It’s now working. I’ve tested Qubes with a big variety of hardware wallets and they all work out of the box, no need to create a custom sys-usb - except for Trezor Model T and Trezor Safe (3 and 5), and only if you want to use them with browser based wallets (that includes Trezor Suite).
It looks like this is because most hardware wallets use HID protocol for USB communication, which is easy to passthrough to virtual machines in Qubes. Model T and Safe models use WebUSB, and it looks like they don’t like how Qubes passthrough handles WebUSB devices. Electrum seems to be able to communicate with model T and Safe models via HID.
Long story short, after following @smrtak guide Model T and Safe models work with Trezor Suite and other browser wallets. But I do believe the RPC policies are overly permissive, so I suggest to change those to make sure only the TrezorSuite VM can connect to trezord-service.
Thanks! I didn’t realize there was a comment with modified RPC policies - when clicking the link in the thread I can only see the original post with the very permissive RPC policy.
Anyway, I see that you added to the RPC allow list appVMs for Sparrow and Electrum. According to my tests that’s not strictly necessary (but of course it will work), because you can just attach the Trezor devices to those appVMs using the standard Qubes passthrough and they will work. Only case in which Model T and Safe models don’t work via passthrough is with Trezor Suite and other browser based wallets (Metamask, Rabby, etc.)
Check out USBIP protocol errors where we’ve been debugging the usb passthrough method (as opossed to running software in sys-usb), however there are some issues as well.
I have cloned whonix-ws-17 and named it whonixtrezor
I have created AppVM Trezor using whonixtrezor as template
I have downloaded TrezorSuite to AppVM and made it executable
Step 2 - No issues
I have added the code in the whonixtrezor template instead of the AppVM (tried both way)
Step 3 - No issues
Step 4 - Some issues
I have cloned fedora-39 and called it fedoratrezor
I have also created a dvm-clone and called it fedoratrevordvm but I was not apple to use it as template for sys-usb, I could simply not opt for it in the dropdown. I was only able to opt for actual templates so I opted for fedoratrezor as sys-usb template and consequently have installed everything following that was meant for fedoratrezordvm to fedoratrezor template instead.
Step 5 - No issues
Installed to fedoratrezor template
Step 6 - No issues
Installed to feoratrezor template
Step 7 - No Issues
Step 8 - No Issues
First part:
I have installed directly into whonixtrezor template
I’ve used the following command: “sudo install python3-trezor”
Second part:
Installed in fedoratrezor template
I’m using Qubes 4.2.3
TrezorSuite gets me following erro: App can’t communicate with device
You basically need default sys-usb (no need for customized template where we were previously installing trezor-bridge, udev.rules and socat)
The rest of tools will be in template and TrezorSuite AppVM.
This is what I did:
clone whonix-ws > wws17-ts and install trezor package in it
create TrezorSuite appVM on updated template in step 1
download and transfer TrezorSuite*.AppImage and udev.rules (51-trezor.rules) to created appVM
open terminal in TrezorSuite
move 51-trezor.rules to /rw/config/
create /rw/config/trezord.service with following content:
modprobe vhci-hcd # Only if AppVM is running as PVH
cp /rw/config/51-trezor.rules /etc/udev/rules.d/51-trezor.rules
cp /rw/config/trezord.service /etc/systemd/system/trezord.service
systemctl enable --now trezord
In case you were using trezor-bridge in sys-usb there was file /etc/qubes-rpc/policy/trezord-service in dom0 which is not needed any more (remove it).
and that should be all you need
restart TrezorSuite appVM
unlock your HWW
attach it to TrezorSuite appVM
you should be now able to work with HWW in TrezorSuite application
profit!
share as you like and me a coffee @ smrtak@fountain.fm
so i tried following most recent @smrtak instructions… couldnt get it to work… trezor suite app keeps loading… downloaded trezor in cloned whonix ws template routed over sys-whonix using the trezor Ubuntu guide on website Installing Trezor Suite on Linux | Trezor
sudo apt install trezor
used the manual download off Trezor Udev install Udev rules | Trezor into the TrezorSuite terminal
I have trezor working with qubes based on the guide. It’s been a while but my fuzzy recollection is that trezor can work on multiple connections (bridge to Suite, webusb to electrum, and a third one I can’t remember name of) so it is worth trying it with different wallet apps. This also helps diagnose what connection type is working and which isn’t.
