Are there steps that can be taken to harden Qubes templates for Debian and Fedora? Things like exploit mitigations, kernel and boot flags, app sandboxing, apparmor, SELinux, etc. I don’t see any documentation that talks about this. Was looking to follow this guide https://madaidans-insecurities.git…

Creating templates themselves is the best hardening one could imagine, thanks to the Qubes OS concept of a security-by-isolation (or security-by-compartmentalization). [image] Security design goals Qubes OS implements a security-by-isolation (or security-by-compartmentalization) approac…

Is there any kind of package available in the Qubes repo that can assist with the creation of templates or the hardening of templates? I mean something that can be installed via the Yum Extender (DNF)

[image] enmus: Creating templates themselves is the best hardening one could imagine It has some flaws though: Templates | Qubes OS

Which is why we call it “reasonably secure”, since hardly any other could fall into this category :slight_smile:

How to harden a template is that a guide on how to do it?

It depends on why you want to harden it. What are you defending against? What is your threat model?

Let’s assume the highest possible threat model just for sake of example.

This is not so simple. Do you expect that someone can come to your home and take your machine and read your data? If yes, you probably should use TAILS , not Qubes. Do you expect that someone can infect your BIOS while you leave your computer unattended? Then, you should use Heads or AEM . Do you thi…

You are describing side-channel attacks performed by spooks. Tempest (electromagnetic) monitoring, audio/video monitoring, evil maid attacks, and other firmware level attacks like flashing SPI chip or attacks like USB, SD card, Ethernet, etc. Don’t forget side channels like insecure smart tvs, la…

Qubes OS Forum

Template Hardening

User Support

fsflover February 23, 2022, 9:25am 4

My personal experience of attempt to harden qubes VM General Discussion

Just saw this discussion More practical security for Qubes (and more realistic threat model) - #42 by 51lieal @arkenoi so I would like to share some of my experience on harden qubes VM. Basically my opinion is qubes is fantastic about compartmentalization, but abandon in VM security completely is a bad idea. Even for a amateur user like me I can feel the VM security is quite terrible. It seems the developer’s idea is to use seperate VM for every activity, so it is irrelevant to secure each sing…

Hardening Qubes OS? General Discussion

I was wondering whether anyone has any tips on how to further ‘harden’ Qubes OS. I am currently running all my sys-* as disposable vm’s. These sys* vm’s are all based on fedora-33-minimal. I also use 1 appvm/standalone per program. Any further tips would be appreciated!

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled