Re: [qubes-users] Qubes/Whonix as an Internet Gateway for a client machine

[*Null* **]

Another option, depending on the machine, is add another ethernet nic or wifi 
dongle. Create a vm that 'provides network' and enable network manager in that 
vm (im calling it sys-lan here). Then assign the new nic or dongle to sys-lan.

Assign netVMs like usual sys-net>sys-firewall>sys-whonix>sys-lan

Traffic will then flow through qubes normally with sys-lan assigning ip and dns 
settings to whatever is on the sys-lan nic.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/7786f1ae-3069-4293-9b9c-e0c98fed4f76%40googlegroups.com.

Re: [qubes-users] What's your flow for new templateVM?

['Elliot Killick' via qubes-users]

On 2020-05-12 15:23, unman wrote:
> On Mon, May 11, 2020 at 08:46:25PM +, 'Elliot Killick' via qubes-users 
> wrote:
>> -BEGIN PGP SIGNED MESSAGE-
>> Hash: SHA256
>>
>> On 2020-05-11 14:26, 'Ryan Tate' via qubes-users wrote:
>>> Saw the new f31 templateVM (thanks for that) and just curious how
>> folks generally migrate to a new templateVM.
>>> I manually maintain this big text list of packages and just use
>>> that
>> to manually update the fresh templateVM to what I need. There's
>> typically also some non package installs, which I include basic pointers
>> for (think downloaded rpms and so forth), as well as some outside repos
>> to add (e.g. keybase). There's also typically some packages I forgot to
>> put on the list, which I can usually suss out by going through the bash
>> history for the old template, although often there's one or two that
>> slip through the cracks, which I find out about eventually and it's not
>> a huge deal.
>>> I'm particularly curious if anyone does anything more
>>> sophisticated
>> than that, using salt or some other automated deploy system to prep new
>> template images.
>>> Thanks for any tips!
>>>
>> I also keep a list of packages I want to have on each of my templates.
>> For the switching part of each AppVM to the new TemplateVM (e.g.
>> fedora-30 to fedora-31) I use a simple Python script that utilizes the
>> Qubes Admin API:
>>
>> #!/usr/bin/python3
>>
>> import qubesadmin
>> from qubesadmin.exc import *
>>
>> from_templatevm = 'fedora-30'
>> to_templatevm = 'fedora-31'
>>
>> qubes = qubesadmin.Qubes().app.domains
>>
>> for qube in qubes:
>> if qube.name == from_templatevm:
>> appvms = qube.appvms
>> for appvm in appvms:
>> print('Changing TemplateVM of:', appvm.name)
>> try:
>> appvm.__setattr__('template', to_templatevm)
>> except QubesVMNotHaltedError:
>> print("Cannot change TemplateVM while qube is turned on!
>> ")
>>
>> I usually just run this after my next reboot when almost (don't forget
>> to shutdown the NetVMs) all my qubes will be turned off. This is much
>> better than switching them manually one by one in Qubes Manager.
>>
> Just for the record there's a GUI tool to do this.
> System->ManageTemplates in Qube Manager
>
Huh, I've seen that before but I guess I kind of forgot about it!

Thanks, unman.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b0af88bd-d42c-941d-9011-92a57f5c9f4f%40zohomail.eu.

[qubes-users] Re: What's your flow for new templateVM?

[liked2]

On 2020-05-11 16:11, unman wrote:

On Mon, May 11, 2020 at 10:52:32AM -0400, Stumpy wrote:

On 2020-05-11 10:26, 'Ryan Tate' via qubes-users wrote:

Saw the new f31 templateVM (thanks for that) and just curious how folks
generally migrate to a new templateVM.

I manually maintain this big text list of packages and just use that to
manually update the fresh templateVM to what I need. There's typically
also some non package installs, which I include basic pointers for
(think downloaded rpms and so forth), as well as some outside repos to
add (e.g. keybase). There's also typically some packages I forgot to put
on the list, which I can usually suss out by going through the bash
history for the old template, although often there's one or two that
slip through the cracks, which I find out about eventually and it's not
a huge deal.

I'm particularly curious if anyone does anything more sophisticated than
that, using salt or some other automated deploy system to prep new
template images.

Thanks for any tips!



Ditto, would really be interested as well, I have a similar system but i am
sure there are better ways to do it.



