Re: [qubes-users] Is it possible to upgrade a Fedora 31 Template to Fedora 32?

[Claudio Chinicz]

Hey donoban,

Thanks. I'll take a look in  more details later on. It seems a bit long of 
a process to try right now.

Cheers

On Thursday, 5 November 2020 at 12:31:23 UTC+2 donoban wrote:

> On 11/5/20 7:23 AM, Claudio Chinicz wrote:
> > Hi All,
> > 
> > I have a Fedora 31 template where I've installed applications and made
> > customization, which I want to upgrade to Fedora 32 because of F31 EOL.
> > 
> > I've followed the process described
> > here https://fedoramagazine.org/upgrading-fedora-31-to-fedora-32/ but
> > got errors:
> > Error: 
> >  Problem 1: package rpmfusion-free-release-31-0.3.noarch requires
> > system-release(31), but none of the providers can be installed
> >   - fedora-release-31-4.noarch does not belong to a distupgrade 
> repository
> >   - problem with installed package rpmfusion-free-release-31-0.3.noarch
> >  Problem 2: package fedora-release-31-4.noarch requires
> > fedora-release-common = 31-4, but none of the providers can be installed
> >   - package rpmfusion-nonfree-release-31-0.3.noarch requires
> > system-release(31), but none of the providers can be installed
> >   - fedora-release-common-31-4.noarch does not belong to a distupgrade
> > repository
> >   - problem with installed package 
> rpmfusion-nonfree-release-31-0.3.noarch
> > 
> > Is there a way to upgrade Fedora 31 Template?
> > 
> > Thanks in advance for any input.
>
> Hi, try following this steps:
> https://www.qubes-os.org/doc/template/fedora/upgrade/
>
> If you still having problems with rpmfusion maybe disabling it helps.
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/985d4f53-7357-4a39-afa7-bd0536a02a5dn%40googlegroups.com.

[qubes-users] Is it possible to upgrade a Fedora 31 Template to Fedora 32?

[Claudio Chinicz]

Hi All,

I have a Fedora 31 template where I've installed applications and made 
customization, which I want to upgrade to Fedora 32 because of F31 EOL.

I've followed the process described 
here https://fedoramagazine.org/upgrading-fedora-31-to-fedora-32/ but got 
errors:
Error: 
 Problem 1: package rpmfusion-free-release-31-0.3.noarch requires 
system-release(31), but none of the providers can be installed
  - fedora-release-31-4.noarch does not belong to a distupgrade repository
  - problem with installed package rpmfusion-free-release-31-0.3.noarch
 Problem 2: package fedora-release-31-4.noarch requires 
fedora-release-common = 31-4, but none of the providers can be installed
  - package rpmfusion-nonfree-release-31-0.3.noarch requires 
system-release(31), but none of the providers can be installed
  - fedora-release-common-31-4.noarch does not belong to a distupgrade 
repository
  - problem with installed package rpmfusion-nonfree-release-31-0.3.noarch

Is there a way to upgrade Fedora 31 Template?

Thanks in advance for any input.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/fb0ab9ee-7621-43b7-a3ab-579dcdaa9bc2n%40googlegroups.com.

[qubes-users] Is there a Fedora 33 template?

[Claudio Chinicz]

Hi Guys,

Fedora 33 is out (GA). Any news about the new template?

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/f1b51287-8e0b-4e92-a578-5ff5dcd8bef0n%40googlegroups.com.

Re: [qubes-users] Why Fedora?

[Claudio Chinicz]

In the corporate world users usually have no choice but to use their laptops 
domain joined to the company MS AD, which enforces strict policies. This is 
required from a security point of view as well as from an operational point 
view, because user support may cost a lot of money. Users often cannot install 
applications on their notebooks and BYOD is avoided as much as possible and 
when inevitable usually not connected to corporate network but rather to some 
open/visitors wifi.

That's the reality I see. In this world, there is no free choice for the user, 
it comes as a package with everything they need. Of course, a user may request 
some special purpose software, but it will have to be through IT.

