Two back to back live modes is pretty neat. What are the advantages of one over the other though?
It’s described in this guide: Qubes OS live mode. dom0 in RAM (zram0, overlay in tmpfs). Protection against forensics. Tails mode
zram saves memory, but it takes a long time to start up and isn’t as safe. Overlay in tmpfs is maximally safe and starts up very quickly, but it requires more memory.
I didn’t mean the differences between your two live modes but rather the differences/advantages of your guide and @leandroibov guide
My scenario is much safer and simpler and fully reproduces a real Tails environment and does so with a secure boot:
It has two live modes: ultra‑secure Overlay Mode, like in Tails, and ZRAM scenario.
The root filesystem is mounted read‑only (ultra‑secure, like in Tails).
Custom GRUB options are used so that the default boot process isn’t affected at all (ultra‑secure).
Hardened options are applied when mounting the overlay/copy (like in Tails).
A RAM‑wipe is performed for paranoid protection (like in Tails).
It’s a very simple script that will install all modules automatically - you just need to run the script.
My scenario works in BTRFS (the old scenario does not work in BTRFS)
2 Likes
The script does everything automatically! Easier! Perfect! Qubes Team must do it in qubes with gui interface in the next version of qubes os.
Hi @linuxuser1,
Firstly, thanks for all your hardwork. This looks great.
You seem to have a good grasp of the inner workings with how data is handled in Qubes between VMs and dom0.
I just installed Qubes yesterday and the topic about encrypted Qubes is one of the first subjects i started to look at.
I created an additional partition and pool which is encrypted with a different key where i intend to store some of my Qubes but honestly i am not sure what data will pass the dom0 disks when doing operations like copying files from one VM to another etc.
I really love your approach and it is probably what i need together with an extra encrypted partition but i only have 32GB ram so i am trying to understand how much coverage i get by only going with an additional encrypted partition/pool approach.
What kind of metadata is stored in dom0 and do i need to be worried if i choose to only go with an extra encrypted partition/pool?
Thank you!
1 Like
@pikol thanks!
My script now works with ephemeral encryption instead of RAM in the varlibqubes pool. Therefore, you can use it even with 8 GB of memory. This topic describes why ephemeral encryption is more convenient and efficient. Also, you now have an anti-forensics appVM without dom0 in RAM. Also, you can use ephemeral encryption only for the root and volatile volumes in persistent appVMs - it protects logs from forensics but won’t be an issue for file storage.
1 Like
Hello @linuxuser1. I copied both the Whonix workstation and gateway templates into varlibqubes but then I don’t have any space left for any other templates or AppVMs. I am using a Thinkpad T440p with 16GB RAM, by the way.
Is there anything I’m missing?
@linuxuser1 Just posting to make sure you notice my other one above.
I didn’t put the @ in before until I edited it.
@ledOnion My guide is here. My guide doesn’t require much memory. You’ll be able to run up to 20 appVMs.
1 Like