Salt it - if you get used to using salt, it's simple to use.
If you want to install a package, don't open the template and install it
there, edit the install.sls file to include the package, and run
`qubesctl --skip-dom0 --targets=  state.apply install`



What's the advantage of using Salt in comparison to 'qvm-run ...' commands 
bundled to a script to manage template modifications? In this case you've also 
a executable documentation.
What's I'm missing?

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/16761577-022f-c5fd-20de-69f3d4c6ef7e%40gmx.de.

Re: [qubes-users] Dividing Qubes Into Separate Networks (FAILED)

[unman]

On Tue, May 12, 2020 at 04:13:23PM +0100, unman wrote:
> On Mon, May 11, 2020 at 03:16:03PM +, 'Zsolt Bicskey' via qubes-users 
> wrote:
> > Here is full summary of where I am at. Could someone please provide 
> > guidance with this? Thank you very much. 
> > 
> > 
> > Qubes OS version
> > Qubes OS R4.0
> > 
> > Affected component(s) or functionality
> > Networking
> > 
> > Brief summary
> > I tried to separate everything into to two subnets meanings 2 NICs, 2 
> > gateways (sys-net), 2 firewalls. Everything works on the network before the 
> > new gw and after it. All qubes can communicate to the firewall. After the 
> > gateway everything works properly on the physical network as designed and 
> > can get out to the internet if I connect any client other to it but the new 
> > gateway.
> > 
> > The main gateway remains functional but the new one can't get on the 
> > network, hence the whole chain doesn't work.
> > 
> 
> 
> > Solutions you've tried
> > 1) To make sure everything works on the server running Qubes and the 
> > network itself I used a live boot Linux and tried all NICs. Every NIC was 
> > able to connect to both the main LAN and the separate VLAN using both DHCP 
> > and manual IP settings.
> > 
> > 2) As I listed above I tried cloning the 2nd gw from the main one and I 
> > tried creating from scratch
> > 
> > 3) I tried editing the gw network settings though nmcli and the GUI
> > 
> > 4) I booted the server with a Fedora 31 live USB, set network setting 
> > manually, copied out the 
> > /etc/sysconfig/network-scripts/ifcfg-interface-name and manually entered 
> > all those through nmcli
> > 
> > Just to reiterate once more, the network setup outside of Qubes is 100% 
> > functional. If I connect any machines to any segment of network to any port 
> > on the switch they always work as intended.
> > 
> 
> The thing is, you simply refuse to give us any of the detail that might be
> useful here - you don't identify the NICs (may be relevant), you don't
> tell us *what* configuration you have set on the VLAN, and (crucially)
> what configuration you have set on the NIC.
> When you used the live Fedora, did you connect both NICs to the ports?
> 
> I accept some reluctance to give out identifying data, but you
> cant expect help without this.
> 
> The key facts seem to be:
> 1. The NIC attached to pentest-gw has MAC address assigned, and works
> when attached to non-VLAN port on switch.
> 2. That NIC can be configured without error with static IP address.
> 3. That NIC does not automatically connect to a VLAN port, and the
> switch shows an error (off/on/blocked cycle)
> 
> Th obvious conclusion is that there's something wrong with your
> VLAN configuration of the NIC. (Since the NIC connected to the port
> under Fedora Live we can rule out problems with the NIC itself.)
> The fact that Fedora Live autoconfigures, but the Fedora template based
> qube does not, may indicate that there's some crucial package missing.
> Test this by creating an HVM, assigning the NIC, and booting from Fedora
> Live.
> 

Just for fun, can you run `lsmod|grep 8021q` in pentest-gw?
Post the name and content of your config file.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20200512154200.GA4736%40thirdeyesecurity.org.

Re: [qubes-users] What's your flow for new templateVM?

