More practical security for Qubes (and more realistic threat model)

[ddevz]

Since you mentioned logging you might be interested in this:

WORKING: Guide for creating a logging qube (I.E. sys-log) - WIP

NOTE: While this guide is still a work in progress, it is now useful enough that many people should be able to use it to get logging working locally on their system After a 7 year discussion on logging, a Qubes pull request was recently created for new patches to allow the creation of a logging qube. Both DisposableVM’s and AppVM’s currently discard all their logs when they are shut down, so this was desperately needed. (note: verify that that situation hasn’t changed for AppVM’s) This threa…

Sounds like you may be researching log analysis tools soon. If so, please mention any solutions you find to that thread so we can add it to the guide and everyone can benefit from them.

I’ll also be interested to see what you come up with for a Host IDS and several of the other things you propose.