On 7/29/19 1:54 PM, Chris Laprise wrote:
On 7/28/19 10:23 PM, Jon deps wrote:
On 7/29/19 12:02 AM, Chris Laprise wrote:
On 7/28/19 4:55 PM, Jon deps wrote:
On 7/28/19 7:52 PM, Jon deps wrote:
On 7/28/19 1:36 AM, Chris Laprise wrote:
On 7/27/19 8:27 PM, Jon deps wrote:
pardon my non-sysadmin query :
any chance of some real world examples? quite a few new terms
there .
so install into Debian-9
but step 2 am already lost
eg how and where amd I "activating" vm-boot-protect in the
templatevm ?
or during install there is going to appear a choice of which
service to start , then when one opens a TBAVM based on the
specified Deb-9 template the protection work at that point ?
Go to the VM's Settings / Services tab, and add "vm-boot-protect"
as a service.
Can I install it in a fresh Deb-9 , and if its breaking things,
just delete the fresh Deb-9 template, or is it touching dom0 ?
It has a second-stage installation step that changes sudo/root
access inside the template. And for that new root config to work,
you have to add a couple dom0 config lines (it shows you the dom0
lines at the end of the install process).
If you remove the altered Deb-9, the dom0 config lines will stay
unless you change them back. However, in practice there is really
no impact on your unmodified templates, so whether or not to
remove the dom0 lines is a question of tidiness.
As an alternative, per the Readme step 3, you can sidestep the
whole sudo auth reconfiguration.
I guess once installed there is no un-installing ?
Currently there is no "purge everything" function or uninstall.
You can remove the service manually by deleting the following:
/lib/systemd/system/vm-boot-protect.service
/usr/lib/qubes/init/vm-boot-protect.sh
/etc/default/vms
I just ended up using vm-boot-protect-root for the sys-net and
sys-usb in qube settings services
per the "Where to use basic examples"
and vm-boot-protect for regular appVMs
think I'll skip it for anything else
sys-net is working (I am using fedora-30: because of the past clock
sync issue) otherwise Deb-9 but just curious what the
"additional networks VMs would be here" proxyVPNVMs ?
"The sys-net VM should work 'out of the box' with the
vm-boot-protect-root service via the included whitelist file.
Additional network VMs may require configuration, such as cp
sys-net.whitelist sys-net2.whitelist."
PS: the appVMs seem a bit slower to boot, but could be my
imagination ? :)
as expected, since my sys-net was not based on the template I
installed the script to ....
I installed it to a deb-9-clone and the disp-qubes-manager method
seems to be failing to update so typically when that happens I go
to a terminal in the template and do it manually usually it
seems to want -dist-upgrade , which presumably the disp-update
has issues with but after installing the script *
in the deb-9 template
$sudo apt-get update
fails with what looks like a script of having entered it
incorrectly 3 times
so sorry, but am I supposed to add vm-protect-root to the
template services as well or how to fix this ?
'vm-protect-root' doesn't match any service created by
Qubes-VM-hardening.
Adding vm-boot-protect or vm-boot-protect-root to the services of the
template is optional. You can use either one, but it will always
behave like plain vm-boot-protect in the template (the -root
functions don't make sense in templates).
I'm not clear on when/where you're using fedora-30. Note that install
step 3 is different for fedora.
With debian-9, if you're getting immediate errors from every 'sudo'
command, this would be expected if you chose to uninstall
'qubes-core-agent-passwordless-root' in install step 3 (this means no
more sudo!). But if you chose to auto-configure sudo, you will still
need to add the config lines to dom0 for sudo to work correctly
(otherwise, sudo will just give you errors); these lines are printed
in the shell at the end of the install process.
hence, my original query about 'examples' thanks in advance
Not sure what example you're looking for. In debian, the installer
asks you one question: 'Configure sudo authentication prompt now?
(y/n)'.
After installing Qubes-VM-hardening with sudo auth configured,
running a command like 'sudo apt-get update' will cause a dom0 auth
prompt window to appear, at which point you can hit 'Enter' or click
'OK'. Then the command will run normally.
At the vm-boot-protect level, you should see 'bin' automatically
added to your home dir, and doing an 'lsattr -a' will show a number
of files/dirs in home with the 'i' flag set.
