Ultimate Guide on Using Trezor on Qubes

[smrtak]

All Trezor devices have been tested and work without issues.

Did you follow all instruction as specified in how-to? Was there anything confusing or incorrect? Where did you get stuck or lost?

When troubleshooting issues, this link was very useful: Installing Trezor Suite on Linux

Make sure you use correct UDEV rules and verify your sys-usb with cmd: systemctl --version
It needs to return value higher thatn 256.4

sys-usb template needs to have these extra pkgs installed: trezor libfuse2 socat

[d-arcy]

It’s now working. I’ve tested Qubes with a big variety of hardware wallets and they all work out of the box, no need to create a custom sys-usb - except for Trezor Model T and Trezor Safe (3 and 5), and only if you want to use them with browser based wallets (that includes Trezor Suite).

It looks like this is because most hardware wallets use HID protocol for USB communication, which is easy to passthrough to virtual machines in Qubes. Model T and Safe models use WebUSB, and it looks like they don’t like how Qubes passthrough handles WebUSB devices. Electrum seems to be able to communicate with model T and Safe models via HID.

Long story short, after following @smrtak guide Model T and Safe models work with Trezor Suite and other browser wallets. But I do believe the RPC policies are overly permissive, so I suggest to change those to make sure only the TrezorSuite VM can connect to trezord-service.

[smrtak]

thx for feedback
NOSTR note has been edited + new reply with proposed restriction to RPC policy (for clients that don’t support edited posts)

[d-arcy]

Thanks! I didn’t realize there was a comment with modified RPC policies - when clicking the link in the thread I can only see the original post with the very permissive RPC policy.

Anyway, I see that you added to the RPC allow list appVMs for Sparrow and Electrum. According to my tests that’s not strictly necessary (but of course it will work), because you can just attach the Trezor devices to those appVMs using the standard Qubes passthrough and they will work. Only case in which Model T and Safe models don’t work via passthrough is with Trezor Suite and other browser based wallets (Metamask, Rabby, etc.)

[equbes]

Check out USBIP protocol errors where we’ve been debugging the usb passthrough method (as opossed to running software in sys-usb), however there are some issues as well.

[adamnume2]

Unfortunately this doesn’t work for me.

Here is what I did:

Step 1 - No issues

• I have cloned whonix-ws-17 and named it whonixtrezor
• I have created AppVM Trezor using whonixtrezor as template
• I have downloaded TrezorSuite to AppVM and made it executable

Step 2 - No issues

• I have added the code in the whonixtrezor template instead of the AppVM (tried both way)

Step 3 - No issues

Step 4 - Some issues

• I have cloned fedora-39 and called it fedoratrezor
• I have also created a dvm-clone and called it fedoratrevordvm but I was not apple to use it as template for sys-usb, I could simply not opt for it in the dropdown. I was only able to opt for actual templates so I opted for fedoratrezor as sys-usb template and consequently have installed everything following that was meant for fedoratrezordvm to fedoratrezor template instead.

Step 5 - No issues

• Installed to fedoratrezor template

Step 6 - No issues

• Installed to feoratrezor template

Step 7 - No Issues

Step 8 - No Issues
First part:

• I have installed directly into whonixtrezor template
• I’ve used the following command: “sudo install python3-trezor”
  Second part:
• Installed in fedoratrezor template

I’m using Qubes 4.2.3

TrezorSuite gets me following erro: App can’t communicate with device

As a solution it says try restarting computer.

