QubesOS Hardening

User Support General
1

Hello.

Are there any QubesOS hardening guides or tips or are the default settings hardened enough?

what do you recommend

2 Likes
2

I think Qubes achieves to be a reasonably secure OS by focusing on compartmentalization while giving up on “hardening” stuff.

See:

So I would say it is not “hardened” enough but who cares? :slight_smile:

3 Likes
3

any guides or tips to harden it?

1 Like
4
4 Likes
5

Dom0 is already very reasonably hardened. I’d advise against doing any significant “hardening” modifications within dom0. However, you can still harden the templates themselves, I suppose. But then again, what could constitute “hardening” in your case depends entirely on your threat model.

3 Likes
6

Hardening against what?

Tell me your threat model and I tell you, as good as I can, how to harden your Qubes OS installation.

2 Likes
7

@Kubeis The best guides (scripts) for max hardening

2 Likes
8

I think you can just use a harden template and not have to reinvent the wheel.

For example you can use the Whonix-ws template, which has strong hardening already, but it’s focused on anonymity.
However, if you want a heavily harden template, then go with Kicksecure, which is very locked down, but hard to work with, as you have to set a lot of permissions, and you even have to boot to a different kernel just to run sudo.

Both are available in the Template Manager for you to download.

3 Likes
9

Unikernels are cool and I like them :]

IMO weakest aspect of Qubes is that despite all efforts of the developers compartmentalizing things has notable friction. Check out stuff like Quick Quality-of-Life Improvements , write your own scripts, figure out you own security policy and find a way to reliably enforce it (e.g. never move things from less trusted to more trusted domains, never open files in vaults, etc. - what is allowed to do and how and in what situations and why)

Customized qrexec policies, passwordful root and MAC could be useful for further hardening but only in some circumstances.

I bet I’m forgetting some stuff at this point but you will get the hang of it over time.

p.s. Here are some related links I've stumbled upon recently:
2 Likes
10

By hardening I would first decide what to harden against. If you’re looking to harden the OS software further, then perhaps install a templateVM, which has a hardened kernel and packages (especially the browser) compiled with various hardening flags? Alpine linux comes to mind.

1 Like