Modern USB Peripherals on Secure PS/2 QubesOS Systems | KVM Switch Madness

User Support
,
1

I want to build a QubesOS desktop PC and am currently considering my mouse/keyboard options. I know I need a PS/2 port because with a USB port and sys-usb I can easily lock myself out. It is also a security risk. So fine, PS/2.

My motherboard supports virtualization and has a PS/2 combo port. So I need to use a PS/2 Y splitter cable to get keyboard/mouse support.

My question is, do I need to buy a PS/2 keyboard/mouse or can I use the splitter cable to connect PS/2 to USB adapters and then use USB devices? Will this work?

For reference the two cables/adapters:

https://www.amazon.com/Kentek-Female-Extension-Splitter-Keyboard/dp/B07KVF6D4Y/

https://www.amazon.com/DKARDU-Adapter-Female-Keyboard-Replacement/dp/B09WV5JMKS/

I also want to use a KVM switch so I can use a single keyboard/mouse for multiple PCs. Would this work? QubesOS PC PS/2 combo port > PS/2 Y splitter cable to 2x PS/2 > PS/2 to USB adapter > USB cable to KVM switch > USB keyboard and mouse.

Are there better options? Are there direct PS/2 combo Y splitter cables to USB?

2

So this isn’t stupid or bad, but you will most likely need an active adapter from USB to PS/2. PS/2 and USB are completely different protocols, and early USB keyboards supported the PS/2 protocol by detecting and switching based on the computer port it was plugged into. Now that PS/2 ports are largely irrelevant to USB keyboard manufacturers, they don’t include this functionality; hence, the need for an active adapter. That being said, in my experience active adapters are crazy expensive, and good luck finding one.

3

You could also use a dedicated USB controller for dom0. If your motherboard doesn’t have multiple controllers, you can buy a PCIx1 USB extension card for around $20.

Qubes OS automatically enables USBGuard for a controller attached to dom0, and default is to only allow HID devices to connect.

4

In the absence of precious PCI slots, you also have the option of repurposing an m2 slot that you might not be using into a PCIe x1, x2 or x4 using one of several adapters

Some systems have only m2 in the form factor for storage (“key m”, maybe?) while others have a special, smaller slot for things like WiFi that you may not need- “key a” / “key e”

I looked into this some time ago and found a few different ways of doing this, all under $35 total. The USB/PS2 adapters are ~$5USD (Startech is a reputable brand for those)

5

So, you are blessed with a PS/2 port and you are considering using USB keyboard? The point of having PS/2 (keyboard and mouse) isn’t avoiding being locked out in dom0.

6

If that is addressed to me, no, that is not what I’m describing. I’m describing ways to add a PCIE-based PS2 controller to a system that does not have PS2 support, without using one of the true PCI slots

Apologies for confusing language, it’s a convoluted idea to begin with lol

7

Thanks for your reply. So the adapter I linked would not work? What does crazy expensive mean in terms of USD?

Are there better options? What about a KVM switch?

8

That is interesting! But that would still be a security issue, right?

9

Thanks for the idea, but PCI slots are not an issue for my build.

10

What does blessed mean in reference to PS/2? If sys-usb is not in autoboot, how do I not accidentally get locked out? Please explain.

11

I don’t think so.

The issue with USB is mostly the shared bus, if you are using an isolated controller for just the mouse and keyboard you should be fine.

Someone with physical access would be able to install a keylogger or injector, but that is also possible with PS/2.

12

No, I am confused. You meant to use a PCIe slot to get PS/2 ports, that’s it, right?

13

IIRC, the adapter was ~80USD. It’s not going to break the bank if you have a security budget, but it’s just outrageous to me to have a simple adapter cost that much.

As for KVM, I haven’t found a PS/2 KVM yet and I’ve been looking for a while.

14

By using PS/2 keyboard and mouse exclusively when having PS/2 port present.

15

Tripp-Lite makes an excellent active adapter. I’ve been using one for probably a couple of years now. I liked proper clickety click keyboards with a tactile feel like the old IBM keyboards (dating myself here) and couldn’t find one, which I liked for PS/2. You might find, you need to try different usb keyboards to find one, which will be compatible though with the Tripp-Lite. In my experience, I really liked my Hyper-X keyboard, but it wouldn’t work with the Tripp-Lite. So I tried a Logi KB45CH board, which did work, until it eventually gave up the good fight. I have now been using a RedDragon K551RGB-1. Solid board, which I’m extremely happy with.

16

Some other options to convert USB to PS/2 if you are willing to build it yourself:

I’ve been intending to build some of the ps2pico ones for myself and I could build some extra if people are interested.

2 Likes
17

Can you link the Tripp-Lite active adapter please?

18

I will look into the projects. Thanks.

19

No problem.
https://tripplite.eaton.com/ps-2-to-usb-converter~0DT60002

1 Like
20

Thanks for the link! If my KVM switch only has one USB cable output for mouse/keyboard (USB devices), could I use a USB splitter cable to connect to the PS/2 to USB converter, which is then connected to my PS/2 combo jack Y splitter cable? This sounds like a lot of redirection, but would it work?

To explain my setup idea (I know it sounds crazy): USB mouse/keyboard cable > KVM switch > Single USB splitter cable to USB ports of Tripp Lite converter > PS/2 converter cable to Y splitter PS/2 combo cable > Single PS/2 combo jack of my mainboard.