Qubes OS Security Hardening Guide – 11 tabs + automated helper script

First of all, I didn’t run any script, I did it manually.

What does a parameter called X even do?

Not literally! X as an replacement/variable of what @abdullah wrote as kernel parameters for dom0: GitHub & BitBucket HTML Preview

Of course, I can’t save terminal outputs and save them to a USB drive from dom0 so I had to take snapshots.

Wait, any other VM is broke too? Or just tor?

What do you make of them?

I expected there to be an issue because for snowflake to work, some changes in the had to be made and maybe this broke your tor connection.
Stupid question.

# ========
# 3. Create Whonix Gateways
# ========
whonix_gws() {
    for g in "sys-whonix-A:red" "sys-whonix-B:blue"; do
        n=${g%:*}; l=${g#*:}
        if ! qvm-ls | grep -q "$n"; then
            qvm-create --class AppVM --label "$l" --template whonix-gateway-18 "$n"
            qvm-prefs "$n" provides_network true
            ok "$n created"
        else
            info "$n already exists, skipping"
        fi
    done
    pause
}

It does not define a net qube. Is your sys-whonix A even connected to sys-firewall?

As you didn’t directly answered

Do you use Snowflake?

I assume that you don’t get a tor connection at all.

1 Like

Huh? I thought that’s normal for Qubes? How am I supposed to save any terminal output from dom0 considering I can’t copy and paste to or from dom0?

Yes. They’re all connected to sys-firewall.

No I didn’t, not at first. But as soon as you asked me that, I did switch to Snowflake to see if it made any difference. It didn’t.

@abdullah, you hearing all this?

1 Like

Can you rule out an issue with whonix-gateway-18? Try creating a new sys-whonix manually.

1 Like



I created a new sys-whonix and it’s running a bootstrap test as I speak. As of this writing, it’s at 71%.

@abdullah, I inspected the RAM Pool scripts and I’ve just been given some pause.



Does setup-ram-pool.sh actually set up a seperate RAM pool from varlibqubes where the Live mode script puts it’s RAM DVMs? Why?

And I thought create-ram-vm.sh lets you customize a RAM VM as you create it. Instead it just sets a template, name, etc. for you. Although I could still edit the script before running it but still…

Ah. @Schnur As I was writing this, the Tor progress bar was at around 71% but when I checked again, it’s back around 20 to 30%. That’s the problem I had before with Sys-Whonix-A.

1 Like

And here it is.

On an off-note, previously, for some reason I wasn’t able to start up any apps on untrusted-ram-dvm so I was trying to reproduce the error to take screenshots but… By some miracle, I was able to run a file explorer and plug in my USB drive. Although…


untrusted-ram-dvm did not show up in sys-usb’s dropdown menu so I had to start the qube myself before I could plug the flash drive in.

1 Like

I’ve gone through the script and found nothing tampering with the template.
Try reinstalling the template in the template manager. Safe any configs if needed.

Btw @abdullah, why are there cyrillic characters?

Создание ephemeral-whonix-dvm

1 Like

@ledOnion Off topic but in order to more easily take screenshots without phone:

sudo qubes-dom0-update gnome-screenshot (idk if xfce4 provides one, this is what I use tbh)

then just run as user in a terminal

gnome-screenshot

then it will create a file Screenshot-.png or so

qvm-copy-to-vm <browser-for-qubes-forum-vm> Screenshot[tab]

:wink:

3 Likes

Heads up @abdullah!
@linuxuser1 's about to update his(?) Live Mode script soon.

2 Likes

Check the kernelopt nullification in sys-whonix

1 Like

Check the kernelopt nullification in sys-whonix

qvm-prefs sys-whonix kernelopts ""
1 Like

I copied the original script from @linuxuser1 and then pasted it as is, without any modifications.

1 Like

Hey @abdullah.
Since there hasn’t been an update to your script, incorporating @linuxuser1’s Live Mode updates, I decided to just copy and paste his script into yours myself and give it another test run.

It looks like everything ran just fine.

2 Likes

About a week ago, I ran yet another fresh install of Qubes 4.3.1 and ran the script once more, albeit modified with the latest updated version of @linuxuser1’s Live Mode script at the time.

Today, I booted it up (without a clear idea what to do next) on Persistent Mode and decided, on the fly, to give it a test run.

I found that while sys-Whonix’s Tor Control Panel isn’t accessible on the panel for some reason (right clicking the icon lists sys-firewall, sys-usb and sys-net but no sys-whonix), I can access it from the app menu and found it works fine and successfully connects to Tor through the obfs4 and snowflake bridges.


However, even though I ran the Live Mode script I added in, I couldn’t find the untrusted-ram-dvm VM that it usually creates.

I plugged in my USB storage drives but, for some reason, sys-usb isn’t picking them up yet I was able to connect and use a USB mouse just fine.

I brought up sys-usb’s sdwdate logs just in case.


Last of all, while I was running the script last week, the folders created from the Create RAM Pool Scripts and Destruction tools options have locks over their desktop icons, which I’m sure didn’t happen before.

1 Like

Actually, I’m beginning to discover the problem with attaching storage flash drives might not be sys-usb’s fault but something gone wrong with my laptop itself.

Edit 15/8/26: Yeah. USB flash drives are working again. All I needed to do was remove the battery, drain away any residual power by holding the power button for a minute and then everything’s back to normal.

I thought it was a problem with sys-usb but that was a false alarm.
Sorry about that.

1 Like