That's what I meant when I wrote about Qubes being far from being an enterprise 
product.

I'm not an advocate of Windows, it's just reality.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8c7a8856-69fa-4d82-a519-b67bcd5e1a0ao%40googlegroups.com.

Re: [qubes-users] Why Fedora?

[Claudio Chinicz]

Hi, I've been following this thread, as well as others on this user group.

Without being critic, or trying to bring some positive feedback, I can say that 
Qubes needs to evolve towards to being more user friendly and manageable as a 
corporate product. On the positive side, I can say from my personal experience 
that, once properly configured, it works and is stable. Maybe creating some 
user admin features that would limit what an end user can do would make it 
"user proof" (is there something like that?) and enterprise fit.

>From this perspective, the underlying OS is less of a concern, provided it is 
>stable and automatically upgradable.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/725d5f41-4b2b-4868-9884-9bf1781d90d5o%40googlegroups.com.

[qubes-users] Qubes T-shirts, polos, and sweatshirts now available from HELLOTUX

[Claudio Chinicz]

Great initiative! I'm happy and proud I've been using Qubes for an year and a 
half now.

Also, this user group is very active and has been helping people, new users as 
well as veterans and very technical people.

It's important to help fund this important Project, very relevant to all users.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/17a3b559-0f28-4746-af4c-6c3f9e758cc9o%40googlegroups.com.

Re: [qubes-users] vCPUs count over-booking

[Claudio Chinicz]

Hi unman, thank you for the detailed explanation. Regards

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0e4a85b7-4d98-4919-81d5-75ef9f51bb4bo%40googlegroups.com.

[qubes-users] vCPUs count over-booking

[Claudio Chinicz]

Hi,

I noted that my sum total of vCPUs is larger than the actual number of vCPUs.

Maybe Xen works at the minimum in order to keep sum total of vCPUs within 
limits?

One thing I tried was to disable VT-x and then HVMs (min and max vCPUs is the 
same) would not start.

Any ideas of how Xen manages vCPUs within the limits of the processor?

Regards

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/98d0e85c-9235-41e6-b4b8-85ac2534582fo%40googlegroups.com.

[qubes-users] "Qubes Architecture Next Steps: The GUI Domain" by Marek Marczykowski-Górecki & Marta Marczykowska-Górecka

[Claudio Chinicz]

Hi,

Great idea to separate display management from dom0.

You wrote it'll optional in the initial release and also not compatible with 
Windows because lack of support on qrexec.

Will it allow dom0 to manage display for a Windows qube and the new display 
management quebe for other AppVMs?

For one it sounds strange to me to have to entities managing display but you 
also wrote there may be more than one display management VM so I wonder one of 
them can still be dom0.

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e99f51f4-09dc-4900-a59c-2b942b42d154%40googlegroups.com.

Re: [qubes-users] Backup/Restore issue

[Claudio Chinicz]

Yep. When I first installed the apps on the template and afterwards shut it off 
I saw the apps in the AppVM.

The issue happened when I've restored. And, again, I did not reinstall the apps 
in the template, they were already there. The dnf install command resulted in 
no change but it somehow "reminded" Qubes they exist and so I could use the 
again as UI/windows.

Regards

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/6d44d12a-9c99-4905-966e-cecdf6e5bf24%40googlegroups.com.

[qubes-users] Backup/Restore issue

[Claudio Chinicz]

Hi,

I've created an oathtool AppVM following instructions from here: 
https://www.qubes-os.org/doc/multifactor-authentication/

On the Fedora-30-minimal template I've also installed Nautilus file manager and 
Gedit to easy my process of token creation.

I tested it and it worked as designed. Then I want to test backup/recovery 
before I would rely on this to store my tokens.

To my surprise, when I restored the OTP VM together with it's template the 
applications (file manager and text editor) did not show up as available 
applications.

I had to open a terminal on the template and run again dnf install. Although 
they were not installed again (because they were present when I backed up), 
after running dnf install Qubes "remembered" they were there as if were 
notified just then.