[adamnume2]

I have tried out some more but still no success:

[user@fedoratrezor ~]$ systemctl --version
systemd 254 (254.10-1.fc39)
+PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP -GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN -IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified
[user@fedoratrezor ~]$ sudo dnf install trezor
Last metadata expiration check: 1:34:42 ago on Thu Apr 10 13:42:05 2025.
No match for argument: trezor
Error: Unable to find a match: trezor
[user@fedoratrezor ~]$ sudo dnf install fuse
Last metadata expiration check: 1:35:01 ago on Thu Apr 10 13:42:05 2025.
Package fuse-2.9.9-17.fc39.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[user@fedoratrezor ~]$ sudo dnf install libfuse2
Last metadata expiration check: 1:35:14 ago on Thu Apr 10 13:42:05 2025.
No match for argument: libfuse2
Error: Unable to find a match: libfuse2
[user@fedoratrezor ~]$ 

I have added and executed the UDEV Rules and have also changed trezord.service to root by changing “User=trezord” to “User=root”

Any clues @apparatus @smrtak ?

[vaticanvoodoo]

The trezor bridge is deprecated, is there a way to use trezor on qubes without it?

[smrtak]

It works without issues. You can make it work following instruction on Trezor’s official web site: Installing Trezor Suite on Linux plus combine it with findings in this thread here: USBIP protocol errors

You basically need default sys-usb (no need for customized template where we were previously installing trezor-bridge, udev.rules and socat)
The rest of tools will be in template and TrezorSuite AppVM.

This is what I did:

1. clone whonix-ws > wws17-ts and install trezor package in it
2. create TrezorSuite appVM on updated template in step 1
3. download and transfer TrezorSuite*.AppImage and udev.rules (51-trezor.rules) to created appVM
4. open terminal in TrezorSuite

• move 51-trezor.rules to /rw/config/
• create /rw/config/trezord.service with following content:

[Unit]
Description=Trezor Bridge
After=network.target

[Service]
Type=simple
ExecStart=/home/user/squashfs-root/resources/bin/bridge/trezord -r=false
User=user
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

• modify /rw/config/rc.local with this content:

modprobe vhci-hcd # Only if AppVM is running as PVH
cp /rw/config/51-trezor.rules /etc/udev/rules.d/51-trezor.rules
cp /rw/config/trezord.service /etc/systemd/system/trezord.service
systemctl enable --now trezord

• In case you were using trezor-bridge in sys-usb there was file /etc/qubes-rpc/policy/trezord-service in dom0 which is not needed any more (remove it).
• and that should be all you need
• restart TrezorSuite appVM
• unlock your HWW
• attach it to TrezorSuite appVM
• you should be now able to work with HWW in TrezorSuite application
• profit!

share as you like and me a coffee @ smrtak@fountain.fm

[Phelipe]

I’m using Qubes OS 4.2.4. This guide worked perfectly for me, thanks @smrtak!

[gasull]

@smrtak

ExecStart=/home/user/squashfs-root/resources/bin/bridge/trezord -r=false

I don’t have a /home/user/squashfs-root/ directory, so trezord.service fails.

What am I missing?

[EveK818]

I am using Qubes 4.3.0, with whonix-workstation-18 and a Trezor Model T. Considering the new features that whonix-workstation-18 implements ( sysmaint user, Boot mode settings, Default boot mode for derived AppVMs settings, etc.), could you please rewrite or update your guide? I tried every suggestion in this posts thread using whonix-workstation-18, all to no avail.

When the Trezor-suite is run, it DOES recognize the Trezor Model T. Then it tells me I need a firmware update and asks me if I want to update the Trezor. After clicking yes, it starts the firmware update, and then 1 second in, it gives me an error saying “Unknown error”. If I try to update again, it keeps doing the same thing.

Can you try updating this guide for the latest Qubes/Whonix, or provide some advice as to how I can get this working with a Model T?

[gasull]

@EveK818

Then it tells me I need a firmware update and asks me if I want to update the Trezor. After clicking yes, it starts the firmware update, and then 1 second in, it gives me an error saying “Unknown error”. If I try to update again, it keeps doing the same thing.

Please see my post about USB flashing.

[corny]

Switching to HVM made trezor suite work again. Previously updating would just spin and spin even though the hardware was recognized. This is on 4.2.4, haven’t tried on 4.3 yet.

