I installed on SSD drive of the laptop. It was unlabeled disk. Had more than enough of space. Do you mean removing of the hard drive itself? Then no. I removed only usb stick after installation process of OS was finished and it asked to reboot computer. That issue started already then, but then I already knew about how to boot Qubes manually and then did it and continued the installation process. Under “installation process” I mean the second phase when goes the process of installation of components like Debian, Fedora, Whonix.
OK then. If other packages except Whonix are needed then how can I prevent my traffic of being leaked in clearnet? I chose Qubes hoping they can give me protected Tor sandbox as Tails do but with much better protection of Qubes VM’s.
If you use this setup:
sys-net (using debian template with your network PCI controllers attached) ↔ sys-whonix (using whonix-gateway template) ↔ anon-whonix (using whonix-workstation template)
Then nothing from anon-whonix qube will be leaked to clearnet.
1 Like
1 Like
Thanks for help. Another qustion: is there a way to encrypt disk with keyfile instead of password? It has two advantages:
- If you distroy a keyfile no one ever can decrypt the disk. In contrast of password which can be obtained through “thermorectal cryptanalysis”.
- Password can be typed wrong during first encryption (because it was too large and you did a mistake while typed it) and you either can’t decrypt the disk anymore, or you have to enter a long password for half an hour each time.
The documentation really lacks a manual on how to encrypt the disk of Qubes with a keyfile.
P.S. I can’t decrypt my drive with my password anymore, so I still have to reinstall the OS. So I decided to ask this question before reinstalling.
And what should it be for? I didn’t see there anything about encryption with the keyfile. Did you send this because of something about proper manual disk partitioning about which there maybe is something written? I didn’t understand for sure yet because of still complicated text for me. I don’t have enough experience yet to figure out every single thing that is written there.
Is there a way to translate the Qubes’ interface into another language? Because they’re like the spaceship’s dashboard and everything’s in English.
This topic is about creating this setup for Qubes OS:
https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encrypted_/boot_and_a_detached_LUKS_header_on_USB
It’s better than just having USB drive with a key that anyone can steal/copy or get it from you using force before you manage to destroy it and decrypt your Qubes OS without asking you anything.
It’s an advanced topic so you’ll have to spend some time reading to understand it.
It’s better to keep the interface in English because when you’ll try to follow some instructions in English you won’t know what to do because you won’t know how exactly it translates from English instructions to interface in another language.
2 Likes
Thank you for your answers. During the acquaintance with the Qubes, I realized that this OS is too complicated to use it at once in the work and learn it like that, “in combat conditions”, so it came to the understanding that I need to begin somehow to test it in a safe environment and conditions. Of all the possible options, I have one more Qubes to install, but already on the external hard drive and test it there until I master it properly. Except it’s not empty. Is it possible to install Qubes on the remaining free space so that you can load OS, and, when you need, to open files on this disk, as on ordinary external media? Let’s say for OS to create a partition on this disk. I will put the OS there and encrypt this partition during installation, and the rest of the partition will be a normal NTFS partition with files.
Or I also have an internal HDD. There is no operating system, just file storage. With files on it too. Could use it the same way as described above. It could be something like dual boot but with OSes installed on different disks. Is it possible to do?
P. S. OS installed on that comp it’s Windows 10, not Linux.
You can install it using the free space on any of your disks the same way you can do it with any other Linux distribution.
But be aware of the possible security risks with multibooting:
1 Like
So, if I use default Qubes installation, then even if I install it on a different disk then only Qubes will boot but not Windows? Once I already installed Linux after Windows 10 and had to do extra steps to place Windows in Grub menu, but then they were installed on the same disk. So, as I understand, even if they will be installed on different disks, Qubes anyway overwrites some boot partition (wherever it is or whatever it is, I don’t know this thing for sure) and only Qubes will be bootable after that? Or even if so, can I still enter boot menu each time I turn my comp on and then manually choose from which disk to boot and this way I can boot one of two OSes when needed, without some extra steps of placing the Windows 10 in grub manu of Qubes? Am I right in something?
No, only if Qubes OS is installed on the same disk that already has some other OS installed.
You’ll be able to boot like this from BIOS if you install Qubes OS on a separate drive where no other OS are installed.
1 Like
I read the manuals on the Qubes and Whonix website and never found the answers to some questions.
-
Do I even need the sys-net, sys-firewall cubes and cubes that use them, or can they all be uninstalled without any worries? I need all my traffic to go through the Tor network as it is in Tails, so can I delete them all to eliminate any possibility of traffic leakage into the clearnet? Or without these cubes, will the OS not work normally or not work at all?
-
What is the point of being Disposable Template if this Disposable Template is exactly the same Template, only based on another Template? Why can’t you create Disposables right on the Templates?
-
When creating a Whonix Workstation cube, why to give ability to choose which Internet cube to connect to it, when it is crystal clear that if it is Whonix Workstation, then it needs either sys-whonix (aka Whonix Gateway), or no Internet at all (and then it should be “none”)? Why give the ability to connect sys-net if then will go clearnet traffic, bypassing Tor?
You need to attach your PCI network controllers to one of the qubes to connect to the internet.
If you attach it directly to sys-whonix then it’ll be less secure:
And you’ll just won’t use the possible security provided by Qubes OS:
How does Qubes OS provide security?
Qubes takes an approach called security by compartmentalization, which allows you to compartmentalize the various parts of your digital life into securely isolated compartments called qubes.
Also, I’m not sure if Whonix Gateway even support attaching PCI network controllers directly to it.
You can have multiple Whonix Gateway qubes and not only a single sys-whonix. Also see this issue:
2 Likes
What do you all call “pci device”? An internet modem? So, if I’m using an Internet modem, which cube I need to connect the modem to, so I can use the Internet without leaking into the clearnet?
Your Ethernet or Wireless controller (LAN / WiFi) that is using PCI bus. Or it could be USB adapter.
By default your PCI network controllers are attached to sys-net qube that is created by installer by default.
1 Like
I have an internal HDD with ~ 500 MB read/write speed. Is it enough to test Qubes on it? Still want to test Qubes in a safe environment before really use it “in the wild”, but have to choose the drive for the Qubes’ test. At the moment that HDD is the most possible and convenient option.
It’s enough.
1 Like