Update all Templates over Tor

Thanks!
I use qubes 4.0

You opened a wrong file. The correct filename is “qubes.UpdatesProxy”, you missed the “s”. So the editor opened an empty (non-existing) file for you.

When you are entering something in the command line, you can let the system help you to choose the correct names by using Tab. For example, you write
/etc/qubes-rpc/policy/qubes.Up, then you hit Tab – and it fills the rest of the filename for you automatically.

2 Likes

Thank you verry mutch. Now I’m in the folder, is that so correct?

It’s spelled wrong. I made the same mistake.

Can you help me please, Im in the folder but I don’t know what I should to do…
how I can test it?

It looks like the right file to me now. Symbol # in front of a line means that it’s a comment. If you want to enable “Upgrade all TemplateVMs through sys-whonix”, you need to remove # at the beginning of the next line, putting $type:TemplateVM $default allow,target=sys-whonix into force.

Then you need to save the edit by hitting ctrl+x, then y, enter. You can then open the file again and verify that it’s modified as expected.

Sorry iam Berry stupid, can you send a picture of your setting in the folder…

Currently, on you screenshot you have this:

...
## Please use a single # to start your custom comments

# Upgrade all TemplateVMs through sys-whonix.
#$type:TemplateVM $default allow,target=sys-whonix
...

and you need this:

...
## Please use a single # to start your custom comments

# Upgrade all TemplateVMs through sys-whonix.
$type:TemplateVM $default allow,target=sys-whonix
...
1 Like

can I somehow check whether it works? is there anything?

thank you for your patience and help

Actually I don’t know how to check that. I hope someone else could help you here.

Kill all Whonix qubes, start an update - sys-whonix should start.

I don’t use Whonix so cant comment on the internals, but you may be
able to watch outgoing circuits to repositories.

You can use Onion repository instead of clearnet, ensuring that you are using tor network.

dom0

  1. In dom0, open /etc/yum.repos.d/qubes-dom0.repo in a text editor.
  2. Comment out all the baseurl = https://yum.qubes-os.org/[...] and metalink lines.
  3. Uncomment all the baseurl = [...].onion lines.
  4. Update every .onion address to yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion . The affected lines should look like this:
#baseurl = https://yum.qubes-os.org/r$releasever/current/dom0/fc25
baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r$releasever/current/dom0/fc25
#metalink = https://yum.qubes-os.org/r$releasever/current/dom0/fc25/repodata/repomd.xml.metalink
  1. Open /etc/yum.repos.d/qubes-templates.repo in a text editor and repeat steps 2-4.

if the onion address is same as above, you don’t need to change anything, just comment / uncomment what it need.

Fedora TemplateVMs

  1. In the TemplateVM, open /etc/yum.repos.d/qubes-r4.repo in a text editor.
  2. Comment out every line that contains yum.qubes-os.org .
  3. Uncomment every line that contains .onion .
  4. Update every .onion address to yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion . The affected lines should look like this:
#baseurl = https://yum.qubes-os.org/r4.0/current/vm/fc$releasever
baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.0/current/vm/fc$releasever

if the onion address is same as above, you don’t need to change anything, just comment / uncomment what it need.

Debian & Whonix TemplateVMs

  1. In the TemplateVM, open /etc/apt/sources.list.d/qubes-r4.list in a text editor.
  2. Comment out every line that contains deb.qubes-os.org .
  3. Uncomment every line that contains .onion .
  4. Update every .onion address to deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion . The affected lines should look like this:
# Main qubes updates repository
#deb [arch=amd64] https://deb.qubes-os.org/r4.0/vm buster main
#deb-src https://deb.qubes-os.org/r4.0/vm buster main

# Qubes Tor updates repositories
# Main qubes updates repository
deb [arch=amd64] http://deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.0/vm buster main
#deb-src http://deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.0/vm buster main

if the onion address is same as above, you don’t need to change anything, just comment / uncomment what it need.

1 Like