And what should it be for? I didn’t see there anything about encryption with the keyfile. Did you send this because of something about proper manual disk partitioning about which there maybe is something written? I didn’t understand for sure yet because of still complicated text for me. I don’t have enough experience yet to figure out every single thing that is written there.
Is there a way to translate the Qubes’ interface into another language? Because they’re like the spaceship’s dashboard and everything’s in English.
This topic is about creating this setup for Qubes OS:
https://wiki.archlinux.org/title/Dm-crypt/Specialties#Encrypted_/boot_and_a_detached_LUKS_header_on_USB
It’s better than just having USB drive with a key that anyone can steal/copy or get it from you using force before you manage to destroy it and decrypt your Qubes OS without asking you anything.
It’s an advanced topic so you’ll have to spend some time reading to understand it.
It’s better to keep the interface in English because when you’ll try to follow some instructions in English you won’t know what to do because you won’t know how exactly it translates from English instructions to interface in another language.
2 Likes
Thank you for your answers. During the acquaintance with the Qubes, I realized that this OS is too complicated to use it at once in the work and learn it like that, “in combat conditions”, so it came to the understanding that I need to begin somehow to test it in a safe environment and conditions. Of all the possible options, I have one more Qubes to install, but already on the external hard drive and test it there until I master it properly. Except it’s not empty. Is it possible to install Qubes on the remaining free space so that you can load OS, and, when you need, to open files on this disk, as on ordinary external media? Let’s say for OS to create a partition on this disk. I will put the OS there and encrypt this partition during installation, and the rest of the partition will be a normal NTFS partition with files.
Or I also have an internal HDD. There is no operating system, just file storage. With files on it too. Could use it the same way as described above. It could be something like dual boot but with OSes installed on different disks. Is it possible to do?
P. S. OS installed on that comp it’s Windows 10, not Linux.
You can install it using the free space on any of your disks the same way you can do it with any other Linux distribution.
But be aware of the possible security risks with multibooting:
1 Like
So, if I use default Qubes installation, then even if I install it on a different disk then only Qubes will boot but not Windows? Once I already installed Linux after Windows 10 and had to do extra steps to place Windows in Grub menu, but then they were installed on the same disk. So, as I understand, even if they will be installed on different disks, Qubes anyway overwrites some boot partition (wherever it is or whatever it is, I don’t know this thing for sure) and only Qubes will be bootable after that? Or even if so, can I still enter boot menu each time I turn my comp on and then manually choose from which disk to boot and this way I can boot one of two OSes when needed, without some extra steps of placing the Windows 10 in grub manu of Qubes? Am I right in something?
No, only if Qubes OS is installed on the same disk that already has some other OS installed.
You’ll be able to boot like this from BIOS if you install Qubes OS on a separate drive where no other OS are installed.
1 Like
I read the manuals on the Qubes and Whonix website and never found the answers to some questions.
-
Do I even need the sys-net, sys-firewall cubes and cubes that use them, or can they all be uninstalled without any worries? I need all my traffic to go through the Tor network as it is in Tails, so can I delete them all to eliminate any possibility of traffic leakage into the clearnet? Or without these cubes, will the OS not work normally or not work at all?
-
What is the point of being Disposable Template if this Disposable Template is exactly the same Template, only based on another Template? Why can’t you create Disposables right on the Templates?
-
When creating a Whonix Workstation cube, why to give ability to choose which Internet cube to connect to it, when it is crystal clear that if it is Whonix Workstation, then it needs either sys-whonix (aka Whonix Gateway), or no Internet at all (and then it should be “none”)? Why give the ability to connect sys-net if then will go clearnet traffic, bypassing Tor?
You need to attach your PCI network controllers to one of the qubes to connect to the internet.
If you attach it directly to sys-whonix then it’ll be less secure:
And you’ll just won’t use the possible security provided by Qubes OS:
How does Qubes OS provide security?
Qubes takes an approach called security by compartmentalization, which allows you to compartmentalize the various parts of your digital life into securely isolated compartments called qubes.
Also, I’m not sure if Whonix Gateway even support attaching PCI network controllers directly to it.
You can have multiple Whonix Gateway qubes and not only a single sys-whonix. Also see this issue:
2 Likes
What do you all call “pci device”? An internet modem? So, if I’m using an Internet modem, which cube I need to connect the modem to, so I can use the Internet without leaking into the clearnet?
Your Ethernet or Wireless controller (LAN / WiFi) that is using PCI bus. Or it could be USB adapter.
By default your PCI network controllers are attached to sys-net qube that is created by installer by default.
1 Like
I have an internal HDD with ~ 500 MB read/write speed. Is it enough to test Qubes on it? Still want to test Qubes in a safe environment before really use it “in the wild”, but have to choose the drive for the Qubes’ test. At the moment that HDD is the most possible and convenient option.
It’s enough.
1 Like
I tested QubesOS out by running it from a thumbdrive, because that was the only way I could install to that hardware. I knew it would be slow; I just wanted to see how it functioned–what the workflow was and how things interconnected. (Once I knew I wanted it I bought new hardware.)
1 Like
OK, I could install. It’s pretty slow (I suppose because of HDD), but works. There is USB mouse attached and when I entered Qubes it asked me to attach USB mouse to the dom0. As I understand sysnet cube asked this, because that cube was in the window that appeared. Why dirrectly in dom0? I decided do not do this before I ask here. There was written many times that dom0 must be used only for updating and nothing should be attached to it. During installation I checked tick about sysnet using usb cube to make working with modem possible. Is it somehow related (I mean, that it was sysnet who made the request)? So it means all usb devices that I will attach to the computer can connect to the Internet? Is it possible to avoid this?
And how high is risk if I will attach mouse to the dom0 as it asks? Is it better do not use mouse at all and use touchpad instead?
Yes.
Because dom0 needs the mouse input to use it for itself and to pass this input to other qubes.
Yes:
Yes.
If you have multiple USB controllers you can attach one of them to sys-net and use it only for your USB network adapter and attach all other USB controllers to sys-usb to use for mouse or other USB devices.
2 Likes
Thank you very much. Is this the manual how to do this? There also is written:
You said dom0 needs mouse to use it. But how mouse can be used by dom0 if mouse will be attached to sys-usb instead of dom0 so dom0 will not see it?
Yes.
Mouse can be attached from sys-usb to dom0 in the same way as any other USB device can be attached from sys-usb to any other VM.
1 Like
This is not how it works currently. sys-usb can’t attach anything to dom0 for obvious security reasons. In the case of mouse/keyboard, Qubes sends the input through Qrexec using input-proxy-sender and input-proxy-receiver. The sender resides in sys-usb where the mouse and keyboard are, and the receiver runs in dom0 and filters the events sent to it based on a specific list of actions.
2 Likes