How to prepare a Qubes OS system for remote training?

Hi!

I’m working with a company to set up Qubes OS training (compatible with French pro training budget), it would be all in remote.

However there is a show stopper for me at the moment, how to provide a Qubes OS system or a way for participants to install / use qubes os without formatting their computer or use a second computer?

I’m not sure Qubes OS can be installed in a virtual machine, and running correctly in it, right?

Any idea? :thinking:

2 Likes

Consider installing on portable SSDs.

1 Like

Don’t know if it works, but maybe you can use this GitHub - fepitre/qubes-remote-desktop

1 Like

Providing computers with qubes os installed with this was also an option. I guess it’s the best option yet :+1:

this is a remote training

You can use some machines with IPMI.

Or maybe use separate IP-KVM device instead of machine with onboard IPMI e.g.:

1 Like

Some scripts to create a live USB flash drive, that runs in memory. Then you have just to boot from USB, the main drive is unaffected.

How does this help remote training? People will be there to learn how to install and use qubes os.

They need a computer for the video conferencing to work.

In addition to the ideas above, I have few more:

  • you actually can run Qubes OS in a VM, but it isn’t straightforward. It works in KVM, if you enable IOMMU emulation. I had better results on Intel than AMD. See full working QEMU cmdline near the beginning of Qubes OS openQA: autoinst-log.txt (most options can be simplified, but you do need those related to cpu, machine, iommu)
  • PiKVM recommended above already is great, but you still need to install Qubes OS somewhere, to give that remote access
  • You can also setup sys-gui-vnc, but make sure everything you want to teach actually works there…
  • There is GitHub - QubesOS/qubes-remote-support in a broken state (wormhole not packaged in dom0…) but there are parts of it that could be useful as yet another alternative to give remote access to a qube instance (general idea being SSH into dom0, additionally protected with some VPN or Tor); then you can start x11vnc and tunnel that VNC over that SSH
  • @deeplow may have some more convenient solution
5 Likes

I would enable Internet in dom0 and install Teamviewer there. Then I would either eth0 or wireless assign to sys-net, the other card is for dom0. After this you have a full working Qubes-os, where you can demonstrate a Qubes-install in a Standalone, or help others with Qubes-workflow issues.

I have succesfully set up remote Qubes demos in the past. I got them working via a web browser (vnc). This was on physical systems at the time, but as Marek pointed out, more on this later.

I can’t seem to find a link to where I documented my setup, but it worked something like this:

  • dom0 vnc server (now this can be done by sus-gui with vnc support)
  • TCP. RPC policy connecting dom0’s RPC policy to one VM which can be responsible for the remote part. Let’s say this is sys-remote (you can make it internal now so users don’t mess this up)
  • apache guacamole server in sys-remote to be able to do VNC via web so that your clients can coveniently access. Then you have to options:
    • a) install, setup a Tor onion service for easy configuration (the downside is having to tell the clie t to install tor browser)
    • b) setup IP forwarding im that VM and expose it to the internet (with adequate privacy / security considerations in mind)

I haven’t played around with a PiKVM but I guess the setup should be kind of similar except it’s all done on eternal computers and doesn’t need messing around with your Qubes config.

Regarding doing this on virtual machines, it’s much more convenient. The Qubes team, as Marek pointed out has had success with KVM and it also generally works on VMWare (yup it’s proprietary) except for the critical part that through VNC the mouse does not work, which is a totall blocker.

3 Likes

The best remains to use KVM/libvirt or Proxmox on which you can start several Qubes OS (VMs) and access remotely the SPICE or VNC consoles of the machines. That’s how I did in the past for training and as Marek pointed out, this is mostly how openQA works for testing Qubes.

1 Like

I have another potential idea:

  • Network boot a live version of Qubes OS
    - PXE or NFS GRUB (I have done both before, but only over LAN)

It would be slower, but it would allow everyone to boot off the same image, giving them the full experience needed, while leaving their internal drives untouched.

Even if this doesn’t end up being what you do, I’m still putting it on the back burner, because there’s a legitimate use case for an environment where users can familiarise themselves with Qubes OS, even if the environment doesn’t actually contain all the protective measures that real Qubes OS does.

how do you show the installer with this? How do trainees use PXE remotely with a single computer used for the videoconferencing?

Well, everyone would network boot into the ISO. With a few tweaks, everyone could run through the installer on their own bare metal, and GRUB could even be tweaked to install onto a ramdisk (leaving their block devices intact).

They don’t. At least, not very well…

I went off this comment:

My apologies for the confusion. In my head, I was concerned about the watered-down experience that virtual machines provide.

If you’re going to be training someone on how to use Qubes OS, then surely the last thing you want them to see would be the OS “jailed” inside in another OS. That leaves a lasting impression.

I see it all the time with penetration testers and security researchers. Because they were first exposed to Linux through a VM on Windows or MacOS, that imprinted on their mind, to the point that they couldn’t possibly fathom the idea of it running “without the assistance of Windows”. They think “Oh, so Qubes OS needs to be propped up by Windows because VMs are inferior, right?”.

Just don’t want that to happen to your training… :slightly_frowning_face:

Maybe an online training with video conferencing via a secondary device (phone, dedicated conferencing device)?

But then again, if you have no choice (like what you’re trying to achieve), then maybe a VM with a mock-up BIOS as well, so that they can experience provisioning it before install.

Sorry, I had face-to-face training in my mind for some reason. It was late when I wrote this, and I was out of coffee… :laughing:

In any case, I think this is a fantastic idea, and I really hope it goes well for you!

The major problem with this is that you have not been clear about what
the training will provide. Is it training in the use of Qubes,
installation, configuration, setting up complex security domains, what?
Do you want to demonstrate Qubes?
Be clear about what it is you want to do.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

1 Like

Indeed, thank you for pointing this out.

The training would be 2 days. The first day should focus installing and using Qubes OS for daily tasks in place of a traditional OS. The second day would focus on more advanced topics.

@solene,

Just curious. How did your training go?

Are there any questions or feedback from the participants that would be worth sharing?

Hope it went well :slight_smile:

I did not have time to prepare anything, except installing proxmox on a spare drive. I need to verify if Qubes OS works fine in proxmox, this would allow me to give access to a working system to participants.

The training was a WIP, and I’m too busy now to continue working on it. I just wanted to verify if it’s actually doable remotely before offering training through a partnership with another company.

1 Like