I have been looking for a convenient quick way of having a qube on a USB (encrypted) without it showing on the Qube Manager when it is unplugged and only being visible when the USB is plugged in. I wonder if anyone else has thought of this?. IMO it would be a good way to have sensitive qubes disconnected and isolated.
Those are nothing to do with Encryption.
Encryption is done on disk level. Any default install uses full disk encryption, sou your Qubes are encrypted in the disk.
Separating a VM from others can be also done by storage pool level:
Means you can setup a pendrive as a 2.nd storage pool - but it would be very sloooow in practice.
However - currently - all VM (Qube) info and configuration is located in a single database: qubesdb And the implication of this that you canât âhideâ your qubes from dom0, and canât âseparateâ it from the rest of your qubes configs.
There was some discussion about similar topic before, but I was not able to find itâŚ
1 Like
If non convenient is sufficient - you could look into diy-ing it yourself.
You could probably backup a standalone vm to a usb stick and delete it on the main system. And if you need it, import it again.
Thanks, there are a few ways but they all seem clunky like this. I was hoping for a smoother way 
Perhaps having a VM image on the usb and then loading that within another virtualizer within, say a debian qube.
Say for example you have a vm that you donât want sitting all the time in the ecosystem with crypto that only needs to be connected / updated rarely.
If you script it, you could script the creation of the Qube and restore the backup from a encrypted USB stick.
You could probably backup a standalone vm to a usb stick and delete it on the main system. And if you need it, import it again.
Kind of like this, yes.
Following exactly what you want, the USB stick would have to be assigned to dom0, which might not be ideal, depending on how securely you can store that usb stick / how much you trust it.
I think the best approach would be to script the creation of the qube and then restore a backup. Its pretty much the same thing, but with waiting 20 seconds longer (for the script to finish creating the Qube + restore backup). If you rarely need it, that should do the trick as well.
Or is it that the data of that Qube should not touch the disk of your computer itself?
Yes, its looking like that may be an option,
No, the important thing is that its not all the time sitting among the other qubes on the qube manager, and can be removed. I guess it would have to be standalone.
Something like a TAILS qube I guess, but with ability to R/W to the stick
I see little to no reason why it would have to be standalone.
Iâm working on something called âkuhbsâ right now that pretty much does this for the whole installation. Absolutely everything past the base installation is automated / scripted / code. Think salt but enduser-friendly(er) - this time it will have a gui.
You run kuhbs backup-all and it creates backups to a usb stick.
You wipe the box and reinstall qubes os.
You install kuhbs in dom0 and run kuhbs create-all and your box is setup exactly like before.
So I know for a fact that what kind of VM âklassâ 
you need has nothing to do with what you want.
The way I do this is âI know I want to backup /home/user/.thunderbirdâ, so I create a .tar.gz of this dir and backup it to a usb stick. The rest is code and a bunch of qvm-bla commands basically. If you have an AppVM âklassâ Qube, then you run your script with the qvm-bla commands that creates said Qube, and then you restore that backup.
When you are done you destroy it again.
What you want (the Qube not being present on the system) isnât in the design of Kuhbs, but it would pretty much be:
kuhbs create thunderbird
# use thunderbird here
kuhbs backup thunderbird
kuhbs remove thunderbird
The end. Create takes about 30 seconds, depending on how fast you can apt install thunderbird, backup depends on your ~/.thunderbird and usb stick speed of course, and remove takes maybe 5 seconds.
Its not ready yet but will be soon (then it even has a gui so you can skip the commands).
So long story short, what you want is possible, and if you tell me a bit more about what you want exactly iâm happy to show you the commands you need to do that, so you can have a little bash script in dom0 that does that for you, like:
./create-secret-qube.sh
./backup-secret-qube.sh
./remove-secret-qube.sh
Or similar.
Sidenote: if you use the default Qubes OS Backup mechanism then I really donât know, but I always found it to be a bit wasteful - my prefered approach is to have a list of dirs I want to backup, and only backup / restore those. And the Qubeâs presence, from template to appvm to named disposable or standalone or Appvm as template for unnamed dispvms is just a bunch of qvm commands and alike.
Sidenote 2: just because you remove a Qube doesnât mean the data canât be restored - especially as Qubes OS does funky backup snapshots of their LVMs by default, which you can turn off, but the non volatile LVM volumes of Qubes are written in plain text to your disk - which is encrypted. So if an attacker gets your box while its decrypted / running, this data can be restored.
That sounds like a neat way of selective backing up, I look forward to seeing more on that, thanks.
If I have understood you correctly, I think the workflow of backing up to external drive, deleting Qube, then restoring said Qube everytime is not really practical for my needs.