Did I miss something when I backed up? Or is this behaviour expected?

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d909ef1b-3668-46ae-b48c-2aba8550326d%40googlegroups.com.

Re: [qubes-users] Secure Boot on Dell 5590 UEFI - failed signature verification

[Claudio Chinicz]

Hi, thanks for answering.

I had read that post before and understood it is possible and in the plans for 
the future (by then) and decided to give it a try and see if someone made 
progress.

Regarding Anti Evil Made I think it is not necessary because I set my boot 
config to boot from disk only and the setup is password protected.

In the event someone removes the disk and tampers with the boot partition I'd 
like to rely on Secure Boot to check on it's integrity before proceeding.

I'm not a high profile or a targeted individual. All I am is a curious person, 
another Joe.

Cheers

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1ad316a1-8e4a-46c4-a149-da4ca98e9191%40googlegroups.com.

[qubes-users] Secure Boot on Dell 5590 UEFI - failed signature verification

[Claudio Chinicz]

Hi,

I have Qubes running on this machine. It boots UEFI from disk.

On the boot menu I've checked the Secure Boot and it was unchecked (never 
changed before). I've checked the box and reboot. So it failed signature 
verification and I had to uncheck it and continue without secure boot.

Is there a way to change it and use secure boot? I mean, considering "I 
trust" what I have now on disk and I want to define the current state as 
trusted.

Thanks to all

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/f6930299-01ae-4789-90b7-5ae9eb4f%40googlegroups.com.

Re: [qubes-users] Benefits of Sys-Firewall

[Claudio Chinicz]

Thanks you dhorf and Sven for explaining the subject. I've learnt from your 
words.

Best Regards

On Saturday, 29 February 2020 02:49:59 UTC+2, dhorf-hfr...@hashmail.org 
wrote:
>
> On Fri, Feb 28, 2020 at 06:00:04PM -0600, Sven Semmler wrote: 
>
> > You want your sys-firewall to be separate from sys-net for the same 
> > reason: compartmentalization. 
>
> as usual "depends on your threat model". 
>
> if you are into outbound-firewalling of appvms, not doing so in the 
> appvm makes a lot of sense for the reasons you stated. 
> but you could do that in sys-net too, entirely without sys-firewall. 
>
> unless your threat model involves the same (or cooperating) attackers 
> compromising your sys-net from the outside that want to break out of 
> your appvm... 
>
>
> > I hope others will correct me if I got anything wrong. 
>
> looks good to me. 
> but i would like to add some off-default-config considerations/rambling. 
>
> what if your attacker has some l2-ish network linux exploit? 
> lets take something like CVE-2018-15688 as an example. 
> ipv6 dhcp problem, in both systemd and networkmanager. 
>
> afaik no one ever really evaluated the impact on a qubes system. 
> because ipv6 is "disabled" in the default config. 
> but what does that mean? 
> "ipv6 disabled in qubes" means ipv6 is disabled _within_ qubes. 
> as in, it is actualy enabled (by default) in sys-net in some ways, 
> just not forwarding it on the qubes-internal network links. 
>
> so worst case, an attacker can compromise your sys-net, then compromise 
> your sys-firewall, then your appvm. all with the same exploit, just 
> having to go hop-by-hop. 
>
> one way to mitigate a scenario like that is to involve something that 
> is _very_ much not linux. like qubes-mirage-firewall. or a bsd fw. 
> which of course is a "threat model" and "subjective considerations" thing. 
>
> because one side of it is ... it makes it much more unlikely for a 
> single attacker to have a walkthrough with a single exploit. 
> == it makes it less likely for an attacker to compromise the whole chain. 
>
> otoh ... now there are two ip stacks involved, and the mirage one 
> certainly got a lot less eyeballing than the linux one. 
> == it makes it more likely for an attacker to compromise part of your 
> chain. 
>
> and there are "env" factors to consider too. 
> sure, if you dont have the ram to run separate linux based firewall vms, 
> go ahead and dump all of it (inkl sys-usb) into sys-net. 
> or your HW doesnt have (usable) IOMMU and you run your sys-net/sys-usb 
> pci-vms as "pv" instead of "hvm". 
> your overall security posture will (probably) still be better than with 
> a plain linux (or anything else) system, even though you take some 
> shortcuts that are not default config or recommended. 
>
> qubes provides a lot of different options there, with a reasonable 
> default config, but (depending on your threat model) going beyond 
> that can be quite reasonable too. 
>
>
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ffc9ee62-3159-40a8-b0a0-69910faecbfd%40googlegroups.com.

[qubes-users] Benefits of Sys-Firewall

[Claudio Chinicz]

Hi All,

Being a non technical user of Qubes, I'd like to ask the community about the 
benefits of using an additional VM between an AppVM and Sys-Net.

I do not configure Sys-Firewall and therefore it should be "all" open, right?

If I were to configure it for a specific purpose, like for a MailVM, I'd have 
to use 'clones' of Sys-Firewall, one for each specific purpose, correct?

So, I got confused. Is there a benefit for using Sys-Firewall without 
configuring it?

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9fe4e4fe-837c-40bc-9591-1a63a8b6a1d1%40googlegroups.com.

Re: [qubes-users] Parrot template

[Claudio Chinicz]

Hi, it worked! Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b8f1d646-4370-42c8-91e9-03a9b0997be1%40googlegroups.com.

[qubes-users] Parrot template

[Claudio Chinicz]

Hi,

I'm trying to build a Parrot template from Debian-10 following the steps 
from here: https://docs.parrotlinux.org/getting-started/install-qubes/ (
Option 2 - Build a ParrotOS TemplateVM on top of a Debian TemplateVM).

I do not know what to do when I get to:

[user@parrot ~]$ sudo cat < /etc/apt/sources.list.d/parrot.list
 # ParrotOS repository
deb http://deb.parrotsec.org/parrot stable main contrib non-free
#deb-src http://deb.parrotsec.org/parrot stable main contrib non-free
EOF

So I've created /etc/apt/sources.list.d/parrot.list using vim and added this 
one line:
deb http://deb.parrotsec.org/parrot stable main contrib non-free


When I run sudo apt install parrot-core parrot-archive-keyring parrot-drivers 
parrot-skel I get the following errors:
Reading package lists... Done
Building dependency tree   
Reading state information... Done
E: Unable to locate package parrot-core
E: Unable to locate package parrot-archive-keyring
E: Unable to locate package parrot-drivers
E: Unable to locate package parrot-skel

Please help.

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/85a1b2e5-67be-42a2-9806-749b6c7c5c99%40googlegroups.com.

Re: [qubes-users] Is Qubes Split GPG safe?

[Claudio Chinicz]

Hi Marek,

Thanks for acknowledging the issue with the next version of TB. I believe it is 
critical that the Qubes team be aware of this as part of the roadmap for new 
features/versions.

Just to clarify, I'm looking for a replacement for TB+Enigmail that works with 
Split gpg and *also* supports Oath2 as I use Gmail accounts with my mail client.

Best Regards

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/06e9b647-b240-4dfc-9b46-5eadc1a2cd0b%40googlegroups.com.

Re: [qubes-users] Is Qubes Split GPG safe?

[Claudio Chinicz]

Thanks. Actually, I'm looking for a replacement for TB+Enigmail. Regards

On Friday, 14 February 2020 09:48:29 UTC+2, Johannes Graumann wrote:
>
> On 2020-02-13 18:36, Claudio Chinicz wrote:
>
> Hi Sven,
>
> Thanks again. I've tried them and found the following:
>
> - KMail is not allowed to authenticate with Oath2 from Google (my accounts 
> are Gmail)
> - Evolution now does not support Gnupg
> - Claws is not available for Fedora
>
> Sorry for insisting.. any ideas?
>
> Best
>
> https://fedoraproject.org/wiki/Using_GPG_with_Evolution
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d5757e58-63af-42af-971b-aa02dc4c8a3c%40googlegroups.com.

