Ultimate Guide on Using Trezor on Qubes

Community Guides
81

All Trezor devices have been tested and work without issues.

Did you follow all instruction as specified in how-to? Was there anything confusing or incorrect? Where did you get stuck or lost?

When troubleshooting issues, this link was very useful: Installing Trezor Suite on Linux

Make sure you use correct UDEV rules and verify your sys-usb with cmd: systemctl --version
It needs to return value higher thatn 256.4

sys-usb template needs to have these extra pkgs installed: trezor libfuse2 socat

2 Likes
82

Itā€™s now working. Iā€™ve tested Qubes with a big variety of hardware wallets and they all work out of the box, no need to create a custom sys-usb - except for Trezor Model T and Trezor Safe (3 and 5), and only if you want to use them with browser based wallets (that includes Trezor Suite).

It looks like this is because most hardware wallets use HID protocol for USB communication, which is easy to passthrough to virtual machines in Qubes. Model T and Safe models use WebUSB, and it looks like they donā€™t like how Qubes passthrough handles WebUSB devices. Electrum seems to be able to communicate with model T and Safe models via HID.

Long story short, after following @smrtak guide Model T and Safe models work with Trezor Suite and other browser wallets. But I do believe the RPC policies are overly permissive, so I suggest to change those to make sure only the TrezorSuite VM can connect to trezord-service.

2 Likes
83

thx for feedback
NOSTR note has been edited + new reply with proposed restriction to RPC policy (for clients that donā€™t support edited posts)

2 Likes
84

Thanks! I didnā€™t realize there was a comment with modified RPC policies - when clicking the link in the thread I can only see the original post with the very permissive RPC policy.

Anyway, I see that you added to the RPC allow list appVMs for Sparrow and Electrum. According to my tests thatā€™s not strictly necessary (but of course it will work), because you can just attach the Trezor devices to those appVMs using the standard Qubes passthrough and they will work. Only case in which Model T and Safe models donā€™t work via passthrough is with Trezor Suite and other browser based wallets (Metamask, Rabby, etc.)

2 Likes
85

Check out USBIP protocol errors where weā€™ve been debugging the usb passthrough method (as opossed to running software in sys-usb), however there are some issues as well.

1 Like