Packaged tools for 4.3

I’ve uploaded some packages for 4.3 - available from
https://qubes.3isec.org/tasks.html

The packages can be used to install:

cacher - a drop in replacement for the Update Proxy that caches packages
to speed updates and reduce network load.

mirage-firewall 0.9.5 - a drop in replacement for sys-firewall that uses minimal RAM and boots very quickly.

mullvad-vpn
Thanks to the folk at Mullvad VPN this creates a qube ready for use with varieties of Mullvad VPN.
The package installs a Mullvad Proxy with the Mullvad GUI to make it
easy to set up the VPN. It also creates a disposable template, so you
can run disposables which have the Mullvad GUI and Mullvad browser
pre-installed. You can use the Mullvad browser without using a Mullvad
VPN - it’s been developed with the Tor Browser team, to provide secure
browsing out of the box.

pihole
Creates a pihole standalone as a drop in replacement for sys-firewall to block ads and trackers.

sys-multimedia
Creates a “media” qube for storage of media files, and a disposable
called “multimedia”. The “media” qube is configured so that opening
a file will launch multimedia, and play the file in the right app. By
default multimedia is offline. This means that you can (fairly) safely
work with content from untrusted sources.

12 Likes

Does it work out of the box with onionized repositories?

I don’t know how to import your key @unman . can someone guide me how to do it step by step? I have to download it in dispvm? and then import if This is true how to download it tell commands or something.

What would be the security difference between using an offline vault versus your media and multimedia qubes?

getting following error while trying to install 3isec-qubes-task-manager
failed to connect to system scope bus via local transport: operation not permitted
updatevm for dom0 and templates is sys-whonix.
I use mirage-firewall and openbsd sys-net.
netv for sys-whonix is mirage-firewall and I use onionized repositories for everything. ( whatever instruction availabe at whonix website) Using Qube 4.3rc2 fully updated current testing.

Difference is that vault is for most precious thing, like passwords, bank documents, tax documents, etc, while media qube is for music and movies and some casual documents.

The process is explained here.

Download the key in a disposable.
You can find it on keyservers (like Search results for '0x8B3F30F9C8C0C2EF'),
or GitHub
There will be a link to the file - save it on the disposable.

Check the fingerprint:
gpg -n --import --import-options import-show unman.pub

pub   rsa4096 2016-06-25 [SC]
      4B1F 400D F256 51B5 3C41  41B3 8B3F 30F9 C8C0 C2EF
uid           [ unknown] unman (Qubes OS signing key) 
sub   rsa4096 2016-06-27 [S] [expires: 2026-06-30]
sub   rsa4096 2016-06-25 [E]

In particular, check that the output from your command contains the
fingerprint 4B1F 400D F256 51B5 3C41 41B3 8B3F 30F9 C8C0 C2EF

When happy,copy to dom0 and add key to keyring:
In dom0:

qvm-run -p QUBE_WHERE_YOU_DOWNLOADED_KEY 'cat PATH_TO_KEY' > RPM-GPG-KEY-unman
sudo mv RPM-GPG-KEY-unman /etc/pki/rpm-gpg/
sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-unman 
I never presume to speak for the Qubes team. When I comment in the Forum I speak for myself.
1 Like

The only difference is that the media qube is preset to open files in an
offline disposable preloaded with appropriate software.
Any one could set this up for themselves.

Like most of these packages it is a convenient way for users to
configure their systems. The risks in blindly copying bash commands or
mistakes in configuration are reduced - you do, of course have to trust
me, but often users are trusting other users in the forum.

The source for all packages is on GitHub, and is deliberately kept as
simple as possible. This is so that the salt packages can be easily
understood, and serve as a teaching aid.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

1 Like

Short answer - No.

Long answer -
It used to do so, but no longer does. This is because RFC7686 mandates
that name resolution libraries drop DNS requests for onion names.
It’s discussed in this thread -

There is a work round using privoxy, or you can put a passthrough in
acng.conf to skip onion addresses.

I never presume to speak for the Qubes team. When I comment in the Forum I speak for myself.

I dont use Whonix, and dont recognise this error.

There’s no issue with pulling over Tor using OpenBSD sys-net, so I think
this may be Whonix specific.
Perhaps you would get more help at the Whonix Forum

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

3 posts were split to a new topic: APT cacher-ng: Error: Failed to fetch https://repo.librewolf.net

@unman, when running

sudo qubes-dom0-update 3isec-qubes-task-manager

the rpm package gets downloaded and signature passes but then I get the following error:

‘/usr/lib/qubes/qrexec-client-vm dom0 qubes.ReceiveUpdates /usr/lib/qubes/qfile-agent /var/lib/qubes/dom0-updates/packages/*.rpm’ failed with exit code 1!

Qubes R4.3.0-rc3, update VM: sys-whonix

I also used a direct repository URL (Index of /rpm/r4.3/current/dom0/fc41), because the templated URL (https://qubes.3isec.org/rpm/r$releasever/current/dom0/fc41) returned a 404.