Debian-10-minimal Configuration

[whoami]

Hi @Sven could you please share your status on this?
Looking forward to your how-to

[Sven]

@whoami … by Sunday evening / Monday morning CST. You successfully shamed me into action.

[whoami]

I very interested in the salt part…
As soon as I find some free time I will follow your instructions on a fresh installation.

But do not stress, no urgency.

[Sven]

Yeah, it’s only gonna be a guide about the bash script stuff. Kind of an updated more detailed version of the above post.

Not sure if and when I’ll get into salt.

[Sven]

OK, let’s get this started: Automate debian-minimal based template creation

[enmus]

@Sven

@fiftyfourthparallel

I’ve never had to install exfat-fuse or ntfs-3g in my sys-usb since drives are never mounted there–those packages are installed in the app-vms. Since my drives work fine, it’s likely this is unnecessary (but of minimal impact in terms of security). I haven’t tried mounting encrypting drives but I suspect it’s the same.

I usually mount drives in sys-usb and then send/receive files from/to
there via the respective Qubes OS function. And obviously I mount my
encrypted backup drive in sys-usb. Just different uses than yours.

How does this respond to

Frequently asked questions (FAQ)

[Sven]

It doesn’t.

• sys-usb can see the files anyway
• I don’t view or edit any files inside sys-usb (which I believe to be the concern with accessing files in sys-usb)
• my sys-usb doesn’t have any programs installed (minimal template)
• I no longer mount encrypted volumes in sys-usb (that’s where the FAQ applies)

[Sven]

On second thought: thank you @fiftyfourthparallel for originally pointing it out and thank you @enmus for making me finally see it after I was too dense to see it the first time:

It is obviously a bad idea to mount an encrypted partition inside an untrusted qube. It’s bad practice and bad advice.

I will edit both in the forum and on my website to correct this mistake in the next days.

[enmus]

At the time, your post stuck in my mind, and I posted it yesterday because I read the docs again (and constantly over and over again) and stumbled upon this, and I had no doubt how you’d react, but I needed it to create that way for users hopefully an example of a good practice of a constant re-reading, re-thinking and revising, eventually to realizing what many of us already did: that Qubes is life-changer, milestone.

[thimbles_taxidermist]

Update on package for sysusb:
polkitd and libblockdev-crypto3 seem to be referenced from other packages which are the current versions for debian 13

qvm-clone tpl-deb-13-min tpl-deb-13-sys-usb

qvm-run --pass-io -u root tpl-deb-13-sys-usb "apt install --no-install-recommends qubes-usb-proxy qubes-input-proxy-sender qubes-core-agent-nautilus nautilus zenity gnome-keyring polkitd libblockdev-crypto3 ntfs-3g -y && poweroff"