[qubes-users] Trezor in Qubes

mailinglist_bot · August 26, 2021, 2:27pm

Hello all, I would like to start to use Trezor with my qubes. I would like to follow this guide here Qubes OS - Trezor Wiki. My intention is to use the Trezor HW wallet in a anon-whonix AppVm with Trezor Suite qube through Tor. I run qubes on X230 Nitropad.

I would like to check if the guide to install the Trezor Bridge and Udev rules in the sys-usb (see the official Trezor guide) is advised by qubes community or is it good practice not to install anything in the sys-usb and instead install the packages (bridge, udev rules and suite) in the target anon-whonix AppVM.

mailinglist_bot · August 27, 2021, 12:08pm

It should be fine. See my pull request for step by step instructions:

github.com

Qubes-Community/Contents/blob/3e1785a11e90b52e086fb8b3b246e5c2de7faca5/docs/common-tasks/setup-trezor-cryptocurrency-hardware-wallet.md

## Setting up a Trezor cryptocurrency hardware wallet in Qubes

using a Fedora-based sys-usb VM and a Whonix WS-based application VM:
- navigate to the [Trezor instructions](https://wiki.trezor.io/Qubes_OS) page and read them. They are more frequently updated than this document.
- in dom0:
    `sudo vim /etc/qubes-rpc/policy/trezord-service`
add this line:
        `$anyvm $anyvm allow,user=trezord,target=sys-usb`
replace `sys-usb` with `disp-sys-usb` if you are using a disposable sys-usb

- in the sys-usb VM, or for disp-sys-usb, the VM on which it is based
  (in both cases, assumed to use a fedora-3x template):
	`sudo mkdir /usr/local/etc/qubes-rpc`
	`sudo vim /usr/local/etc/qubes-rpc/trezord-service`
	and add this line to trezord-service:
	`socat - TCP:localhost:21325`
- in the whonix-based application VM:
    `pip3 install --user trezor`
    `sudo vim /rw/config/rc.local`
	add this line (note the "&" at the end):

This file has been truncated. show original

mailinglist_bot · August 30, 2021, 11:02am

tetrahedra via qubes-users:

mailinglist_bot · September 3, 2021, 7:54am

tetrahedra@danwin1210.me:

Hello all, I would like to start to use Trezor with my qubes. I would like to follow this guide here https://wiki.trezor.io/Qubes_OS. My intention is to use the Trezor HW wallet in a anon-whonix AppVm with Trezor Suite qube through Tor. I run qubes on X230 Nitropad.

I would like to check if the guide to install the Trezor Bridge and Udev rules in the sys-usb (see the official Trezor guide) is advised by qubes community or is it good practice not to install anything in the sys-usb and instead install the packages (bridge, udev rules and suite) in the target anon-whonix AppVM.

It should be fine. See my pull request for step by step instructions:
add Trezor setup cheat-sheet by tetrahedras · Pull Request #145 · Qubes-Community/Contents · GitHub
Contents/docs/common-tasks/setup-trezor-cryptocurrency-hardware-wallet.md at 3e1785a11e90b52e086fb8b3b246e5c2de7faca5 · Qubes-Community/Contents · GitHub

Thank you for the guide. I tried to follow the official guide on trezor wiki, abstaining from fedora a bit more, but still erroring.

To your guide. The last 4 lines:

copy to fedora-3x

in fedora-3x sudo rpm -i /path/to/trezor.rpm

...are to be done in the fedora-3x template, right? Will it work on fedora-33-minimal too, or it needs to be full template?

All done, but I wasnt able to find any signed hash of the bridge or something and so I get this error:

[user@fedora-33-min-trezor ~]$ sudo rpm -i trezor-bridge-2.0.27-1.x86_64.rpm
warning: trezor-bridge-2.0.27-1.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID b9a02a3d: NOKEY
package trezor-bridge-2.0.27-1.x86_64 does not verify: Header V4 RSA/SHA256 Signature, key ID b9a02a3d: NOKEY

mailinglist_bot · September 4, 2021, 9:05pm

Thank you for the guide. I tried to follow the official guide on trezor wiki, abstaining from fedora a bit more, but still erroring.

To your guide. The last 4 lines:

copy to fedora-3x

in fedora-3x sudo rpm -i /path/to/trezor.rpm

...are to be done in the fedora-3x template, right? Will it work on fedora-33-minimal too, or it needs to be full template?

I don't know.

All done, but I wasnt able to find any signed hash of the bridge or something and so I get this error:

[user@fedora-33-min-trezor ~]$ sudo rpm -i trezor-bridge-2.0.27-1.x86_64.rpm
warning: trezor-bridge-2.0.27-1.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID b9a02a3d: NOKEY
package trezor-bridge-2.0.27-1.x86_64 does not verify: Header V4 RSA/SHA256 Signature, key ID b9a02a3d: NOKEY

Weird. You have to install the Trezor verification key. I had to do this
the first time I installed, but after re-imaging my system, it wasn't
necessary on the most recent install, so I took the section out of my
notes. Unfortunately I don't remember what the steps were to install the
key!