QubesOS and the Cloud Bare Metal Instance: A Proposal

General Discussion
1

As a cloud engineer who personally use QubesOS, I would like to say I love this ingenious system dedicated for security.

I noticed that major CSPs (Cloud Service Providers) introduce OS images for their virtual machine / compute service. For example, on AWS they let customers to pick between Ubuntu, Amazon Linux, Windows Server, etc. However, I didn’t see QubesOS at least in the AWS AMI list. I wonder if the adoption of the cloud is in itself, runs contrary to the principle of QubesOS – because “migrating to the cloud” means literally giving up some control.

Despite this, there is one cloud use case that may benefit or even facilitate the population of QubesOS: bare metal instances. I don’t know if QubesOS is in CSPs’ OS image list, but maybe we should somehow promote the idea of “QubesOS for bare metal” to those CSPs? If QubesOS is already in their image list, it’s fine and please let me know.

1 Like
2

One large issue with that is the fact that it would require nested virtualization, support for which varies between CSPs (last time I checked, which was a long time ago) and causes performance issues for guests.

2 Likes
3

Okay, mind shedding some light on the nested virtualization?

1 Like
4

Let me Google… no, DuckDuckGo this for you: here (onion) or here (normal web).

2 Likes
5

The largest issue is that if you don’t control the CPU’s Ring 0, you can’t have any expectation of privacy or security.

1 Like
6

All above, plus: System requirements — Qubes OS 4.3.1 documentation and How to install and use Qubes OS inside VirtualBox

I’d be interested to see how useful virtualizing Qubes for automatically testing certain aspects of Qubes without bare-metal. And I mean only certain aspects like “do the salt scripts not fail in a fresh install?” or “do the upgrade from 4.3 to 4.4 not fail”? Like a first-pass type of test that can be executed in a few minutes and created from scratch. Won’t replace bare-metal testing.

I would argue that not controlling the hardware being the largest issue to privacy. As far as the x86 VM is concerned, it control’s ring 0 (a virtual one) and privileges are respected inside the VM; off course, it’s all virtualized by the hypervisor and correct as long the hypervisor correctly implement such controls, but is just an illusion of hardware control. It would be my guess.

2 Likes
7

I recommend checking out https://openqa.qubes-os.org/ and GitHub - QubesOS/openqa-tests-qubesos: OpenQA tests for QubesOS · GitHub (in particular [openqa_vm_setup.md](openqa-tests-qubesos/openqa_vm_setup.md at main · QubesOS/openqa-tests-qubesos · GitHub)) to see, how the tests are implemented and what modifications are being done to the target.

3 Likes
8

The idea of “Qubes OS in the cloud” is attractive at first due to the rather difficult situation of finding suitable, compatible and best cheap hardware for running Qubes on the endpoint. The Qubes Air concept by Rutkowska went into that direction of Qubes in the cloud quite a bit, from my understanding.

Server hardware has some fancy security features that endpoints don’t have. I would argue that running Qubes in the cloud would not be a complete catastrophe trust-wise because of that, but: You still need some sort of endpoint to access your Qubes instance (e. g., an iPad), and that endpoint also limits the security of your Qubes instance.

You would get rid of the burden of looking for compatible hardware but you would never get rid of the burden of keeping your endpoint secure.

Edit: I see some potential here. A newly bought iPad solely used for Qubes-related work and used in lockdown mode could be sufficiently secure to do a variety of tasks on your Qubes cloud instance.

Secondly, cloud Qubes would allow people to give Qubes a spin in a much easier way. Imagine a “Try” button on the Qubes homepage where people can jump into an instance right away and test it for 10 minutes :exploding_head: :heart_eyes:

3 Likes
9

Thanks! It’s just, given that you must be an insider who knows the latest trend of CSPs, I hoped that you can give more details on what you saw in those organizations.

1 Like
10

At my previous workplace we considered this option as a replacement for vSphere and vCenter from Broadcom. But the question quickly fell away, for the following reasons:

  1. There’s no one to hold responsible in the event of a failure.
  2. Regulator requirements: while large companies have every possible quality and security certificate, here there isn’t a single one.
  3. It’s hard to find technical staff and/or train them: we reviewed candidates CVs over years and couldn’t find even 5 people with serious Xen knowledge at a technical director or tier-3 level.
  4. Incompatibility with a number of distributions, clients mostly buy Windows-based VPS. Windows runs on QubesOS in such a way that it can’t be sold to a client.
  5. The need to install commercial products that can limit support, refuse, or charge extra in the case of support for VMs running in a QubesOS-based cloud environment.
1 Like