"Now You're Thinking with Qubes"

panati · September 21, 2020, 8:18pm

Actually there is a third party documentation about http-proxy running in a proxy VM for restricting access, but I never had time to give it a try. If you want to give it a try here it is-

github.com

Qubes-Community/Contents/blob/master/docs/configuration/http-proxy.md

How to run an HTTP filtering proxy
=================================================

Introduction
------------

By default, Qubes uses a special firewall VM that sits between the networking VM and each AppVM.
This VM controls the traffic for AppVMs and can be used to restrict what AppVMs can send or receive.
The traffic rules can be setup using the filtering rules GUI in Qubes VM manager.
The manager translates user-defined setup into iptables rules for the firewall VM's kernel.

The primary goal of the filtering rule setup in the firewall VM is to allow for the user to protect either from his own mistakes (like accessing an arbitrary website from a browser running in a banking VM) or from the mistakes of websites (like a banking website that loads JS code from a social network operator when the user logs into the bank).

As the rules in the firewall are IP-based, it has drawbacks.
First, the rules cannot be used if one has to use an HTTP proxy to connect to websites (a common setup on corporate networks).
Second, Qubes resolves DNS names from the firewall rules when the AppVM loads.
This prevents websites that use DNS-based load balancers from working unless the user reloads the firewall rules (which re-resolve the DNS names) whenever the balancer transfers her session to another IP.
Third, the initial setup of the rules is complicated as the firewall drops the connection silently.
As a workaround, one can use a browser's network console to see what is blocked, but this is time-consuming and one can easily miss some important cases like including sites for OCSP SSL certificate verification in the firewall white-list.

This file has been truncated. show original

deeplow · September 21, 2020, 8:22pm

I see. Breaking using the original ideas behind the purpose of domain names is quite nice. And above all what I think Qubes does well is making things explicit.

One thing to note there is that Qubes compartments themselves only assure isolation from a security perspective. Isolation from the privacy perspective (anti-tracking) is very difficult and for that only whonix-based VMs are appropriate. (FAQ: What about privacy in non-Whonix qubes?)

Sean · September 22, 2020, 8:08am

Hello ejd and thanks for your reply. True indeed for me too. My bank’s website seems to have a liking for googleaps and one or two others I’d have to login there again to remember, but they all timeout within five or ten seconds and after that kind of delay, I get through. Secure.

It bothers me quite a bit that my bank is sharing my financial details with Google but I know from experience that they would never listen to plain simple logic, so I just put up with it. The damned delay, that is. I guess that’s the price I pay for reasonable security in the 21st century.

Sean · September 22, 2020, 8:20am

I noticed that Facebook saw when I tried to translate another language on a Facebook post using Google Translate in the other Web-Wild VM. I assumed that they’d honed in on my IP address, so yes I agree that it might be more secure to use Whonix VMs. It seems though that Facebook don’t like Tor IP addresses though.

My answer to that: Don’t use Google Translate with Facebook even with different VMs, It’s a hassle and a half considering what the end result of a translation usually turns out to be worth.

So funny in hindsight how in 2000 I was sad that most people didn’t know anything about computers or The Internet and I wished that everyone would hurry up and get online and share in the technology.
Now look what I wished for that happened. Big Gov ruins my dreams once again …

phl · September 22, 2020, 9:13am

Interesting that you are experiencing a delay. I thought the Qubes Firewall would reject requests to IP addresses not in the whitelist instead of silently dropping them. Maybe you could fine-tune your firewall here to improve the user experience?

deeplow · September 28, 2020, 6:30am

2 posts were split to a new topic: Printing from DisposableVMs

Surf · September 27, 2020, 4:58pm

Very important in this day an age. Unfortunately, when I reisntalled qubes this feature got corrupted by my qubes back up somehow. Is there a packet to install to fix this in dom0 if it isn’t working properly?

Sean · October 3, 2020, 1:07am

Sorry for the delay in replying. It has been quite a busy week. I have been pondering your point about the timeout and the more I think about it, the more perplexed I get.

I have always in the past assumed that it was at the bank’s end that timeouts were coming from. A system where the bank’s server receives a request from the client at my end, for a whitelisted domain address …

… but then, inside that allowed web page some overpaid, underqualified cretin has added links to all the usual googleapps garbage, which is denied at my end by the firewall …

… so, the bank’s server keeps trying to send the denied domain address data for a while until it gives up and tells my client to render the blimmen page with what it can best use at the time.

