Qvm-connect-tcp to Kicksecure 18 distro-morphed from debian-13-minimal

[gasull]

I cannot use qvm-connect-tcp to connect to a VM which template is Kicksecure 18 distro-morphed from debian-13-minimal.

Is this expected? Does Kicksecure or minimal templates disable qvm-connect-tcp?

When I change the template of the VM to debian-13-xfce, I can qvm-connect-tcp into it without problems.

[Atrate]

Do you get any errors or anything? What steps did you take?

[ephile]

@gasull

Does Kicksecure or minimal templates disable qvm-connect-tcp?

I suspect it has to do with Kicksecure, since I have never had any trouble using qvm-connect-tcp with debian-13-minimal qubes. Even though it doesn’t touch on Kicksecure, when it comes to digging into the issue, you may find something useful in the following thread:

Understanding how qvm-connect-tcp works under the hood

qvm-connect-tcp plays an important role in Qubes, so I’m trying to understand it more fully. In particular, I’m confused about how it works to expose a service with a simple port binding. Any insight into the following would be appreciated and hopefully of value to the forum at large. In general, exposing a service with socat in a server-client setup would look something like user@server$ socat TCP-LISTEN:55555,reuseaddr,fork,bind=server TCP:localhost:55555 enabling user@client to call on the…

[gasull]

@Atrate

Do you get any errors or anything? What steps did you take?

Yes, journalctl --follow shows this error in the VM that should receive the qvm-connect-tcp connection initiated by another VM:

Apr 30 05:15:38 sys-something qrexec-agent[3178]: 2026-04-30 05:15:38.462 qrexec-agent[3178]: exec.c:589:qubes_tcp_connect: Connecting to 127.0.0.1:1080
Apr 30 05:15:38 sys-something qrexec-agent[3178]: 2026-04-30 05:15:38.462 qrexec-agent[3178]: exec.c:623:qubes_tcp_connect: connect: Connection refused
Apr 30 05:15:38 sys-something qrexec-agent[3178]: 2026-04-30 05:15:38.462 qrexec-agent[3178]: qrexec-agent-data.c:242:handle_new_process_common: failed to spawn process