Update all Templates over Tor

User Support
21

Thanks!
I use qubes 4.0

22

You opened a wrong file. The correct filename is “qubes.UpdatesProxy”, you missed the “s”. So the editor opened an empty (non-existing) file for you.

When you are entering something in the command line, you can let the system help you to choose the correct names by using Tab. For example, you write
/etc/qubes-rpc/policy/qubes.Up, then you hit Tab – and it fills the rest of the filename for you automatically.

2 Likes
23

Thank you verry mutch. Now I’m in the folder, is that so correct?

image
image2016×1512 1.41 MB

24

It’s spelled wrong. I made the same mistake.

25

Can you help me please, Im in the folder but I don’t know what I should to do…
how I can test it?

26

It looks like the right file to me now. Symbol # in front of a line means that it’s a comment. If you want to enable “Upgrade all TemplateVMs through sys-whonix”, you need to remove # at the beginning of the next line, putting $type:TemplateVM $default allow,target=sys-whonix into force.

Then you need to save the edit by hitting ctrl+x, then y, enter. You can then open the file again and verify that it’s modified as expected.

27

Sorry iam Berry stupid, can you send a picture of your setting in the folder…

28

Currently, on you screenshot you have this:

...
## Please use a single # to start your custom comments

# Upgrade all TemplateVMs through sys-whonix.
#$type:TemplateVM $default allow,target=sys-whonix
...

and you need this:

...
## Please use a single # to start your custom comments

# Upgrade all TemplateVMs through sys-whonix.
$type:TemplateVM $default allow,target=sys-whonix
...
1 Like
29

can I somehow check whether it works? is there anything?

thank you for your patience and help

30

Actually I don’t know how to check that. I hope someone else could help you here.

31

Kill all Whonix qubes, start an update - sys-whonix should start.

I don’t use Whonix so cant comment on the internals, but you may be
able to watch outgoing circuits to repositories.

32

You can use Onion repository instead of clearnet, ensuring that you are using tor network.

dom0

  1. In dom0, open /etc/yum.repos.d/qubes-dom0.repo in a text editor.
  2. Comment out all the baseurl = https://yum.qubes-os.org/[...] and metalink lines.
  3. Uncomment all the baseurl = [...].onion lines.
  4. Update every .onion address to yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion . The affected lines should look like this:
#baseurl = https://yum.qubes-os.org/r$releasever/current/dom0/fc25
baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r$releasever/current/dom0/fc25
#metalink = https://yum.qubes-os.org/r$releasever/current/dom0/fc25/repodata/repomd.xml.metalink
  1. Open /etc/yum.repos.d/qubes-templates.repo in a text editor and repeat steps 2-4.

if the onion address is same as above, you don’t need to change anything, just comment / uncomment what it need.

Fedora TemplateVMs

  1. In the TemplateVM, open /etc/yum.repos.d/qubes-r4.repo in a text editor.
  2. Comment out every line that contains yum.qubes-os.org .
  3. Uncomment every line that contains .onion .
  4. Update every .onion address to yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion . The affected lines should look like this:
#baseurl = https://yum.qubes-os.org/r4.0/current/vm/fc$releasever
baseurl = http://yum.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.0/current/vm/fc$releasever

if the onion address is same as above, you don’t need to change anything, just comment / uncomment what it need.

Debian & Whonix TemplateVMs

  1. In the TemplateVM, open /etc/apt/sources.list.d/qubes-r4.list in a text editor.
  2. Comment out every line that contains deb.qubes-os.org .
  3. Uncomment every line that contains .onion .
  4. Update every .onion address to deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion . The affected lines should look like this:
# Main qubes updates repository
#deb [arch=amd64] https://deb.qubes-os.org/r4.0/vm buster main
#deb-src https://deb.qubes-os.org/r4.0/vm buster main


# Qubes Tor updates repositories
# Main qubes updates repository
deb [arch=amd64] http://deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.0/vm buster main
#deb-src http://deb.qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/r4.0/vm buster main

if the onion address is same as above, you don’t need to change anything, just comment / uncomment what it need.

4 Likes
33

its to bad there isn’t a setting in Qubes Global Settings to change both dom0 and template updates to sys-whonix

don’t like to manually edit the sources file ; as simple as it is

34

You have to edit the sources file to use onion repositories, not to
update over Tor.

One reason not to have a Global setting for templates is because you may
want to use different update qubes for specific templates.

35

I think for this fresh 4.1 installation, I’m not going to pollute by manually changing repo sources.

someday if it was all in the QGlobalSettings, I’d trust I wouldn’t make a fatal mess or secure hole , ymmv :slight_smile:

like .onion sources for individual templates and Dom0 , built into the QGS tool

36

this post is from sept 14

is there any official maintained .onion addresses vs just changing global settings for dom0 to sys-whonix

which I imagine isn’t the same

37

The “official” onion repo addresses should already be in the .repo file, just commented out. You could simply comment out the clearnet lines and uncomment the onion lines. (Not sure if they’re really official. I believe they’re maintained by @unman.)

1 Like
38

I should mention that it’s not strictly necessary to use the onion repos. You can simply use the clearnet repos over Tor. You don’t get the usual onion service benefits, but to me, those aren’t very important for updates. I’d rather not have to worry about the onion mirrors lagging behind the official ones. But that’s just me.

1 Like
39

seems like qubes.UpdatesProxy in dom0
in 4.1 now just contains whonix-updatevm references

2nd line of $anyvm deny must mean all other templates use qubes-prefs updatevm choice ?

so to have templates use sys-whonix just change updatevm via $qubes-prefs ? Somehow I’m thinking that will only do dom0

so, is it in the documentation how to make templates use sys-whonix for their updates?(*other than commenting out sources.list.d in the template, which only includes the .onion addresses) if so where ? I’ll go look again

40

To be clear, I don’t maintain the onion mirrors. (At best I facilitate
them.)
Since they are included in the official repo definitions provided by
Qubes in dom0 and templates, I think they can be regarded as “official”.
The repository data is, of course, signed by Qubes.

As with any mirror there is a slight delay in the mirroring process.
Usually this is less than 4 hours - I believe the onion repositories
currently sync hourly.

1 Like