Issues with trezor connection

For what it’s worth, turning the qube with Trezor Suite into an HVM and attaching the PCI device for the USB port my Trezor is connected to works for me. Only the standard way through sys-usb doesn’t.

[tmp.lLDDirZ2Rg]

I’m spamming this on all the Trezor threads I can find.

Issues with trezor connection

I’m spamming this on all the Trezor threads I can find. I could never get a good solution, so I worked with AI to diagnose and create a working solution. It’s a python script, it depends on python3-trezor and python3-libusb1. The flow is 1) plug trezor in, unlock, and attach to qube, 2) run script, 3) use trezor suite, or launch a chrome-based browser with “–disable-features=LocalNetworkAccessChecks“ and then the trezor website and metamask should work. The script has nice long comment docs expl…

[DMG]

I’ve made a request on official Trezor forum for guide on this topic, please comment there, so hopefully they will make one when they will see many people interested in it.

https://forum.trezor.io/t/the-ultimate-crypto-fortress-can-we-get-official-qubes-os-trezor-suit-guide/27033?u=dmg

[DMG]

Ok so after some testing, I was able to run Trezor Suit with full access to USB wallet, all seams to work fine.

Unfortunately to do that I had to install Trezor Suit inside ‘sys-usb’ qube as only this cube has full USB access, and had to enable internet access to this qube [not recommended for long period].

I would highly recommended getting PCI-E expansion card with extra USB ports, and by doing that you should get two USB controllers in you system.

One standard, always used in sys-usb for keyboards, mouse etc
Second PCI-E ones for Trezor only, attached to your custom qube.

I’m aware this is not perfect solution for users using laptops where you can’t expand your hardware much…

Currently testing on Lenovo P3Tiny, ordered USB expansion card, will check it when arrive.

[DMG]

Ok so I did something different, after fresh install of Qubes OS I made a copy of ‘debian-13-xfce’ TempleteVM and renamed it ‘debian-13-xfce-t’.
Made a copy ‘default-dvm’ and renamed it ‘default-dvm-t’.
Then started ‘debian-13-xfce-t’ with internet access… and installed Trezor Suite with terminal as per official guideline for ubuntu: Installing Trezor Suite on Linux | Trezor

sudo apt install trezor
sudo apt install libfuse2

Then I downloaded AppImage for Linux: Trezor Suite App (Official) | Desktop & Web Crypto Management | Trezor

Then I had to move AppImage file to the system-wide skeleton directory so it persists in template used by sys-usb

sudo mkdir -p /etc/skel/Applications
sudo mv /home/user/Downloads/Trezor-Suite-*.AppImage /etc/skel/Applications/Trezor-Suite.AppImage
sudo chmod +x /etc/skel/Applications/Trezor-Suite.AppImage

Now you can stop ‘debian-13-xfce-t’ qube and disable internet access to it.
Next open setting for ‘default-dvm-t’ in Qubes Manager, and as Template select ‘debian-13-xfce-t’ from drop list.

Last thing is to change sys-usb template to ‘default-dvm-t’, you have to use Dom0 terminal for this command:

qvm-shutdown --wait sys-usb; qvm-prefs -s sys-usb template default-dvm-t; qvm-start sys-usb

Here are little screenshot of my qubes settings;

So now what you have to do is open File Explorer in sys-usb qube, and double click on the Trezor-Suite app (file explorer is opening like 10 sec, after that speed is normal, if it’s slow for you try increase memory setting for sys-usb qubes).

Remember to switch-on internet for sys-usb for the time you will use Trezor Suite, everything is working, checking wallet if it’s genuine, updating firmware etc., you don’t have to playing with USB widget to attach wallet to specific qube.

I know it’s not an ideal solution, but it allowed me to fully use the Trezor wallet. The SYS-USB qube is disposable; whatever might find its way in there gets wiped upon restart.

I am a beginner Qubes OS user, so please feel free to share any suggestions or concerns regarding this method.

Thanks