](https://www.openbsd.org/)… support in Qubes OS. OpenBSD and Qubes OS are among the very few operating systems that provide serious security for their users. To be clear, I think the way we currently do things is _sufficient_, but I don't think it is _proactive_. ### In dom0 Having the OpenBSD operating system in dom0 is a long way off. I would be surprised if OpenBSD provides the ability to (easy) run as dom0. Currently, FreeBSD dom0 [works](https://wiki.xen.org/wiki/FreeBSD_Dom0). Given that dom0 has a much smaller attack surface than domU, running OpenBSD instead of Fedora would not provide much security benefit. Let me know if I'm wrong here. I suppose it could be helpful in simplifying dom0, given that OpenBSD is vastly stripped down of anything that could be vulnerable on a default install. With the 4.1 dom0-GUI split, we could remove all `x*` [file sets](https://www.openbsd.org/faq/faq4.html#FilesNeeded) in dom0. ### In domU OpenBSD [now supports](https://www.openbsd.org/59.html) running as [PVH domU](https://man.openbsd.org/xen) and [Xen paravirtualized networking](https://man.openbsd.org/xnf). However, currently it is not easy to run OpenBSD -- I've been successful running it as a standalone HVM and can only access it through the debug console. Providing an OpenBSD template, in the same way Fedora, Debian, and Whonix are today (this is what I mean by first-class support), would vastly reduce user attack surface. By attack surface, I mean the kinds of things summarized in [this talk](https://youtu.be/AvSPqo3_3vM?t=2346). We currently strive to reduce Xen's attack surface (and we do a decent job with only 18% of XSA's having affected Qubes OS), so reducing the attack surface in domU is a natural extension of security in depth. Running OpenBSD gives users a secure-by-default environment for their VMs, something that is lacking currently (#4233, #2748, #2045 etc.). OpenBSD is well know for its proactive security and development of [many security features](https://www.openbsd.org/innovations.html) that often slowly filter down to other operating systems. Qubes tools are made with Linux in mind, and some will need to be extended to support *BSD operating systems. --- Let me know what possible obstacles you guys see with this. It would be nice to see these two great operating systems fit together to provide a truly "reasonably secure operating system." (This issue is a requirement of, and related to, #4245).

github.com/QubesOS/qubes-issues

Use OpenBSD as NetVM

opened 12:29PM - 04 Sep 19 UTC

tetrahedras

T: enhancement C: other security P: default

**The problem you're addressing (if any)** The NetVM is exposed to a wide varie…ty of attacks, and it's the first line of defense in hostile local network environments. (e.g there is evidence certain Middle Eastern countries have been building infrastructure to automatically attempt exploiting every device connected to public WLAN networks) There is demand (see #4551) for running OpenBSD as a VM but efforts are stalled due to OpenBSD's lack of PV support. Since the NetVM is run in HVM mode, PV support is not necessary in this application. **Describe the solution you'd like** OpenBSD offers well-reviewed driver code, high code quality, innovative exploit mitigations, excellent hardware support, low resource consumption, and a much smaller attack surface than Linux. OpenBSD also offers a [much simpler](https://www.openbsd.org/faq/faq6.html#Wireless) approach to connecting to wireless networks than does Linux. **Where is the value to a user, and who might that user be?** Adding it as a NetVM would likely increase resistance to attackers on the local network, and increase the diversity of the system (from the current-best MirageFW+Linux to OpenBSD+MirageFW+Linux). **Related, [non-duplicate](https://www.qubes-os.org/doc/reporting-bugs/#new-issues-should-not-be-duplicates-of-existing-issues) issues** https://github.com/QubesOS/qubes-issues/issues/4551

github.com/QubesOS/qubes-issues

Create a LibertyBSD TemplateVM

opened 11:39PM - 24 Aug 18 UTC

asddsaz

T: enhancement help wanted C: templates P: minor

Feature: Create a template VM for [LibertyBSD](https://libertybsd.net/). - - - …- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - **Why**?: Firstly OpenBSD is arguably the most secure OS besides QubesOS with some of the most sophisticated encryption standards[1](https://www.openbsd.org/security.html). Secondly this would add support for BSD Applications. **Why LibertyBSD instead of OpenBSD?**: Because OpenBSD contains non-free software that LibertyBSD removes or replaces. Everything else should be the same. It is the only BSD that I am aware of that does this. **Philosophy/Goals of OpenBSD**: "OpenBSD believes in strong security. Our aspiration is to be NUMBER ONE in the industry for security (if we are not already there). Our open software development model permits us to take a more uncompromising view towards increased security than most vendors are able to. We can make changes the vendors would not make. Also, since OpenBSD is exported with cryptography, we are able to take cryptographic approaches towards fixing security problems."[1](https://www.openbsd.org/security.html) **Philosophy/Goals of LibertyBSD**: " OpenBSD is universally known as an operating system designed with security in mind, proudly being able to say that it has had “Only two remote holes in the default install, in a heck of a long time!” However, OpenBSD ships with several pieces of non-free, binary only firmware in the base system, and depending on the hardware detected, by default a script will download more at first boot, without informing the user of this. With a default installation, you might end up using some of this non-free firmware without even knowing it and, if you try to install additional software, you might end up unwittingly installing non-free programs. LibertyBSD is a “deblobbed” version of OpenBSD. You can get all of the benefits of OpenBSD, while being sure that there is nothing non-free lurking in the depths of your system. "[1](https://libertybsd.net/)

drtduit · July 19, 2022, 9:38am

Yes, I saw these entries, although mine refers to HardenedBSD and not OpenBSD. HardenedBSD is considered more secure than OpenBSD.

Although it doesn’t matter. Any official BSD template is needed for Qubes OS. FreeBSD would be great if its template for Qubes was officially available, you can quickly convert the FreeBSD template into other templates yourself, but if FreeBSD were to be created as a base template, it would also be great.

fsflover · July 19, 2022, 9:54am

There is also a discussion of HardenedBSD in the links. Moreover, there is a guide how to install OpenBSD, linked from these links above.

Qubes developers have no time to implement a first-class support for *BSD but hopefully someone from the Community can help.