That doesn’t seem to make much sense now I think it over. There are no timeouts at the transfer end of the hypertext transfer protocol. It just doesn’t work that way as far as I can imagine.

The best answer I can come up with now, having just thought it over a bit more while typing, is that my Qubes firewall is smart enough to identify a whitelisted web page domain address and still deny any embedded external links which are not whitelisted.

Curious to me, since you mentioned it. I’ve always just put up with the delays without too much question because after all it works sufficiently to do my banking operations with reasonable security.

I have never tried running the Web-Bank VM to access my bank’s website without the firewall, so there’s no standard to measure Qubes’ with or without a firewall, and I can’t be bothered with that anyway. Now that my Qubes OS has died of bootstrap disease an I am having to resort to Linux Mint though, it is clear that accessing the bank website with plain old Linux without a firewall and taking all the googleapps crap in the process is far quicker and smoother than doing the same banking chores with Qubes OS and a firewall.

Sorry I could not provide more reliable answers, phi.

fsflover · October 8, 2020, 9:01am

github.com/QubesOS/qubes-issues

Safe use of Hyperthreading when Xen stable includes new sched-gran parameter

opened 09:59PM - 29 Dec 19 UTC

trueriver

T: enhancement C: Xen security P: default

### Qubes OS version: R 4.0.1 All current versions as of 1 Jan 2020 ### Affected component(s) or functionality: Xen, hyperthreading, Intel --- ### Steps to reproduce the behavior: Run Qubes on machine with hyperthreading (HT) hardware ### Expected or desired behavior: HT should ideally be available ### Actual behavior: HT disabled by default ### General notes: HT has been deliberately disabled for security reasons, and with the current relaease versions of Xen this is sensible. The reason is that there exist several exploits on Intel kit that involve abuse of shared cache, etc, when one thread in a CPU is running on one VM and another on another. However, the Xen wizards are on the case, and they have a fix that will ensure that all the threads running on a cpu are allocated together. This means that the only software exposed by such exploits will be software that already has access to that machine. This may reduce the attack surface to an acceptable level for at least some users. The patch is now included in some unstable branches of Xen, and is invoked by the command line parameters smt on sched-gran=core (or socket or cpu). My request is that this is implemented by Qubes, but ONLY once we start using a Xen version that includes this feature. However, it is currently (Jan 2020) too soon to change the current behaviour, as the versions of Xen currently in use ignore this combination without warning. My request therefore is that this is assigned a sensibly long timescale. --- ### I have consulted the following relevant [documentation](https://www.qubes-os.org/doc/): https://www.slideshare.net/xen_com_mgr/xpdds19-core-scheduling-in-xen-jrgen-gro-suse https://patchwork.kernel.org/cover/11086677/ https://xenbits.xen.org/docs/unstable/misc/xen-command-line.html#sched-gran-x86 (NOTE the above path is in the "unstable" branch) ### I am aware of the following related, [non-duplicate](https://www.qubes-os.org/doc/reporting-bugs/#new-issues-should-not-be-duplicates-of-existing-issues) issues:

deeplow · October 9, 2020, 9:15am

4 posts were merged into an existing topic: What’s your system layout like?

fsflover · January 7, 2021, 4:32pm

I like the idea from here: > 1. By default, there is no need for an attacker to find a local exploit to get... | Hacker News. I would probably call it split root.

I agree that it should be harder to go from domU user to domU root. However I think having to manage passwords for every AppVM also negates a lot of the benefits of the template setup in qubes (I currently have about 30 AppVMs).

My ideal solution to this problem, which I might implement at some point, would be to implement a PAM module for domU that asks dom0 whether escalation to root is okay. That way, dom0 can prompt the user whether to allow it or not, and no per-AppVM passwords have to be remembered.

phl · January 7, 2021, 6:27pm

There’s actually already a documentation for that:

Never used it myself, though.

deeplow · January 9, 2021, 12:13am

I’ve used this in StandaloneVM’s because there the logic for the passwordless root AFAIK doesn’t apply.

it’s neet. Even though a propt shows up, it’s still faster and more convenient than having to type out a password

arkenoi · February 3, 2021, 7:36am

As a desktop user, I’d find exportable qubes extremely useful. My laptop is Mac and it cannot run Qubes.

