Kali Linux VM

[kzlz]

Qubes-Community/Contents/blob/master/docs/os/pentesting/kali.md

On this page
I didn’t understand the “8.Replace conflicted packages to work around dependency issues” part of this page.
Can anyone help me understand this?

[gonzalo-bulnes]

Hi @kzlz,

I don’t know why you’re trying to build a Kali template, and if your goal is to learn how to build it, I’m sorry I’m not answering your question.

If all you want is to use Kali, however, are you aware that a community template is available?

Kali template available

Update 2024 Hi, you are probably aware that we do have template build for Kali in R4.0 and R4.1 but we have built it for R4.1 only currently. I need to add generic documentation on it but currently I’m lacking of time. This is a message for anyone who wants to test it and to give a feedback. First, ensure to have qubes-core-admin-linux-4.1.8. We had to increase default max bytes size to download the template because the template size is bigger than the others (standard kali with lot of pack…

[unman]

If all you want is to use Kali, however, are you aware that a community template is available?

The community template is woefully outdated ,and will require a full dist
upgrade.
I have a newer build here

@kzlz, if you do want to build the template yourself, just say so, and
we can walk you through the process.

[kzlz]

No matter how many times I download qubes-template-kali-4.0.6-202304291232.noarch.rpm, it shows digests SIGNATURES NOT OK.
What do you think I did wrong?

[gonzalo-bulnes]

How are you downloading it @kzlz?

What program is telling you that the signature is not OK, is it rpm, is it gpg?

I suspect that if the key used for signing the template wasn’t added to the rpm keyring, then rpm would fail to verify the signature (and default to the safer option of assuming it is not OK).

See the begining of this post of you suspect that’s the issue you’re facing:

How to verify Unman's template

TLDR - rpmkeys --import PATH_TO_KEY rpm -K PATH_TO_PACKAGE If all is well, you will see “digests signatures ok” Verifying a package How do you verify any package? In Fedora, you can see which key signed a package using rpm -qi PATH_TO_PACKAGE For example if you have downloaded an rpm package to Downloads, and you are in /home/user, you can run rpm -qi ./Downloads/PACKAGE_NAME In the output the Signature line shows you the signing key ID - for packages signed by me this may look like th…

(You’ll need to use the key that was used to sign the Kali template, which may not be the same as the ine used for the templates in that thead!)

[kzlz]

I used rpm.
Which is the correct place to copy the downloaded key?
/etc/qubes/repo-templates/key
or
/etc/pki/rpm-gpg/

Also, should the name of the unman key be RPM-GPG-KEY-unman or whatever?

I changed the name of unman’s key to RPM-GPG-KEY-unman and copied it to /etc/pki/rpm-gpg/.

[n0thum4n]

One question out of context: WHy install a kali Template if the apps of kali can be directly installed in a debian template?
Why not install wireshark, wifite (for example) directly in debian-11-clone?

[unman]

Which is the correct place to copy the downloaded key?

Did you read the page from which you downloaded the template?
This is covered there, as well as important notes on installing large
templates like Kali, and dealing with potential problems when updating.

If there’s anything there that isnt clear, please say so.

Also, should the name of the unman key be RPM-GPG-KEY-unman or whatever?

You can name my key whatever you like - it sort of makes sense to me to
be consistent with other keys and to name it after the originator, but
whatever.

[unman]

One question out of context: Why install a kali Template if the apps of kali can be directly installed in a debian template?

Nice handle.

It’s a good question.
You can install any of the tools in to a debian-11 clone.
If you just want a few tools, install them in to a stock template.

Kali is based off debian testing, currently debian-12, and provides
curated (eeew) bundles of tools - for convenience its easier to use a
ready made Template.

I prefer Parrot, so I provide that template too.

I never presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.

[n0thum4n]

Why Parrot instead of Kali?
I was wondering… a simples script is able to install many of Kali tools throw debian-11 without changing from stable to testing.

[unman]

Why Parrot instead of Kali?

I find it better in many respects.

I was wondering… a simples script is able to install many of Kali tools throw debian-11 without changing from stable to testing.

Then you are installing tools from stable, and not from testing. They
will be older versions, and may not be updated by security team.
There are few “Kali tools” - just tools included in Kali

I never presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.

[kzlz]

Yes I read this page: Index of /Templates
I thought I was following the support.
No matter how many times I try with
digests SIGNATURES NOT OK.

[fiddler]

I’m having trouble verifying templates with unman’s key too. I tried a recent key from the Ubuntu key server to verify parrot templates and a kali template. I did this successfully for a kali template maybe a week ago but now I wanted to try parrot after reinstalling qubes today.

Any one else having trouble?

[fiddler]

I got it to work. I found this helpfull How to verify Unman's template

Particularly this command helped

rpmkeys --import PATH_TO_KEY

I didn’t see any mention of this step on unmans website.

edit: instead it said to move the key to /etc/pki/rpm-gpg/RPM-GPG-KEY-unman

[gonzalo-bulnes]

@fiddler

Particularly this command helped

rpmkeys --import PATH_TO_KEY

@fiddler (and @kzlz), this is exactly what I meant when I said:

@gonzalo-bulnes

I suspect that if the key used for signing the template wasn’t added to the rpm keyring, then rpm would fail to verify the signature (and default to the safer option of assuming it is not OK).

I could have been more explicit, I’m sorry about that!

I’m glad you found the way to do it and that it allowed you to move forward

(Edit to add: unless I’m wrong, where you place the keys doesn’t matter as long as you add them (import them) to the rpm keyring. Consistency is good when naming files though, and the /etc/pki/rpm-gpg directory is a good place to store them.)

[kzlz]

I also succesed. thank you

[gonzalo-bulnes]

I marked @fiddler’s post as the solution to make it easy to find for future folks with the same question as yours @kzlz. Feel free to adjust as you see fit!

[fiddler]

Thanks @gonzalo-bulnes zalo