Re: [qubes-users] Is Qubes Split GPG safe?

[Claudio Chinicz]

Hi Frédéric,

Thanks, I've managed to install claws-mail on my Fedora template. The 
problem is that Claws-mail does not support Oath2 (Google) authentication, 
just like Kmail.

Evolution does support Oatrh2 authentication but instead of Gnupg it 
supports Open PGP, the same standard that TB 79 will support, replacing 
Enigmail.

Would Open PGP support/integrate with Qubes Split GPG?

Regards

On Thursday, 13 February 2020 19:50:21 UTC+2, Frédéric Pierret wrote:
>
>
> On 2020-02-13 18:36, Claudio Chinicz wrote: 
> > Hi Sven, 
> > 
> > Thanks again. I've tried them and found the following: 
> > 
> > - KMail is not allowed to authenticate with Oath2 from Google (my 
> accounts are Gmail) 
> > - Evolution now does not support Gnupg 
> > - Claws is not available for Fedora 
>
> 'claws-mail' package is available in Fedora. 
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/f43b72b8-532b-4703-8109-ad5a85027647%40googlegroups.com.

Re: [qubes-users] Is Qubes Split GPG safe?

[Claudio Chinicz]

Hi Sven,

Thanks again. I've tried them and found the following:

- KMail is not allowed to authenticate with Oath2 from Google (my accounts are 
Gmail)
- Evolution now does not support Gnupg
- Claws is not available for Fedora

Sorry for insisting.. any ideas?

Best

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ed3007a8-783d-4f06-8f8f-4f2a01aad365%40googlegroups.com.

Re: [qubes-users] Is Qubes Split GPG safe?

[Claudio Chinicz]

Hi,

But TB 79 will not support 
Enigmail(https://wiki.mozilla.org/Thunderbird:OpenPGP:2020), so we'll "miss" 
split gpg working with TB.

Any alternative with GUI like TB?

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d801b381-28a3-4c24-b1f8-67b193ed5d94%40googlegroups.com.

Re: [qubes-users] Will Thunderbird 78 kill Qubes Split gpg?

[Claudio Chinicz]

Hi Sven, thanks for the explanation of how mail clients work. I've realized 
mutt is not for me, I need a GUI and I'll have to continue using TB or similar, 
regardless of split gpg. Best Regards

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/99bb76f9-72a7-468d-81c6-9b3160193698%40googlegroups.com.

Re: [qubes-users] Is Qubes Split GPG safe?

[Claudio Chinicz]

Hi uman, thanks for clarifying the issue. Regards

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d2eb0215-fe3f-4747-b2a1-dec7967a0420%40googlegroups.com.

Re: [qubes-users] Will Thunderbird 78 kill Qubes Split gpg?

[Claudio Chinicz]

Hi Sven,

Can you provide more details on mutt and how to implement its use with 
Qubes (and TB I suppose)?

Thanks in advance

On Tuesday, 11 February 2020 19:35:27 UTC+2, Sven Semmler wrote:
>
> On Tue, Feb 11, 2020 at 12:06:23AM -0800, Claudio Chinicz wrote: 
> > I've just read this post from TB (
> https://wiki.mozilla.org/Thunderbird:OpenPGP:2020) and do not know if it 
> will support Qubes Split gpg without Enigmail? 
> > Anyone knows? 
>
> If I understand the Wiki entry correctly the Thunderbird team does 
> not plan to use GnuPG because they don't want the user to have to 
> install it separately and they can't bundle it with Thunderbird 
> because of incompatible licenses. 
>
> Instead they plan to use other open-source libraries to implement 
> GPG/PGP compatible en/decryption and signing/verification. 
>
> In that case I don't see how it could work with Qubes Split GPG. 
>
> Makes me happy I switched to mutt late last year. But that's not really 
> a solution for the masses. 
>
> /Sven 
>
> -- 
>  public key: https://www.svensemmler.org/0x8F541FB6.asc 
> fingerprint: D7CA F2DB 658D 89BC 08D6 A7AA DA6E 167B 8F54 1FB6 
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8476a431-30f8-40eb-be09-6a44b888020a%40googlegroups.com.