At vm-boot-protect-root level, you should see a new dir
'/rw/vm-boot-protect' and it should contain 'BAK' and/or 'ORIG'
versions of config, bind-dirs and usrlocal.
1)
So, I chose 'yes' at the end of the script, for 'configure sudo
authentication prompt.
a) somehow I missed the 'several commands' to manually configure
in dom0 ; could you please tell me what they are ?
b) otherwise I guess I can try uninstalling -paswordless-root
from the debian-9 template
I wouldn't do the uninstall on top of the sudo reconfig (though you
might get an interesting result...).
The text printed at the end of install:
Done.
Next.... Enable auth prompts in dom0 with the following commands:
[user@dom0 ~]$ sudo su -
[root@dom0 /]# echo "/usr/bin/echo 1" >/etc/qubes-rpc/qubes.VMAuth
[root@dom0 /]# echo "\$anyvm dom0 ask,default_target=dom0" \
>/etc/qubes-rpc/policy/qubes.VMAuth
++ OK actually now I recall the lines, seems I had Not enter the 3rd
line accurately
These are the same dom0 changes described in the doc page:
https://www.qubes-os.org/doc/vm-sudo/
BTW, if you don't remember seeing the dom0 instructions then something
might have gone wrong in the installer.
2) please disregard what I said about Fedora, my mistype of
'vm-protect-etc", and my 1st status report, when I was still trying
things out.
3) so no service needs to be added to either the Deb-9 template, NOR
any AppVMs based on the template?
a) installing howto says to "specify one of the services for your
VMs"
I didn't say that. I said that specifying the Qubes services isn't
necessary for the template; it doesn't affect whether or not the
template-based VMs use those services.
4) Seems that it also breaks any appVMs using other Templates where
the script wasn't installed
No, it wouldn't do that.
++so does this mean that the VMHardening must be installed in all
template VMs that will be used ? ( and if that were the case then one
would not be able to use both Fed-30 and Deb-9 on the machine, secondary
to the step 3 variance in methods to remove passwordless root ?
++further is it the case that ANY appVM must add at least the
vm-boot-protect as a service to start ; eg. sys-vpn sys-firewall
sys-whonix anon-whonix
+ its Just your saying in your write up that the vm-boot-protect-ROOT
may/may not work in those
+ but again don't expect any appVM to work w/o the VMBP service
present, nor any appVM *not using the template where QVMH has been
installed ?
ATM: per the howto, I've no manually started service in the VMBP Deb-9
Template , however
re:
"The sys-net VM should work 'out of the box' with the
vm-boot-protect-root service via the included whitelist file. Additional
network VMs may require configuration, such as cp sys-net.whitelist
sys-net2.whitelist."
I engaged the VMBP-root in the sys-net restarted, have it connected by
ETH cable on a Thinkpad T5xx-series but no internet
I did in default/vms sys-net.whitelist and did the cp command as
above then re-ran the install script as sh ./install in deb-9
template closed deb-9 and restarted sys-net
ethernet now works! *BUT importantly for a laptop not the wifi (which
worked fine pre_VMBP)
lastly, I can update deb-9 template via the default-mgmt-dvm widget,
but not directly in the deb-9 xterm via apt-get update, is that too
be expected ? as I was saying, seems to me, there are times, when one
needs to apt-get dist-upgrade that the DVM widget doesn't do
PS:
---
I seemed to have gotten it closer in sys-usb using VMBP (no -root) on
starting the AppVM I see a popup window saying :
FIRST BOOT volume initialization Please Restart
private volume is located at /dev/badxvdb
which appears to be the last bulletpoint on your github writeup,
however restarting the sys-usb does not fix , see the same popup window.
I removed my usb mouse dongle, and the error message changed to
Mount failed: BAD private volume!
so looks to break the auto-mounting of the usb mouse to sys-usb so at
root@dom0 and user@dom0 I tried
qvm-usb attach sys-usb sys-usb:1-1.2
but device attach failed:
---
so thx for tool, support, think this is for folks whom know how to use
linux :)
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/8251dd96-8d03-6204-9c46-1501fb207be7%40riseup.net.