[unman]

On Mon, May 11, 2020 at 08:46:25PM +, 'Elliot Killick' via qubes-users 
wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA256
> 
> On 2020-05-11 14:26, 'Ryan Tate' via qubes-users wrote:
> > Saw the new f31 templateVM (thanks for that) and just curious how
> folks generally migrate to a new templateVM.
> >
> > I manually maintain this big text list of packages and just use
> > that
> to manually update the fresh templateVM to what I need. There's
> typically also some non package installs, which I include basic pointers
> for (think downloaded rpms and so forth), as well as some outside repos
> to add (e.g. keybase). There's also typically some packages I forgot to
> put on the list, which I can usually suss out by going through the bash
> history for the old template, although often there's one or two that
> slip through the cracks, which I find out about eventually and it's not
> a huge deal.
> >
> > I'm particularly curious if anyone does anything more
> > sophisticated
> than that, using salt or some other automated deploy system to prep new
> template images.
> >
> > Thanks for any tips!
> >
> I also keep a list of packages I want to have on each of my templates.
> For the switching part of each AppVM to the new TemplateVM (e.g.
> fedora-30 to fedora-31) I use a simple Python script that utilizes the
> Qubes Admin API:
> 
> #!/usr/bin/python3
> 
> import qubesadmin
> from qubesadmin.exc import *
> 
> from_templatevm = 'fedora-30'
> to_templatevm = 'fedora-31'
> 
> qubes = qubesadmin.Qubes().app.domains
> 
> for qube in qubes:
> if qube.name == from_templatevm:
> appvms = qube.appvms
> for appvm in appvms:
> print('Changing TemplateVM of:', appvm.name)
> try:
> appvm.__setattr__('template', to_templatevm)
> except QubesVMNotHaltedError:
> print("Cannot change TemplateVM while qube is turned on!
> ")
> 
> I usually just run this after my next reboot when almost (don't forget
> to shutdown the NetVMs) all my qubes will be turned off. This is much
> better than switching them manually one by one in Qubes Manager.
> 

Just for the record there's a GUI tool to do this.
System->ManageTemplates in Qube Manager

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20200512152355.GD4368%40thirdeyesecurity.org.

Re: [qubes-users] What's your flow for new templateVM?

[unman]

On Mon, May 11, 2020 at 03:02:06PM -0700, ryantate via qubes-users wrote:
> 
> 
> On Monday, May 11, 2020 at 11:11:45 AM UTC-4, unman wrote:
> 
> > If you want to install a package, don't open the template and install it 
> > there, edit the install.sls file to include the package, and run 
> > `qubesctl --skip-dom0 --targets=  state.apply install` 
> >
> 
> 
> Dumb question, where is install.sls (or where should I create it)? I poked 
> around in /srv in dom0 but still not sure
>  

You create it - you can bundle relevant files under subdirectory in
/srv/salt and then refer to them like this:
state.apply .state

> 
> >
> > I have full systems set up in salt to customise a new install as I want, 
> > with new templates and different setups. Sometimes it can be a bit 
> > shaky, and you *have* to check the logs, but it's great to run the full 
> > state, have a coffee, and come back to a fully configured system. 
> > For travel, I have a minimum state I can download and apply, to get a 
> > workable system with gpg, vpn, ssh set up out of the box. So cool. 
> >
> >
> Very intriguing. I am looking at
> 
> https://docs.saltstack.com/en/latest/ref/states/all/salt.states.pkg.html
> 
> https://www.qubes-os.org/doc/salt/
> 
> lmk if there is anything else I should read!
> 

>From another post:
I ran some training a few years back, and the notes are here:
https://github.com/unman/notes/tree/master/salt

They start with the simplest use of `qubesctl`, and work up to quite
complex configurations, but should be easy to understand.
There are examples in (naturally) "examples".

For some real world cases look in notes/config.

unman

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20200512152107.GC4368%40thirdeyesecurity.org.

Re: [qubes-users] Dividing Qubes Into Separate Networks (FAILED)

[unman]

On Mon, May 11, 2020 at 03:16:03PM +, 'Zsolt Bicskey' via qubes-users wrote:
> Here is full summary of where I am at. Could someone please provide guidance 
> with this? Thank you very much. 
> 
> 
> Qubes OS version
> Qubes OS R4.0
> 
> Affected component(s) or functionality
> Networking
> 
> Brief summary
> I tried to separate everything into to two subnets meanings 2 NICs, 2 
> gateways (sys-net), 2 firewalls. Everything works on the network before the 
> new gw and after it. All qubes can communicate to the firewall. After the 
> gateway everything works properly on the physical network as designed and can 
> get out to the internet if I connect any client other to it but the new 
> gateway.
> 
> The main gateway remains functional but the new one can't get on the network, 
> hence the whole chain doesn't work.
> 