[qubes-users] Will Thunderbird 78 kill Qubes Split gpg?

[Claudio Chinicz]

Hi All,

I've just read this post from TB 
(https://wiki.mozilla.org/Thunderbird:OpenPGP:2020) and do not know if it will 
support Qubes Split gpg without Enigmail?

Anyone knows?

Regards 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9459b8d3-b23c-41e6-a98b-83b3ba6b8426%40googlegroups.com.

Re: [qubes-users] Is Qubes Split GPG safe?

[Claudio Chinicz]

Hi, thanks. It is now much clearer the inner workings of split gpg.

On Sunday, 9 February 2020 15:49:45 UTC+2, qubes...@riseup.net wrote:
>
> Claudio Chinicz wrote: 
> > All the idea behind this is to keep your keys in a safe place (VM 
> > without network), isolated from your application VM. 
> > 
> > I've installed the work-gpg (keys vault) and created a mail VM with 
> > Thunderbird and Enigmail. 
> > 
> > While Enigmail cannot create new keys on the vault (I have to 
> > manually import them), it allows me to download/copy the contents of 
> > my keys (private). 
> > 
> > So, if my mail VM is compromised my keys may be stolen/used 
> > regardless of my keys being kept in a vault! 
> > 
> > So, what's the purpose of split gpg? 
>
> The private keys should never touch the online VM running thunderbird. 
> The keys should be generated on the offline VM and the only way to 
> perform operations that require the private key must be via the 
> split GPG setup. 
>
> If you generated the key on the online VM it is probably best to 
> start with a new one if you would like to get the benefit of the split GPG 
> setup of Qubes. 
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/486e2167-59c2-4160-8f0e-ce3ed0c1ce7f%40googlegroups.com.

Re: [qubes-users] Is Qubes Split GPG safe?

[Claudio Chinicz]

‎Thanks, I now better understand the concepts.

On Sunday, 9 February 2020 15:41:39 UTC+2, awokd wrote:
>
> Claudio Chinicz: 
> > All the idea behind this is to keep your keys in a safe place (VM 
> without network), isolated from your application VM. 
> > 
> > I've installed the work-gpg (keys vault) and created a mail VM with 
> Thunderbird and Enigmail. 
> > 
> > While Enigmail cannot create new keys on the vault (I have to manually 
> import them), it allows me to download/copy the contents of my keys 
> (private). 
> > 
> > So, if my mail VM is compromised my keys may be stolen/used regardless 
> of my keys being kept in a vault! 
> > 
> > So, what's the purpose of split gpg? 
> > 
> > Thanks for any feedback. 
> > 
> In a way, it's security by obscurity- some code looking for keys won't 
> know to request through split-gpg. It prompts every time it accesses 
> your keys with split-gpg, with the theory being the user will recognize 
> an unauthorized request and deny it. In practice, it's difficult to 
> determine authorized vs. unauthorized with Thunderbird because it 
> requests access every time a signed email arrives. 
>
> -- 
> - don't top post 
> Mailing list etiquette: 
> - trim quoted reply to only relevant portions 
> - when possible, copy and paste text instead of screenshots 
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/83c9d18c-0720-47d5-be07-89337013828b%40googlegroups.com.

Re: [qubes-users] Enigmail fails to create private key

[Claudio Chinicz]

Hi,

Thank you very much. I've succeeded creating a new key pair in whonix-ws, 
sending it to my mail VM and importing into the work-gpg via 
qubes-gpg-import-key command.

Best Regards

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/bbcaafcd-e8bb-436f-a2f5-26f993fe9fe1%40googlegroups.com.

[qubes-users] Is Qubes Split GPG safe?

[Claudio Chinicz]

All the idea behind this is to keep your keys in a safe place (VM without 
network), isolated from your application VM.

