netVM and ClockVM?

User Support
1

hello dear qubes community, I am having a question about netVM and ClockVM.
When viewing the global settings, netVM is on sys-firewall, and ClockVM is on sys-net, both by default. Should I leave it like that?

one post about ClockVM that I have read was the following:

I’ve been able to get a quiet Qubes machine by:
Setting ClockVM to ‘None’ in Global Settings. This prevents NTP traffic in the chosen qube.

just as an example. i am thankful for any input about this.

What would happen if I set netVM or ClockVM to sys-whonix?

2

netvm: network will won’t work at all in default config
clockvm: tor will only work if your clock is correct, which is can be manually set

3

thank you. does it have any advantage to tweak the ClockVM setting (e.g. to sys-whonix)?

4

no, it better to set to none and manually update the time if it wrong

5

ok, to reduce my data usage, right?
it doesn’t affect my fingerprint if i tweak it to “none” in any way, correct?

6

this is commonly used to force all traffic to go though tor

afaik, it can only used to identify your timezone, ip, linux or windows, etc

7

afaik, it can only used to identify your timezone, ip, linux or windows, etc

if I tweak it to (none)? or always?

this is commonly used to force all traffic to go though tor

is it not forced over Tor if i leave it on sys-net?

8

this

yes, actually you can’t force it to go though tor, so people set it to none

9

cool. and netVM, should I leave it on sys-firewall or is there an alternative?

10

leave it on sys-net, or a custom netvm if you created any

11

this

what i wanted to know: is my fingerprint different if i tweak it to (none) in comparison to someone who left it on default? i don’t wanna increase my fingerprint.

12

leave it on sys-net, or a custom netvm if you created any

why is sys-net more suitable that sys-firewall?

13

yes,…

14

let’s assuming netvm is the vm connect directly to network interface
you’ll see why

15

but why is it the default then?
is it critical? if i tweak it, i would increase my fingerprint after all.

16

too obvious, compartmentalization

unless you want a air-gapped computer, yes

you should randomize your hostname (to DESKTOP-[random character]) as the default one increase fingerprint

17

you should randomize your hostname (to DESKTOP-[random character] ) as the default one increase fingerprint

good point. but the host name is the same unique name for every vm that I use. i want to have separate identities for each of my vms. isn’t that bad then?

18

only netvm hostname is identifiable outside your computer, internal one is not

1 Like
19

alright, thank you.

let’s assuming netvm is the vm connect directly to network interface
you’ll see why

tbh i don’t understand why sys-net is better than sys-firewall for netVM. can you explain that rather noob-friendly?

20

yes, you can attach your network card to sys-firewall, but security is weaken then, so qubes dev add [1] sys-net so it have better compartmentalization → better security

  1. i guess ↩︎

1 Like