Qubes OS Security Hardening Guide – 11 tabs + automated helper script

Qubes OS Security Hardening Guide – 11 tabs + automated helper script

This is a single, interactive HTML file that compiles everything you need to harden Qubes OS 4.3 with Whonix and Kicksecure.

No installation – just download and open in your browser.

Content (11 tabs):
0. Basics – external HDD, Secure Boot, kernel parameters (dom0 vs VMs), full parameter table

  1. Network – WISP+Ethernet only, MAC randomisation, IPv6 disable, architecture diagrams, emergency plans
  2. Whonix Gateways – multiple gateways, bridges (obfs4, Snowflake, meek_azure), stream isolation, layered encryption
  3. Secure Storage – LUKS2/Argon2id, VeraCrypt, double encryption (VC+LUKS), SSD warnings, storage-execution separation
  4. Threat Matrix – 35 threats with clear mitigations (timing attacks, Evil Maid, Cold Boot, fingerprinting, stylometry, etc.)
  5. Amnesic Tmpfs – make logs, cache, and /home reside only in RAM (disappear on shutdown)
  6. RAM Pool – run entire VMs in RAM – complete deniability, no trace after shutdown
  7. Advanced Security – BadUSB, VPN+Tor, encrypted backups, dual boot warning, BusKill, self‑destruct tools (Dead Man’s Switch, immediate nuke), emergency plans, physical protection
  8. Kicksecure – browser fingerprint unification, security‑misc, hide kernel/hardware info
  9. Live Script – Live Mode (OverlayFS) + full comparison table of all ephemeral/secure qube types
  10. Portable Apps – SimpleX (SOCKS proxy method for circuit isolation), Cwtch, OnionShare, Gajim, Element, Signal, Session, Telegram, metadata removal, torsocks
  11. Helper Script – central auto-script.sh that automates most settings (kernel parameters, MAC, Whonix gateways, Kicksecure, RAM Pool, Amnesic Tmpfs, Live Mode, destruction tools, LUKS hardening)

Features:

  • One‑click copy for every command
  • Dark / light modes
  • Progress bar
  • Responsive design (works on desktop, tablet, phone)
  • Arabic + English versions available
  • MIT license (free to use, modify, share)

Live preview (no download required):
https://htmlpreview.github.io/?https://github.com/abdullah127-code/qubes-os-security-/blob/main/q.html

Raw download:
https://raw.githubusercontent.com/abdullah127-code/qubes-os-security-/main/q.html

English version (docs branch):
Preview: GitHub & BitBucket HTML Preview
Download: Integrated Security Blueprint – Qubes OS + Kicksecure (v4.3 Updated 2026)

Warning: This guide is for advanced users. Some procedures (especially destruction tools in Tab 7) can cause permanent data loss. Always take full backups before applying any settings.

Feedback and contributions are very welcome.

4 Likes

It looks like some kind of AI-generated content? The instructions for updating the templates are not even right.

But sure, let’s run this huge script in dom0 :+1:

8 Likes

Why is a newly joined member allowed to create a community guide? It should be limited to member level.

People take community notes seriously, so there should be some level of quality control.

6 Likes

I don’t have a problem with new members (or anonymous accounts) creating community guides. See High quality guides for some discussion about their quality.

Anyway, I think it should not be taken seriously, there is no way to check the content of community docs. We made an experiment without much success here: Display "last checked by" and "last edited by" on Community guides?

5 Likes

Regardless of the topic, there is no user label you can blindly rely on, because users’ criteria and standards can vary. When it comes to security issues in particular, you won’t be satisfied unless you understand what you’re doing. (Leaving aside the illusion of security by shifting trust.)

4 Likes

Sure, here is an assessment:

It would be better to replace most of the script with native Salt formulas, so you can easily declare what state you want your VMs to be and makes the entire repository maintainable for one person.

6 Likes

What you said is correct. I used some things from artificial intelligence, mostly summaries from websites. As you know, AI cannot create such a file from scratch. Likewise, I didn’t document anything except after testing it out.
Also, all the translation was done using artificial intelligence because my native language is Arabic.

1 Like

You are correct. This is for an intermediate level at the very least, and I had an explanation but I didn’t publish it because it was in my native language, Arabic, and the Arabic community is not interested in these things.

1 Like

The script does not make services virtual by default except after the user’s consent. Likewise, everything in it I tested several times before documenting.

Regarding the template names, I thought about making it choose the latest template, but since new templates will come out after about a year, I will update them as soon as they are released, or I will make it choose them automatically. As for kernelopts, you are correct, and there are many of them, but they are for those who want them. Regarding template installation, I mentioned the templates that exist by default. As for the destruction feature, it is for emergencies and is derived from ‘buskill’ with some improvements. The live mode is taken from this community, and I only removed zram. Many thanks to you.

If you have any feedback, please write it, I would be very grateful to you.

Note: I am not an expert, I’m an intermediate user. This guide was originally written for a friend of mine, and then I decided to translate it and publish it.

1 Like

Using AI in contributions

2 Likes

Even if it’s just for translation

For your information, this guide took nearly four months of my time. As for summarizing from websites, I did it first to learn. And I don’t think the site would forbid, for example, a user from using AI to design HTML

1 Like

Looks like you did a lot of work there, thanks for your efforts, it will take a while to unpack. Why did you not just do git or codeberg?

1 Like

Because it was initially an educational guide for my friend, and I didn’t think about publishing it.

1 Like

There are some good things in it I can see already. It just makes it easier for collaboration, help, fine tuning etc otherwise we can just comment here which makes it difficult.

1 Like

Thank you. I will try to do what you suggested, God willing

1 Like

After months of work, I’ve published the Qubes OS Security Hardening Guide (11 tabs + helper script).

Repository: abdullah127/qubes-os-security-hardening-guide: Hardening Guide – 11 tabs + automated helper - Codeberg.org

Inside you’ll find the full interactive HTML guide and the auto-script.sh helper script.

Issues and pull requests welcome.

1 Like

Thank you for your suggestion. You were absolutely right – using Git and Codeberg makes the guide easier to review and maintain.

I have now created a public repository:

The HTML guide is there, and anyone can open issues or submit pull requests. I hope this makes the work more useful for the community.

Thanks again for the constructive feedback.

4 Likes

Thanks for sharing your work :+1:

1 Like

Sorry but I’m now very suspicious about potential AI contributions. Some parts (i.e. updating templates) are very generic and don’t follow the official way so I thought it was generated. It turns out you spent some time on this, sorry for my wrong assumptions.

4 Likes

Don’t apologize, honestly. Artificial intelligence is exhausting and sometimes hallucinates. I was trying to find the error that AI causes in HTML design, and I would spend hours just to figure out where it made a mistake. Sometimes it even tells you that updating dom0 requires using ‘sudo apt update’. The original purpose of AI is just to be an assistant.

2 Likes