Hello A specific topic. I was looking for a similar one, but I didn’t find one.
I’m coming to you with the topic of installing (not cloning!) multiple templates of the same os (debian 12). I need to install the same software several times that gives fingerprint to my vm. I can’t do it in app qube because they share a filesystem with a template. Installing one copy of the program in the app qube (or template) prevents installation in other app qube on the same template (or its clone). And now the questions:
1 Will anything go wrong if I install multiple Debian 12 templates?
2 If my update proxy is sys-whonix (all templates get updates via sys whonix) will the new debian template also be updated via sys-whonix?
3 If I create an app qube with netvm-sys whonix on a new debian template, will the CHECK for new updates be done by sys-whonix?
4 Do I need to do anything extra after installing the template? (just install it)?
IIRC, you cannot have more than one template with the same name. This de facto prevents installing multiple of the exact same templates.
I don’t know why you specifically don’t want cloning, but for anyone who didn’t know, cloning produces the exact same template just with a different name.
Technically, you can install template, rename, install again etc. But that doesn’t really makes sense. Installing template will get you exact the same image each time, so you can very well also clone one.
Application installed into app qube is not visible to the template, nor other qubes based on the same template. If an application refuses to install in another app qube because it thinks it’s already installed (and you haven’t installed it in the template), then it’s something else. Maybe it looks at your IP? Or MAC address of the app qube (by default all have the same, but you can change with qvm-prefs).
But also, there are very few reasons why application would try to prevent installing multiple copies, check if its licensing terms allow that - some prohibit such usage by default and require having another type of license…
There’s one difference: Installing a template immediately starts it (via qvm-template-postprocess, which has a --skip-start option but I don’t see any way to invoke it with that option from qvm-template install), which will change timestamps etc. in the template’s root filesystem. If I then create e.g. two clones of the same installed template and two app qubes for each clone, the two app qubes could theoretically fingerprint their root filesystem and find out that that they’re both derived from the same template installation (not just from the same template package).
Although I’m not saying that this is actually what’s happening in @qerevydi’s case.
That’s exactly why I don’t want to clone. I can’t have the same template because of e.g. timestamps
What about the file system? I found something like this: VM Fingerprinting
If I installed appimage in appqube, does the template or other appqube based on this template not see it? Excuse me. I’d rather be sure.
However, this program effectively tracks. No matter how many templates and separate appqube you have, in fact all actions on a given program are connected. I know that Qubes is focused on security, not anonymity. However, I would like to counteract this. I understand that installing several Debian templates is a bad practice?
That’s exactly what I’m thinking about
Being able to install several templates will lead to different timestamps. I’m just afraid to destroy my qubes os I don’t have much experience in computer science. However, this topic interested me very much because it could increase the level of anonymity of users. Many install, for example, several copies of the Telegram application, which ultimately leads to the association of all accounts (and without the awareness of an ordinary user like me)
I don’t have much experience in computer science. However, this topic interested me very much because it could increase the level of anonymity of users. Many install, for example, several copies of the Telegram application, which ultimately leads to the association of all accounts (and without the awareness of an ordinary user like me)