For Suite my best success was with the bridge although I think that’s deprecated now (I used a workaround)
I found it was helpful to add the udev rules to every qube I was using (the modified sys-usb as well the appVMs)
Have you tried sparrow wallet to access the trezor ? It uses a different connection compared to electrum. Also earlier versions of it use HWI (which can cause inability to connect) whereas the recent ones use its own library.
Yea so I’m trying to access coins on trezor suite app. It uses a web usb connection.
The computer recognizes the wallet. I assign it to the Trezor suite appvm on whonix work station after following complete guide by @smrtak . It just forever loads like when I tried to install it in Debian routed over tor or my vpn.
Think there’s an issue maybe the root files are deleted since I’m downloading the curl udev tiles into my appvm terminal. But upon reboot it says it’s still there. Or maybe I’m not making the pathway executable I’m not sure
I’m a bit confused. Is your issue with the trezor hww being scanned for but never discovered or with the software not connecting to the internet ?
I’m assuming the first one. A trezor hww hardware/software issue. If so, can you do some diagnostics to narrow down the issue ?
Have you tried using trezor ctl(eg. trezorctl list) to scan for connected trezor device ? Does it show up ?
does it show up in electrum ? When you create a new wallet with trezor it’ll list devices it sees. Mine show the trezor and the connection type (webusb)
Do you have udev rules in sys-usb service as well as app vm ?
If you are installing udev to anywhere except home user in appvm (/etc for example) then it won’t persist across reboots. You can copy it each time or put it in the template (or a copy)
The app starts loading but my amounts never load. It’ll say connect and then I connect the wallet and assign it to the trezor suite appvm but it just loads forever.
I used gpt to help me ask the terminal where it’s at and what its pathway is. It led me off track with old bridge ideas to install which are deprecated. Need help fixing it asap. chat gpt leads me down incorrect rabbit holes a lot lol. I’m pretty sure it actually does have something to do with this. I can’t figure it out tho
This is what gpt recommended. And I know with its help we found where it was. Idk if it’s an executable pathway. I’m not sure on much of this lol
`You already proved:
/ udev rule is installed
/etc/udev/rules.d/51-trezor.rules
exists.
/ service exists
trezord. service exists in /etc/ systemd/ system.
But your systemd logs showed:
X trezord.service is failing repeatedly
(status=203/EXEC)
That means the binary it tries to launch DOES NOT EXIST.
The ExecStart path in your service file most likely points to something like:
code
Copy
ExecStart=/home/user/squashfs-root/resources/bi*
But that file is not present, which is why:
code
Copy
which trezord trezord not found
So systemd tries to start it → binary not found → loops forever → Trezor Suite sees “Proxy Disabled” → connection fails → infinite connection circle.`
It would say enabled but it would only say Activating (auto-restart) along with the 203 exit code
I strongly recommend you don’t use AI/CHATgpt. Roll the dice, sometimes you’ll get a good answer, next time you’ll get a 70IQ (wrong) answer. You’ll waste more time trying to figure which is which
My recollection from using a while ago is that udev rules disappear on a reboot of appVM. You can verify by navigating in file manager to /etc/udev/rules.d
Perhaps you should just use fedora or debian with a VPN running (or running on your router). Trezor suite has a Tor option toggle also
This worked for me. I have installed it on 3 different Qubes PC’s with a few changes. Here is a list of mods to the instructions that I needed to make.
In Step 2 - part 2: Change the quotation marks. The quotation marks in the socat command are not correct. If you cut and paste the command from FireFox you must arrow backwards and retype the quotation marks.
In Step 3 - part 2: The command “$anyvm $anyvm allow,user=trezord,target=sys-usb” opens up an unnecessarily large security hole. Try using “Trezor-appVM sys-usb allow,user=trezord,target=sys-usb”
In Step 4 - part 4: It is difficult to change the template of sys-usb. Do not shut down sys-usb or you will loose your mouse and keyboard. Use the following command from dom0:
me a coffee @ smrtak@fountain.fm 