> Solutions you've tried
> 1) To make sure everything works on the server running Qubes and the network 
> itself I used a live boot Linux and tried all NICs. Every NIC was able to 
> connect to both the main LAN and the separate VLAN using both DHCP and manual 
> IP settings.
> 
> 2) As I listed above I tried cloning the 2nd gw from the main one and I tried 
> creating from scratch
> 
> 3) I tried editing the gw network settings though nmcli and the GUI
> 
> 4) I booted the server with a Fedora 31 live USB, set network setting 
> manually, copied out the /etc/sysconfig/network-scripts/ifcfg-interface-name 
> and manually entered all those through nmcli
> 
> Just to reiterate once more, the network setup outside of Qubes is 100% 
> functional. If I connect any machines to any segment of network to any port 
> on the switch they always work as intended.
> 

The thing is, you simply refuse to give us any of the detail that might be
useful here - you don't identify the NICs (may be relevant), you don't
tell us *what* configuration you have set on the VLAN, and (crucially)
what configuration you have set on the NIC.
When you used the live Fedora, did you connect both NICs to the ports?

I accept some reluctance to give out identifying data, but you
cant expect help without this.

The key facts seem to be:
1. The NIC attached to pentest-gw has MAC address assigned, and works
when attached to non-VLAN port on switch.
2. That NIC can be configured without error with static IP address.
3. That NIC does not automatically connect to a VLAN port, and the
switch shows an error (off/on/blocked cycle)

Th obvious conclusion is that there's something wrong with your
VLAN configuration of the NIC. (Since the NIC connected to the port
under Fedora Live we can rule out problems with the NIC itself.)
The fact that Fedora Live autoconfigures, but the Fedora template based
qube does not, may indicate that there's some crucial package missing.
Test this by creating an HVM, assigning the NIC, and booting from Fedora
Live.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20200512151323.GA4368%40thirdeyesecurity.org.

[qubes-users] Re: Consider making tax deductable donations possible in the EU

[Lorenzo Lamas]

On Sunday, May 10, 2020 at 10:26:02 PM UTC+2, Michael Carbone wrote:
>
> On 5/9/20 2:17 PM, Lorenzo Lamas wrote: 
> > Whonix Project has partnered up with the CCT (Center for the Cultivation 
> of 
> > Technology, which is a charitable non-profit host organization in 
> Germany 
> > for international Free Software projects.) 
> > This makes it possible for all EU citizens to deduct donations from 500 
> EUR 
> > and up from their taxes. If Qubes project does the same, it may result 
> in 
> > more donations for the project. 
> > 
> >  
> https://forums.whonix.org/t/european-union-eu-wide-tax-deductible-donations-to-whonix-are-now-possible/9389
>  
> > https://www.whonix.org/wiki/Donate/Tax-Deductible 
>
> thanks for letting me/us know Lorenzo! I'd been in talks with CCT when 
> they first started but they had told me to wait until they were finished 
> getting set up. sounds like they are taking projects now, I'll email them. 
>
> -- 
> Michael Carbone 
>
> Qubes OS | https://www.qubes-os.org 
> @QubesOS  
>
> PGP fingerprint: D3D8 BEBF ECE8 91AC 46A7 30DE 63FC 4D26 84A7 33B4 
>


Great to hear! 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/6eb47b5e-ee5c-4b68-90f1-4fd085233c96%40googlegroups.com.

Re: [qubes-users] Connect to wifi - settings doesnt load

[Jarrah]

> If i left click I only see ethernet network, could it be that my network
> device is not working? I have Wireless Intel AX201 11ax, 2x2 + BT5.0.

There are a few reports on this mailing list of that not working from a
few months back. See "[qubes-users] Missing wifi on Intel NUC10i7FNK"
for example.

I can't comment on that specific card, but the output of the following
three commands (run in sys-net) will tell you whether the card is
available to configure:

* ip l -> should see a wls* interface.

* iwconfig -> same wls* interface but with more wifi specific information

* sudo dmesg | grep iwlwifi -> should show the driver starting and
firmware loading, but will print any errors which occurred. This This
output will be useful debugging here.


A potential stab in the dark, the "kernel-latest-qubes-vm" package may
have updates which solve the issue with that WiFi card. If the above
commands don't give you anything useful, try installing it and setting
that as the kernel for the sys-net VM. You'll find that setting in the
"advanced" tab of the sys-net settings in "Qube Manager".

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c8a9feef-9236-d544-4ddd-b55520bf3364%40undef.tools.

