Patrik Hagara: > On 07/21/2017 03:28 PM, [email protected] wrote: >> Thanks for the reply! I had seen that documentation, but I was >> hoping there was another way to do it. > >> It looks like I can't create a usbvm, because I'm using a desktop >> computer with no PS/2 ports and only one USB controller, and so I >> need my USB controller in dom0 to use my keyboard and mouse. > >> Am I wrong about that? If not, it looks like I'm hosed as far as >> USB printers are concerned. Oh well. Qubes is still worth it >> anyway, and I can always copy files over to my other machine via >> USB stick when I need to print something. > > > Well, it is possible... However, you have to fully understand all the > security implications -- the USB VM will have full access to your > keyboard and mouse, able to intercept or fake key presses and mouse > movement. > > The docs recommend using two-factor authentication for logging into > dom0 (eg. with a Yubikey or similar device) in order to prevent the > (potentially compromised) USB qube from detecting when you lock your > screen and walk away, then unlocking the screen with a captured > passphrase and doing nefarious things. Additionally, you need to be > constantly on the lookout for any "weird" keyboard activity even while > using the computer -- and some of it might be (so fast as to be) > invisible... > > Should you decide to proceed with USB qube setup anyway, you will need > to make sure you *do not* use "rd.qubes.hide_all_usb" kernel param as > otherwise you won't be able to enter your disk passphrase during boot. > > Additionally, you will have to set an auto-accept policy for > qubes.InputKeyboard and qubes.InputMouse RPC calls coming from the USB > qube *before* creating the USB qube (as otherwise you'd lose all input > methods as soon as the USB qube is started). > > Other than that, all the steps are detailed in the doc article already > linked by Jean-Philippe.
Oh so basically the instructions in the documentation (https://www.qubes-os.org/doc/usb/) for using USB keyboard and mouse can be done before creating the usb qube? Just edit the qubes.InputKeyboard and qubes.InputMouse files as the documentation says, and put in the name of the usb qube I'm going to create, and then create the usb qube (using the qubesctl commands at the top of that page)? I'll have to think about whether I want to do that. It's definitely more of a security risk, and I don't know if I want to get a Yubikey and bother with two-factor authentication. Though really it should still be more secure than using a regular Linux distro, right? Since the same attack vector is available in that case as well, plus a lot more? I'm just not sure that I trust enough that I know what I'm doing to not mess things up and then not be able to use my system! -Jackie -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/dc67a3b1-8213-017e-959e-d7b4369ca3c9%40riseup.net. For more options, visit https://groups.google.com/d/optout.