Brainhack · June 8, 2021, 9:19am

Just realised that I could do that also to separate “real” work from personal stuff, by letting the Qube that I work from connect to ETH only.

Makes for a very neat routine of plugging in before starting work at home & then unplugging, rituals like these have a lot of impact.

Added security and splitting up possible data harvesting is a great plus too, but for me its mostly about workflow & blocking big data surveillance which I hate with a vengeance.

deeplow · February 16, 2022, 7:56pm

2 posts were merged into an existing topic: Graphene OS Template?

gg11331 · February 16, 2022, 9:53pm

When we can say “Qubes now suitable for the Normal People”?

Is it a good idea or it is risky for noops?

enmus · February 16, 2022, 11:00pm

I’d say that this has absolutely wrong premise. Can you imagine a youngster first to be introduced to a modern car, telling him that it is not for young people because it has a lot of safety features he/she can’t use because the features are complicated?

You want to drive? Especially beginners should start with modern car with as much as possible safety features.
You want to compute? Especially beginners should start with as much as possible Qubes computer.

Using your logic, would you call people who drive cars without seat belts. airbags, ABS, all the working lights, without bumpers, shatter resistant glasses and without both side view mirrors - normal? Probaly no. And you are calling people who are using computers without even more safety features - normal. It just ain’t right to us using Qubes.

gg11331 · February 17, 2022, 7:57pm

Yes, I agree with you…
(People caring for Privacy without advanced experience )
But I think about the “the future of qubes” and “The concept of simplicity” I think we can see soon qubes is simple for all the people …
Why I say that ?
Some features in qubes are simple more than linux distribution (of course qubes depend on linux templates):

you can see how it’s simple to install qubes and update the templates.
I don’t know if the aim of the developers of qubes wasto make it simple for the normal user.
I think the idea of qubes is “The Ultimate privacy” and “compartmentalization”
To illustrate, when I say for the normal people I was thinking of the people who are caring of privacy and " don’t have a lot of experience with programing and linux "
So I hope we could see qubes more simple for the "Normal User " in the future…

oldschool · February 17, 2022, 10:20pm

“Now You’re Thinking with Qubes”

The toughest concept for me to grasp was the bare metal virtual machines offered by Xen, and how beautifully Qubes built a collection of OS’s and VM’s to leverage them all, especially the chaining of VM’s providing networking services to other VM’s. Once I swallowed the pill, and made myself comfortable with it, I went hog wild.

I love lots of networking options, and this is where Qubes excels. As a linux junkie, I like renting VPS servers from various providers around the world, and using those servers for whatever I want. For $5/month each, they are dirt cheap, but gives me lots of great experience. I usually put a private VPN server on each one, to access it that way. Sometimes I’ll also install a tor entry-node server on it, to play around with tor. Most VPS providers don’t mind entry-node servers, they just don’t like exit nodes, so it’s not a problem.

I like to create a variety of networking options, frequently changing too, like:

sys-net-eth
sys-net-wifi
sys-vpn-losangeles
sys-vpn-chicago
sys-vpn-tokyo
sys-vpn-amsterdam
sys-tor-vpn-losangeles
sys-tor-vpn-tokyo
sys-tor-vpn-amsterdam

then work/play VM’s to access each of those, easily changeable, like:

play-vpn-tokyo
play-tor-vpn-amsterdam
work-vpn-losangeles

Qubes makes it so easy, that once you get used to it, the sky really is the limit. As new things pop up, like wireguard, I’ll play with those too.

As a rule, I don’t put anything sensitive or important on the laptop. It’s just for fun learning really. If it gets screwed up, I’ll just wipe the drive and start over.

I played around with “minimal” installs, minimal firewall, blah blah blah. In the end, it’s just not necessary, for me anyways. A Debian template and a Fedora template give you more than enough to handle almost anything. Sure, there are niche situations, and multiple templates can be necessary. We all do different things, which is another reason why Qubes is so great. The flexibility to do things so easily that other platforms do poorly, if at all, to me, is the greatest appeal.

Sorry I’m late to this thread. Couldn’t resist!