Hosting remote VMs

User Support General
1

I am trying to figure out if it is possible with Qubes to host full remote VMs.

For instance, if I have Qubes installed on my main computer, and want to connect to a full Ubuntu desktop VM hosted on the qubes machine from a zero client or a laptop with client software.

  1. Is this possible with the security stuff, and
  2. If so, what is the best way to approach? Running the VM hosting hypervisor in a Qube or doing it through the built-in Xen architecture?

Thanks!

2

To connect to a qube you’ll have to go through dom0 first. That weakens security in so many ways, but below is an article on how to do this very securely,

3

It isnt altogether clear to me what it is you are asking. I think you
are asking if you can have a qube running Ubuntu with the full desktop
installed, and then connect to the Qubes machine so as to load up the
Ubuntu desktop.
It isnt clear to me whether you want the Ubuntu qube to be able to work
with the rest of the qubes on that machine.

You can do this, without compromising dom0 in a few ways:

  1. Run an admin qube that is remotely accessible, has limited access to
    other qubes, and from which you can control the Ubuntu qube. Take a
    look at this post that introduced the concept
  2. Run a separate sys-gui-vnc which is remotely accessible, and have the
    Ubuntu qube use that as guivm. Redirecting…
  3. Run vncserver in the Ubuntu qube. Set up an ssh tunnel from sys-net to the
    Ubuntu qube, either by forwarding down the Qubes network, or using
    TCPConnect. Once the tunnel is connected you can use a vncviewer on your
    local machine to view the desktop of the remote Ubuntu.

Undoubtedly there are other possibilities. I would favor 3 as simplest
to set up. Whatever you choose, you should set restrictive policies on
the Ubuntu qube so that you do not inadvertently expose other qubes from
it.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

2 Likes
4

I’m pretty sure that #3 was the answer I was looking for, but #2 looks like it might also work and in a somewhat better way once they get it tuned.

Thank you so much!

1 Like
5

Haha… any working sys-gui{,-*} construct is akin to Elon Musk’s Mars dream: nice on paper, impossible to achieve. :joy:

6

https://wiki.smartos.org/

7

Yes. You can do this with virt-manager over ssh. Audio and resizing work, but I haven’t gotten remote 3d acceleration working. Make sure your remote user is in the libvrit-users group.