At the moment I can have a similar effect with a COW, ova etc⌠on a stick or external drive and just open them, work on them, remove them etc⌠Sorry if it was not to clear, I wanted to have something like that, plug in the usb, load the qube into the manager, give it a network work on it, etc⌠Then remove the stick, and it is no longer listed on the manager and ideally has no or minimal traces on the machine.
If I have understood you correctly, I think the workflow of Backing up to external drive, deleting Qube, then restoring said Qube everytime is not really practical for my needs.
Donât underestimate the power of scripting things in qubes. I do get your picture though, that you want it to have a gui - but if you script this, its fully automated and all you have to is press enter. Imho that beats a gui.
load the qube into the manager
This is where my idea breaks, I donât think I ever opened that thing I know it exists lol.
and it is no longer listed on the manager and ideally has no or minimal traces on the machine.
in dom0 too? dom0 likes to log things, as in âhas been presentâ, like âwas created and removedâ and alike. Also LVM backups and alike, but that you can disable.
âNo traceâ is a bit of a complicated thing in qubes.
Maybe kuhbs is for you, where the whole box is kinda setup like this. The ultimate idea for kuhbs is to throw the whole laptop away after using it (or you can do this - it gives you the option for it) - install qubes, kuhbs create-all (including restoring backups), doing things, kuhbs backup-all and then wipe the luks header + sysrq shutdown (because it doesnât matter if you clean shutdown).
All the data lives on the usb stick then, which is plausible deniability encrypted.
You need a second usb stick to install qubes again
I will make a thread here when its finished ofc.
If you want to stick with the gui, and you very rarely need it, use the qubes backup manager thingy (I never used it so no idea how it works), but keep in mind that this will leave traces in dom0 at least, and in LVM and alike. If your goal is anti-forensics, you are on the wrong path.
Well there is Live mode , then write what you want to the qube on stick etc⌠which would do the qubes side of it. The only thing I am trying to wrap my head around is getting this Live-qube on a stick thingâŚ
I didnt fully get live mode either the thread is a bit long xD I had chatgpt summarize it and I THINK (!!!) its about specifically having dom0 stuff like a template, and then using a ram overlay for all the changes.
So from how I understood it (!!!) live mode uses a normal qubes installation (to disk), but changes of dom0 (and other things?) live in ram only.
Does your special secret qube need internet? Maybe you can just use a second box for it, like a cheap raspberry pi or so? If you run openbsd on a raspberry pi, and firewall that right, thats pretty damn secure too. A raspi is similarly easy to hide as a usb stick. A raspi zero is the same size as a usb stick x)
Its hard to give a suggestion without knowing what the qube should do.
From what I understand btw dom0 logs things like âwas presentâ, but not what you did in that Qube. So if you give it a name like âbrowserâ, that doesnt tell much to an attacker. You can run sudo journalctl -f in dom0 to find out when creating / using / deleting that qube. If you restore backups, keep in mind that sys-usb sees things too (that can be made DispVM though).
Long story short qubes is build around security, not anti-forensics. There are a few switches for that, but its not the main goal.
Wait for kuhbs, kill the whole box. It takes time, including the install, but thats ok, you can wait 30 minutes for your box to install itself from scratch every moring, just make coffee or whatever This way you have a completely fresh installation each time.
Side hint: Move all the data you donât need to an airgap, like old mails or so. Fresh thunderbird, only new mails, and the old mails you move to the airgap.
The best approach for hacks to not persist is to completely wipe the whole system and set it up from scratch (thats the idea behind kuhbs, or one of the ideas) - including flashing all possible firmware.
Ultimate answer: if you want a Qube to only be present temporarily, but not leave a trace at all, that might be possible with scripting, but not with gui, and you might miss things while scripting. I wouldnât highly recommend to go that route / trust it. Rather use a seperate box for what you want to do, and nuke it completely after (overwrite the luks header with random data). This is game over TM for any attempt to restore data on what you did there.
Or remove the disk from another laptop and use a live system, where you attach your usb stick to access the data. Tails or something like this.
From what I understood qubes live does require a installation to disk, so thats not it.
Yes I think your right, I am probably trying to turn a apple into a orange here I guess.
1 Like
If you have usb-c, you might be able to have a qubes on an external drive (usb-c cause speed, should work with usb-b as well). Bit larger than usb stick, but that would solve your problem. There are really fast usb sticks by now as well (pricey but possible). So you could just install Qubes on a removable media. This would mean that your secret Qube canât interact with the other Qubeâs you normally have. Not sure if thats a dealbreaker.
Maybe disconnect internal SSD for the time being just to be paranoid (if its easy / you have a desktop and not a laptop)