Re: [qubes-users] Connect to wifi - settings doesnt load

[Alaa Ashkar]

If i left click I only see ethernet network, could it be that my network
device is not working? I have Wireless Intel AX201 11ax, 2x2 + BT5.0.


On Tue, May 12, 2020, 14:04 Jarrah  wrote:

>
> > clicked save, but i didnt find a way to actually connect to it, how do i
> do
> > that?
> Try left clicking on the same icon. You should receive a list of
> available networks.
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAB2TdYAj1OUebX%3DoA381R7kruKeyB-HLQa9seRw-4Q3doqYfwg%40mail.gmail.com.

Re: [qubes-users] Connect to wifi - settings doesnt load

[Jarrah]

> clicked save, but i didnt find a way to actually connect to it, how do i do
> that?
Try left clicking on the same icon. You should receive a list of
available networks.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/50380f3d-121c-3e04-be4f-e3236bd2557d%40undef.tools.

Re: [qubes-users] Connect to wifi - settings doesnt load

[Alaa Ashkar]

Thanks for your email.

I tried to configure it like you said, i clicked edit connections, then on
the +, and chose wifi, and create, i found a screen that i can type the
SSID and some other parameters but not including the password, and i
clicked save, but i didnt find a way to actually connect to it, how do i do
that?

Thanks!

On Tue, May 12, 2020, 09:46 Jarrah  wrote:

>
> > Not able to run sys-net Settings. I would like to configure the wireless
> > networks.
> >
> > After adding "Settings" to sys-net in Qube Manager, clicking on "Service:
> > sys-net | Settings" produced no observable system response.
> >
> > Also running gnome_control_center fails.
> >
> > If i run:
> >
> > export XGD_CURRENT_DESKTOP=GNOME gnome_control_center
>
> Try configuring it from network manager either by right clicking on the
> icon in the taskbar and selecting "Edit Connections" or running
> `nm-connection-editor` at the sys-net terminal.
>
> Gnome settings isn't really a useful part of Qubes within a VM.
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAB2TdYCEqiRmy%3DPOnSeYUPwuFxv9ySdXc%2Bw%2BEmkHhfgTXtWNjw%40mail.gmail.com.

Re: [qubes-users] Dividing Qubes Into Separate Networks (FAILED)

[Jarrah]

>
> I also have an almost identical setup. I wanted to do what you were 
> attempting (Zsolt) but had the same outcome so I quit trying . I thought it's 
> not possible. I tried following this old article but the commands did no 
> longer work the same way 
> https://blog.invisiblethings.org/2011/09/28/playing-with-qubes-networking-for-fun.html
This document is quite old, but conceptually not bad. The commands in it
are likely to fail now, but the theory still applies.
>
> I am not sure if your goal is feasible at all. It didn't work for me but I am 
> fairly new to Linux so actually don't listen to me lol :)
I can confirm that splitting Qubes networking into two zones with two
different NICs is feasible. I have exactly this configuration using a
dual-nic motherboard and handling VLANs on a managed switch.
>
> I have the quad port commercial pfsense netgate appliance but I only use an 
> unmanaged switch unlike your unifi. I could not make the VLAN work. I ended 
> up just having 1 sys-net and separate everything with two firewalls and can 
> chose on each VM which route to take similar to what DG was saying. 
Having an unmanaged switch defeats the purpose of this. You will receive
two IP addresses on the same network. You may be able to assign the VLAN
on the NIC and have the PFSense device recognize it, but this is not
guaranteed to work.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d1cea2dc-8b99-7ce3-8dc4-e24b320fd641%40undef.tools.

Re: [qubes-users] Connect to wifi - settings doesnt load

[Jarrah]

> Not able to run sys-net Settings. I would like to configure the wireless
> networks.
>
> After adding "Settings" to sys-net in Qube Manager, clicking on "Service:
> sys-net | Settings" produced no observable system response.
>
> Also running gnome_control_center fails.
>
> If i run:
>
> export XGD_CURRENT_DESKTOP=GNOME gnome_control_center

Try configuring it from network manager either by right clicking on the
icon in the taskbar and selecting "Edit Connections" or running
`nm-connection-editor` at the sys-net terminal.

Gnome settings isn't really a useful part of Qubes within a VM.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b8ee8a99-ebb2-8ca7-e654-a2292200dad1%40undef.tools.