-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 07/21/2017 03:28 PM, [email protected] wrote: > Jean-Philippe Ouellet: >> On Thu, Jul 20, 2017 at 12:32 PM, [email protected] >> <[email protected]> wrote: >>> Hi, >>> >>> I've been having some problems with this myself. Specifically, >>> I'm not sure how to pass my USB printer to an appVM. The only >>> thing I can see to do is to attach my whole USB controller to a >>> VM, but I'm pretty sure if I do that I'll lose my input devices >>> (USB keyboard and mouse) and not be able to control the >>> system. >> >> See >> https://www.qubes-os.org/doc/usb/#attaching-a-single-usb-device-to-a- qube-usb-passthrough >> >>> >> Do you have to have a usbvm (sys-usb) in order to get this to work? >> >> Yes. > > Thanks for the reply! I had seen that documentation, but I was > hoping there was another way to do it. > > It looks like I can't create a usbvm, because I'm using a desktop > computer with no PS/2 ports and only one USB controller, and so I > need my USB controller in dom0 to use my keyboard and mouse. > > Am I wrong about that? If not, it looks like I'm hosed as far as > USB printers are concerned. Oh well. Qubes is still worth it > anyway, and I can always copy files over to my other machine via > USB stick when I need to print something. >
Well, it is possible... However, you have to fully understand all the security implications -- the USB VM will have full access to your keyboard and mouse, able to intercept or fake key presses and mouse movement. The docs recommend using two-factor authentication for logging into dom0 (eg. with a Yubikey or similar device) in order to prevent the (potentially compromised) USB qube from detecting when you lock your screen and walk away, then unlocking the screen with a captured passphrase and doing nefarious things. Additionally, you need to be constantly on the lookout for any "weird" keyboard activity even while using the computer -- and some of it might be (so fast as to be) invisible... Should you decide to proceed with USB qube setup anyway, you will need to make sure you *do not* use "rd.qubes.hide_all_usb" kernel param as otherwise you won't be able to enter your disk passphrase during boot. Additionally, you will have to set an auto-accept policy for qubes.InputKeyboard and qubes.InputMouse RPC calls coming from the USB qube *before* creating the USB qube (as otherwise you'd lose all input methods as soon as the USB qube is started). Other than that, all the steps are detailed in the doc article already linked by Jean-Philippe. Cheers, Patrik -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJZcgo0AAoJEFwecd8DH5rl1FkP/0o1/kW9nObXuc2H+x0s6lYB ciMEdUmaybzFrcQYT4LqtZ5ukb+6aFF8yz3fQNkU1PpoXzg/FXcELIMFSf7Uzsr3 gqb2K+vk/pplJt+UG2EQKw3zVmqoXiE9rXxOtKbqa+qTOei3/RqWECfY5ZbGIcWy sDMf6KXl0UT4Q19aBbpbZkJZzBE8K/EHLvRFvyvsHOvPMH/g1mDe18u5U2aA/onK B/XEukk+RvSXf5/XYQwzmPOcVB+YT3GVA5YCZ0fusFo8eSbnnWtWPDgjESXCqd2C 7wSuglgMcYM26YHxfoOWr/y5IaliqLfqYswVwbgoOyAfuarSPEys0cJ8FxCsCha4 kpzNePvUD04/TfvroLoNmks5BMi6KG4hWx+9gZkiraFZN26W4mYJuPRKY6W+hXuI QCyCA56s1lfyOw1rbDH8YlGuZwXb434WhBVQDQNv3h27oC3b8cIr8AQwqlLomkB4 Zo86PaAcqgmKya8gL0CXvEXM/1ZZM4yihpedSupb/wGxvv34zKeRVYjLCuprxJaF +1XdWzt1DIdK2s9F5r1ZXcSiK/K/ps3fw/CXSVTeNaLgsTHXSJUnd2GygZf+wGl1 z4my1j+ZYRwDnGf5Zmn7R+dTuPjkyVgU9T7bZZ0giiwl3V7Rk1LX1Pc5o7dJL0de NVEQtar1OeRGUPJl9XWz =W1Ji -----END PGP SIGNATURE----- -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/8a732b72-11ce-bc5c-28f8-4016157d1f17%40gmail.com. For more options, visit https://groups.google.com/d/optout.
0x031F9AE5.asc
Description: application/pgp-keys
0x031F9AE5.asc.sig
Description: PGP signature
