Hi, i just installed qubes and i’m looking for reads or information on good post install practices so far as setting and structuring my qubes go. Pointing me to any guides, blogs and videos is apriciated. Thanks !
1 Like
2 Likes
Welcome to Qubes and the forum! 
Basically you want to:
-
Decide which applications to run in which Qube VMs - if you want to use groups, for example run “all work stuff” in the work Qube VM or if you want to use one Qube VM for each application you use (needs a beefy computer)
-
You want to organize your old backups into your new categories
-
Restore the backups into the new Qube VMs
-
profit.
The beginning with Qubes is a game of organizing your work, or, if you have a strong enough computer, simply making a list of all applications you want to run. When you have setup Qube VMs for each of your usecases, you restore the backups into them and then you start.
After this you can do things like configure the firewall (or before, depending on your paranoia level).
You can browse the Community Guides - Qubes OS Forum section after this, there is a bazillion things you can configure / make more secure in Qubes - go easy on this if your Linux skillz are not reasonably high yet. You can make it less secure if you do something wrong.
A good approach is to post in the forum “I have planned to do this like that” and check what the community thinks of your plan.
2 Likes
Thank u useful diagrams there !
1 Like
Thank you, do you have advise or guides for firewall config?
1 Like
Well the firewall..
How skilled are you in Linux?
The idea here is.. Lets say for example you have a Qube just for thunderbird.
This one is simple, bcs then you have to open smtp.mail.com tcp smtps and imap.gmail.com tcp imaps. block the rest. easy enough.
If you have a qube for signal messenger, you need to wireshark in front of said signal Qube to determine what signal wants to talk to, and then allow all of those (until those hippies change their CDN IPs and so on).
The firewall is a bit of a complicated topic, and not exactly the greatest start. I am not sure what your “Linux level” is - if you tell me I can push you in the right direction 
Mind that not having a firewall still makes your new setup VASTLY more secure. In basic, the firewall is more to block (only allow) things you now to be good and does not prevent a hacked thunderbird from exfiltrating your emails (it can just do so via smtp.gmail.com tcp smtps).
How much can you follow what I just wrote?
2 Likes
Are you an Alice, a Carol, or Bob or John, or someone else?
1 Like
My best recommendation is to take Qubes one step at a time, and to do that step well.
So first thing is “partitioning” your applications / trust levels across Qube VMs, restoring backups to those, and get a system running that can be your daily driver (the laptop you work with every day). Then, when all of this is rock solid (and when you can make backups of it), you pick out one topic you like and learn about it, then implement it.
In Qubes there are SO many funky ways to make it “more secure”, but choosing to much can get you frustrated fast. Its also an absolutely amazing hobby to continuously work on it - but if you are totally new to Qubes, you should not try to get a hyper secure setup all at once.
Just having a good and solid migration to Qubes already makes you VASTLY more secure than windows/osx/ubuntu. One step at a time.
1 Like
That makes sense ! Is it wrong for me to assume someone wrote a guide on it esppecialy for more popular apps so that people don’t have to bother with Wireshark or wrote their own rules ? Are there good tutorials you would otherwise reccomend?
1 Like
Are you what kinda thing?
Judging from his nickname he’s a julian LOL xD
Just checking who’s reading suggested articles and resources…
1 Like
Its not wrong, but a bit more complex than that.
Email client is kind of the most simple model, because you know exactly “whom to talk to”.
Signal is my favorite slightly more complex example, especially if you use a VPN that changes country every now and then, bcs Signal will choose different CDN servers depending on your VPN endpoint (country). So not that easy here.
The browser is the worst case example, bcs ofc you never know which website wants to talk to which service.
I still dont know your linux skill, but I’ve recently written GitHub - kuhbs/qubes-snitch: qubes-snitch is a firewall that runs in a Qubes OS NetVM, and is designed similar to Little Snitch/OpenSnitch. It uses nftables to force VM traffic through userspace prompting, with separate handling for DNS queries and connection decisions, and saves allow/reject rules per source and destination. · GitHub to solve that problem (or make it a TON more easy). It interactively asks you to approve / deny DNS requests and connection attempts. If you are linux-y you can give that a shot. But this is not absolute enduser/beginner level. You have to know a bit what you’re doing.
It is similar to OpenSnitch or Little-Snitch from OSX, if you know any of those two, but written for Qubes OS (and has a cli interface bcs that needs less lines of code).
1 Like
Dope !
1 Like
As said: when you’re new to Qubes, take it one step at a time, and do each step well before you move on to the next. Otherwise frustration might take over, or you might brick your system by accident.
- Compartmentalization / Choosing which applications run in which Qube VM
- Backups
- Maybe firewall, although this is a bit more complex
1 and 2 are by far the most important and by far the biggest security benefit. Properly isolating your usecases / applications gets you 80% of the way already.
Dope i figured out compmartmentalization ! Can you explain backups ?
1 Like
explain backps
Sadly no, because I neither like nor fully understand the way Qubes OS does backups natively xD
But from what I remember there is this Qubes OS Backup GUI where you click “do backups” and it backs up to external USB media or something. I’m the wrong guy to ask x)
Given that Qubes is quite stable software I’d recommend to just try it, it should be intuitive.
Oh and while we are here ALWAYS DO UPGRADES! ALWAYS! WHEN IT SAYS “Do you want to upgrade?” the answer is ALWAYS yes! ALWAYS ALWAYS ALWAYS install upgrades right away.
Very important for security
Can you please explain how exactly they were useful to you? It would be useful to other new users when reading this.
1 Like
I don’t have usb backups for it, i thought it was something else. So it is only in case the system bricks ? What do you use for backups storage ?
For understanding
1 Like
Backups are in case you brick your system, or its stolen, or you drop the laptop, or or or. Just do backups
I use something custom for doing backups, and I store them to a USB device.
You should use the Qubes OS provided solution for backups to begin with, and then, if you are not happy with it, and everything else works well already, maybe find sth custom.
Btw a backup is only a backup if its restore has been tested and verified.
2 Likes