[qubes-users] Need help after a failed in-place upgrade attempt

Mailing Lists qubes-users
1

Hello community,

I tried to upgrade my Qubes OS system from 4.1.2 to 4.2.0 using the “qubes-dist-upgrade” script.

The upgrade failed - and - now the system is in a ‘weird’ state.

None of the Fedora- or Debian-based VM have ‘external / public’ network access anymore.

The ‘anon-whonix’ VM however still does have ‘external / public’ network access - and - the update of templates through the Qubes Updater is also still working …

I did perform a backup a backup of all VMs before starting the script - but - would like to skip a new install if possible ! - Any advice / ideas ?

With kind regards,

Viktor

2

Hi

I tried to upgrade my Qubes OS system from 4.1.2 to 4.2.0 using the
"qubes-dist-upgrade" script.

The upgrade failed - and - now the system is in a 'weird' state.

None of the Fedora- or Debian-based VM have 'external / public'
network access anymore.

The 'anon-whonix' VM however still does have 'external / public'
network access - and - the update of templates through the Qubes
Updater is also still working ...

OK, I am not an expert on THIS question. Some general remarks: the
network card seems to work, right? So you need to check where the chain
breaks.

- go to sys-net (open terminal via widget) type ping 8.8.8.8 and see if
you come out

- go to sys-firewall (terminal via widget) and do the same.

if these two work, and an app-vm has no network, its config got lost.
Look at network settings of the corresponding appVM. It should be
sys-firewall in std setting, apart anon-whonix, of corse which uses
sys-whonix.

3

Hello ‘Haaber’,

Hi

I tried to upgrade my Qubes OS system from 4.1.2 to 4.2.0 using the
“qubes-dist-upgrade” script.

The upgrade failed - and - now the system is in a ‘weird’ state.

None of the Fedora- or Debian-based VM have ‘external / public’
network access anymore.

The ‘anon-whonix’ VM however still does have ‘external / public’
network access - and - the update of templates through the Qubes
Updater is also still working …

OK, I am not an expert on THIS question. Some general remarks: the
network card seems to work, right? So you need to check where the chain
breaks.

  • go to sys-net (open terminal via widget) type ping 8.8.8.8 and see if
    you come out

Working.

  • go to sys-firewall (terminal via widget) and do the same.

Working as well.

if these two work, and an app-vm has no network, its config got lost.
Look at network settings of the corresponding appVM. It should be
sys-firewall in std setting, apart anon-whonix, of corse which uses
sys-whonix.

Not working. - I changed the settings from “default (sys-firewall) (current)” to “sys-firewall” in one App-VM …

An additional / new info is, that an update check for ‘dom0’ does no longer work !

I did not explicitely try that before …

Does it make sense to try to just restore ‘dom0’ as a start ?

With kind regards,

Viktor

4

Hello community,

Hi

I tried to upgrade my Qubes OS system from 4.1.2 to 4.2.0 using the
“qubes-dist-upgrade” script.
…

OK, I am not an expert on THIS question. Some general remarks: the
network card seems to work, right? So you need to check where the chain
breaks.

  • go to sys-net (open terminal via widget) type ping 8.8.8.8 and see if
    you come out

Working.

  • go to sys-firewall (terminal via widget) and do the same.

Working as well.

if these two work, and an app-vm has no network, its config got lost.
Look at network settings of the corresponding appVM. It should be
sys-firewall in std setting, apart anon-whonix, of corse which uses
sys-whonix.

Not working. - I changed the settings from “default (sys-firewall) (current)” to “sys-firewall” in one App-VM …

An additional / new info is, that an update check for ‘dom0’ does no longer work !

I did not explicitely try that before …

Does it make sense to try to just restore ‘dom0’ as a start ?

Any feedback - or - any other ideas what I could try ?

With kind regards,

Viktor

5

Hi

Hi

I tried to upgrade my Qubes OS system from 4.1.2 to 4.2.0 using the
“qubes-dist-upgrade” script.
…

OK, I am not an expert on THIS question. Some general remarks: the
network card seems to work, right? So you need to check where the chain
breaks.

  • go to sys-net (open terminal via widget) type ping 8.8.8.8 and see if
    you come out

Working.

  • go to sys-firewall (terminal via widget) and do the same.

Working as well.

if these two work, and an app-vm has no network, its config got lost.
Look at network settings of the corresponding appVM. It should be
sys-firewall in std setting, apart anon-whonix, of corse which uses
sys-whonix.

Not working. - I changed the settings from “default (sys-firewall) (current)” to “sys-firewall” in one App-VM …

An additional / new info is, that an update check for ‘dom0’ does no longer work !

all updates go via tor network (sys-whonix) by default. You could click on the blue qube widget → sys-wonix → run terminal and see if sys-whonix has network. But I guess not. Here is why:

https://www.qubes-os.org/doc/firewall/

I wild-guess that you are in a “half-state” where one part of the system expects iptables, another one nftables …

Did you download / start to download new (debian/fedora) Templates or are they the “old” ones?

I did not see any other user jump to your help, and I am not good enough to fix that alone for you. So honestly, at your place I would

(1) backup data (again)

(2) extract the list of manually installed packages in each of your templates and stock them on your backup drive

(“apt-mark showmanual > manual.packages.list” in a terminal is your friend, no root priv needed)

(3) re-install a clean 4.2

(4) replay your manual installs of packages in your templates:

"cat manual.packages.list | apt-get install " or something of this type should work (run as root)

(5) restore your data.

It’s a pain and takes half a day, but I fear that it is, at the end of the day, faster than any other solution…

good luck!

6

Hello ‘Haaber’,

7

Hello ‘Haaber’ & Qubes OS community,

8

Hello ‘Haaber’ & Qubes OS community,

…

…

all updates go via tor network (sys-whonix) by default. You could click on the blue qube widget → sys-wonix → run terminal and see if sys-whonix has network. But I

It took much longer due to private reasons - but - I can report that I was able to fully recover from the backups !

What I did different than suggested was that I started with a clean re-install of Qubes OS 4.1 …

Let’s close this thread !