[qubes-users] Networking with debian10-minimal instead of fedora-33

mailinglist_bot · June 30, 2021, 2:54pm

Hi, I am trying to make work the sys-net and sys-firewall under debian-10-minimal template, instead of fedora-33, but without success. Fedora is annoying with its updates and also I would like to decrease the exposure to the complexity of fedora-33 full template wherever possible.

I followed these guides regarding networking:

github.com

Qubes-Community/Contents/blob/master/docs/privacy/anonymizing-your-mac-address.md


Anonymizing your MAC Address
============================

Although it is not the only metadata broadcast by network hardware, changing the default [MAC Address](https://en.wikipedia.org/wiki/MAC_address) of your hardware could be [an important step in protecting privacy](https://tails.boum.org/contribute/design/MAC_address/#index1h1).
Currently, Qubes OS *does not* automatically "anonymize" or spoof the MAC Address, so unless this gets implemented by default you can randomize your MAC Address with the following guide.


## Upgrading and configuring Network Manager in Qubes

Newer versions of Network Manager have options for randomizing MAC addresses, and can handle the entire process across reboots, sleep/wake cycles and different connection states.
In particular, versions 1.4.2 and later should be well suited for Qubes. Qubes R4.0's default sys-net should have 1.8.2-4 by default.  
However, use of the NetworkManager GUI to set these options is **unreliable** - there are numerous reports of changes not being saved for particular cards or interfaces.
You should check carefully that any settings you make in the GUI are saved, before relying on this method.
If the settings are not saved, you can use the method described below using a config file.


Network Manager 1.4.2 or later is available from the Fedora 25 repository as well as the Debian 10 repository.

Check that Network Manager version is now at least 1.4.2:

This file has been truncated. show original

I installed following packages into debian-10-minimal template and based the sys-net and sys-firewall on it:

qubes-core-agent-networking qubes-core-agent-dom0-updates qubes-core-agent-network-manager qubes-core-agent-passwordless-root nano qubes-mgmt-salt-vm-connector qubes-core-agent-nautilus nautilus gnome-terminal

Once I change the sys-whonix and sys-firewall, the network icon doesnt show any Wi-Fi Networks, only ethernet.

Any workaround?

mailinglist_bot · June 30, 2021, 3:14pm

'taran1s' via qubes-users:

Hi, I am trying to make work the sys-net and sys-firewall under debian-10-minimal template, instead of fedora-33, but without success. Fedora is annoying with its updates and also I would like to decrease the exposure to the complexity of fedora-33 full template wherever possible.

I followed these guides regarding networking:

Minimal templates | Qubes OS
Contents/docs/privacy/anonymizing-your-mac-address.md at master · Qubes-Community/Contents · GitHub

I installed following packages into debian-10-minimal template and based the sys-net and sys-firewall on it:

qubes-core-agent-networking qubes-core-agent-dom0-updates qubes-core-agent-network-manager qubes-core-agent-passwordless-root nano qubes-mgmt-salt-vm-connector qubes-core-agent-nautilus nautilus gnome-terminal

Once I change the sys-whonix and sys-firewall, the network icon doesnt show any Wi-Fi Networks, only ethernet.

Sorry, sys-net and sys-firewall, not sys-whonix of course.

slcoleman · June 30, 2021, 10:54pm

Hi, I am trying to make work the sys-net and sys-firewall under
debian-10-minimal template, instead of fedora-33, but without success.
Fedora is annoying with its updates and also I would like to decrease
the exposure to the complexity of fedora-33 full template wherever
possible.

I don’t have any suggestion for the Debian issue, but what I do to limit the updates is clone the fedora-33-minimal to a template called fedora-33-net, strip out any apps not needed, and then use that for my networking AppVM’s. With fewer apps there are far fewer updates to deal with.

dominic · July 1, 2021, 2:27pm

On Wednesday, June 30, 2021 at 6:55:07 PM UTC-4 stevenlc...@gmail.com wrote:

On Wed, Jun 30, 2021, 10:55 AM ‘taran1s’ via qubes-users <qubes…@googlegroups.com> wrote:

Hi, I am trying to make work the sys-net and sys-firewall under
debian-10-minimal template, instead of fedora-33, but without success.
Fedora is annoying with its updates and also I would like to decrease
the exposure to the complexity of fedora-33 full template wherever
possible.

I don’t have any suggestion for the Debian issue, but what I do to limit the updates is clone the fedora-33-minimal to a template called fedora-33-net, strip out any apps not needed, and then use that for my networking AppVM’s. With fewer apps there are far fewer updates to deal with.

Hi,

I use Debian 10 for sys-net. It works great.

Here are the steps that works for me.

1 - Install the minimal template for debian 10

2 - Update the template

3 - Install the qubes-core-agent-passwordless-root package (if you want)

4 - Shutdown the template

5 - Create a clone of the template (deb-10-sys)

6 - Start deb-10-sys

7 - Install the following package: qubes-core-agent-networking qubes-core-agent-network-manager pciutils

8 - Shutdown deb-10-sys

9 - Change the template for sys-net to deb-10-sys (after shutting down all qubes) and start sys-net

10 - If everything works (wired and wireless) you are good to go if not

11 - Start xterm in sys-net

12 - Use lspci to see the info of the card that is not working

13 - Search the web to see which firmware needs to be installed in debian to support that card

14 - Start deb-10-sys, install the firmware and shutdown deb-10-sys

15 - Restart sys-net - everything should work

I know I have use debian for firewall and USB in the past but went back to Fedora for USB because of some issue (don’t even remember what issue) and I am now trying Mirage for firewall.

Hope it helps!

D.

Sven · July 1, 2021, 11:31pm

If your WiFi is Intel just install the "firmware-iwlwifi"

one7two99 · July 11, 2021, 8:23pm

Hello,

Steve Coleman <stevenlcoleman42@gmail.com> schrieb am Do., 1. Juli 2021

I don’t have any suggestion for the Debian issue, but what I do to limit the updates is clone the fedora-33-minimal to a template called fedora-33-net, strip out any apps not needed, and then use that for my networking AppVM’s. With fewer apps there are far fewer updates to deal with.

Not sure if there is a big benefit using Debian over Fedora 33 but I would like to hear if there is a benefit.
I am using my own “minimalized” Templates which are build from a fedora-33-minimal template.
You can find more about my templates here:
https://github.com/one7two99/my-qubes/blob/master/my-qubes-templates/20%20template-sys-vms.md

The template will work for sys-net / sys-firewall / sys-usb and also for a vpn-qube.
I don’t see that updating my fedora-based template takes much longer than my debian templates.

One7two99

Sven · July 12, 2021, 12:24am

Personally I like that once I setup a Debian qube, it'll run and receive security updates for many years. I haven't looked up how quickly a Fedora qube EOLs but it 'feels' like year, maybe 18 months.

It kind of depends what you want from your setup. I've reached a point where I have plenty of stuff to do and don't want to deal with things like updates and changing interfaces any more than necessary. Don't get me wrong: I thoroughly enjoyed the learning curve and setting everything up, but now that it works I enjoy not having to think about it all the time.

/Sven