HardenedBSD Template

huaopeng · September 3, 2021, 4:18pm

Has anybody managed to get HardenedBSD booting either as a Standalone or as a templateVM?

fsflover · September 3, 2021, 4:25pm

github.com/QubesOS/qubes-issues

Add First-Class Support for OpenBSD

opened 06:53AM - 27 Nov 18 UTC

esote

T: enhancement help wanted C: templates P: default

This issue serves as a way to track possible [OpenBSD](https://www.openbsd.org/)… support in Qubes OS. OpenBSD and Qubes OS are among the very few operating systems that provide serious security for their users. To be clear, I think the way we currently do things is _sufficient_, but I don't think it is _proactive_. ### In dom0 Having the OpenBSD operating system in dom0 is a long way off. I would be surprised if OpenBSD provides the ability to (easy) run as dom0. Currently, FreeBSD dom0 [works](https://wiki.xen.org/wiki/FreeBSD_Dom0). Given that dom0 has a much smaller attack surface than domU, running OpenBSD instead of Fedora would not provide much security benefit. Let me know if I'm wrong here. I suppose it could be helpful in simplifying dom0, given that OpenBSD is vastly stripped down of anything that could be vulnerable on a default install. With the 4.1 dom0-GUI split, we could remove all `x*` [file sets](https://www.openbsd.org/faq/faq4.html#FilesNeeded) in dom0. ### In domU OpenBSD [now supports](https://www.openbsd.org/59.html) running as [PVH domU](https://man.openbsd.org/xen) and [Xen paravirtualized networking](https://man.openbsd.org/xnf). However, currently it is not easy to run OpenBSD -- I've been successful running it as a standalone HVM and can only access it through the debug console. Providing an OpenBSD template, in the same way Fedora, Debian, and Whonix are today (this is what I mean by first-class support), would vastly reduce user attack surface. By attack surface, I mean the kinds of things summarized in [this talk](https://youtu.be/AvSPqo3_3vM?t=2346). We currently strive to reduce Xen's attack surface (and we do a decent job with only 18% of XSA's having affected Qubes OS), so reducing the attack surface in domU is a natural extension of security in depth. Running OpenBSD gives users a secure-by-default environment for their VMs, something that is lacking currently (#4233, #2748, #2045 etc.). OpenBSD is well know for its proactive security and development of [many security features](https://www.openbsd.org/innovations.html) that often slowly filter down to other operating systems. Qubes tools are made with Linux in mind, and some will need to be extended to support *BSD operating systems. --- Let me know what possible obstacles you guys see with this. It would be nice to see these two great operating systems fit together to provide a truly "reasonably secure operating system." (This issue is a requirement of, and related to, #4245).

github.com/QubesOS/qubes-issues

Use OpenBSD as NetVM

opened 12:29PM - 04 Sep 19 UTC

tetrahedras

T: enhancement C: other security P: default

**The problem you're addressing (if any)** The NetVM is exposed to a wide varie…ty of attacks, and it's the first line of defense in hostile local network environments. (e.g there is evidence certain Middle Eastern countries have been building infrastructure to automatically attempt exploiting every device connected to public WLAN networks) There is demand (see #4551) for running OpenBSD as a VM but efforts are stalled due to OpenBSD's lack of PV support. Since the NetVM is run in HVM mode, PV support is not necessary in this application. **Describe the solution you'd like** OpenBSD offers well-reviewed driver code, high code quality, innovative exploit mitigations, excellent hardware support, low resource consumption, and a much smaller attack surface than Linux. OpenBSD also offers a [much simpler](https://www.openbsd.org/faq/faq6.html#Wireless) approach to connecting to wireless networks than does Linux. **Where is the value to a user, and who might that user be?** Adding it as a NetVM would likely increase resistance to attackers on the local network, and increase the diversity of the system (from the current-best MirageFW+Linux to OpenBSD+MirageFW+Linux). **Related, [non-duplicate](https://www.qubes-os.org/doc/reporting-bugs/#new-issues-should-not-be-duplicates-of-existing-issues) issues** https://github.com/QubesOS/qubes-issues/issues/4551

unman · September 4, 2021, 1:40pm

I have a HardenedBSD template, which enables me to spin up disposable
instances.
There were no issues with the install.

turkja · September 20, 2021, 7:47am

Mind you telling us what are you doing with those instances?

I’m curious to know if it is feasible to run graphics apps, like browser in the OpenBSD instance.

unman · September 20, 2021, 12:45pm

It is an HVM template, and does not have seamless mode.
You can run applications through vnc or ssh, to have single window
applications on the Qubes desktop.