Hello David Hobach <[email protected]> schrieb am Mo., 26. Aug. 2019, 11:22:
> On 8/26/19 10:24 AM, panina wrote: > > Hi! > > > > This is not strictly Qubes-OS related, rather inspired by Qubes. > > > > I've been struggling with some parts of Qubes usage. Most of the time, > > it is overkill for me, and putting some strain on my computer. The > > bugginess is also quite annoying, whenever I just need to do some > > everyday work. > > I've been thinking I'd like some form of dual-boot solution, or possibly > > a Live USB that could be used. > > Most of the time I work with ssh and webapps, so the only persistent > > data I need to work will fit on a smartcard. > > > > My thought is to have an installation that mounts most of the root > > partition as readonly, and uses ramdisks wherever the system wants to > > write (e.g /var/log). I'm also thinking it should be possible to get a > > fingerprint or somesuch of the root partition, and use my TPM2 to check > > this. > > > > The system should also have a possibility to update itself, that I can > > choose to do in environments that I feel is safe. > > > > I am wondering if anyone knows of an OS that works like this? Or if > > anyone knows of tools that might accomplish parts of this? > > Ehm... You're describing Qubes OS with disposable VMs there? The > fingerprinting is essentially AEM? > > If you need to keep your data on an external disk (SDCard), you can use > either a manual approach with qvm-copy, permanently attach the disk to a > single disposable VM with a fixed name or use an automated solution such > as [1]. You might also want to look into qvm-pool. > > [1] https://github.com/3hhh/qcrypt I don't know why people are complaining about the "bugginess" and that it needs more performance. If you buy the right hardware you'll not run into lots of bugs and get enough performance to run qubes. You can buy a Lenovo T530/430, W530, X230 for not much money, add a SSD some RAM and you'll not run into performance problems (normal use). As David mentioned Qubes will do exactly what you need if you're using disposable VMs. Regarding the fingerprinting, you can use AEM (Anti Evil Maid) or write your own script. I tried something which will fingerprint all files in /boot and gpg sign the signature which is then stored in the LUKS encrypted root partition. You can then free booting into Qubes check the current boot Partition against the fingerprints. https://github.com/one7two99/my-qubes/tree/master/docs/boot-protect Not sure if this is really secure, would be nice to have this checked by someone who knows more about security. [799] -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/CAJ3yz2vkPZAv4pTQzTn9_W%2Bp_yC5_ZtOz3rmdvi59on60u88Qw%40mail.gmail.com.