I've installed the work-gpg (keys vault) and created a mail VM with Thunderbird 
and Enigmail.

While Enigmail cannot create new keys on the vault (I have to manually import 
them), it allows me to download/copy the contents of my keys (private).

So, if my mail VM is compromised my keys may be stolen/used regardless of my 
keys being kept in a vault!

So, what's the purpose of split gpg?

Thanks for any feedback.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/3963f411-b862-47a5-8289-600550007024%40googlegroups.com.

[qubes-users] Split GPG with Enigmail error

[Claudio Chinicz]

Hi,

I've created a work-gpg back-end AppVM from Fedora-30 and a mail VM also from 
Fedora-30 where I run Thunderbird with Enigmail set to use the 
qubes-gpg-client-wrapper.

When I try to generate a key using Enigmail I get the following error (from 
log):

2020-02-02 21:37:38.781 keyRing.jsm: generateKey:
2020-02-02 21:37:38.781 [CONSOLE] /usr/bin/qubes-gpg-client-wrapper --charset 
utf-8 --display-charset utf-8 --no-auto-check-trustdb --batch --no-tty 
--no-verbose --status-fd 2 --gen-key2020-02-02 21:37:38.781 [CONSOLE] %echo 
Generating key
Key-Type: EDDSA
Key-Curve: Ed25519
Key-Usage: sign
Subkey-Type: ECDH
Subkey-Curve: Curve25519
Subkey-Usage: encrypt
Name-Real: 
Name-Email: 
Expire-Date: 1825
 
2020-02-02 21:37:38.782 [DEBUG] keyRing.jsm: generateKey: subprocess = [object 
Object]
2020-02-02 21:37:38.782 enigmailKeygen.js: Start: gKeygenRequest = [object 
Object]
2020-02-02 21:37:38.800 [DEBUG] enigmailKeygen.js: onDataAvailable() 
qubes-gpg-client: unrecognized option '--gen-key'

2020-02-02 21:37:38.802 [DEBUG] enigmailKeygen.js: Terminate:
2020-02-02 21:37:38.824 [DEBUG] enigmailCommon.jsm: dispatchEvent f=resizeDlg
2020-02-02 21:37:43.029 [DEBUG] enigmailKeygen.js: CloseRequest
2020-02-02 21:37:47.157 [DEBUG] enigmailMessengerOverlay.js: 
updateOptionsDisplay: 
2020-02-02 21:37:47.157 [DEBUG] funcs.jsm: collapseAdvanced:
2020-02-02 21:37:50.789 [DEBUG] enigmailHelp.js: enigLoadPage

Any ideas on what's wrong with my config?

Thanks in advance

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/faefeb5a-8cb6-4992-b609-d50e115b23ea%40googlegroups.com.

[qubes-users] Split GPG issue

[Claudio Chinicz]

Hi All,

I'm trying to use Split GPG with Thunderird/EnigmaMail (running on an AppVM 
based on whonix-ws). My work-gpg VM is based on Fedora-30.

I've followed the instructions found on 
https://www.qubes-os.org/doc/split-gpg/.  I had to create ~/.profile 
manually with the QUBES_GPG_AUTOACCEPT on dom0.

When I configure Enigmamail Preferences and "overide" with the 
qubes-gpg-client-wrapper and push the "ok" button I get this error message 
"Cannot connect to gpg-agent. Maybe your system uses a specialized tool for 
passphrase handling (e.g. gnome-keyring, seahorse-agent, KDE wallet 
manager, ...). Unfortunately Enigmail cannot control the passphrase timeout 
for the tool you are using. Therefore the respective timeout settings in 
Enigmail are disregarded." (my work-gpg VM starts automatically when I 
start Thunderbird).

I've tried to create a key and (obviously) got an error message. I've 
checked the Enigmamail log/terminal and found this:

/usr/bin/qubes-gpg-client-wrapper --charset utf-8 --display-charset utf-8 
--no-auto-check-trustdb --batch --no-tty --no-verbose --status-fd 2 
--gen-key%echo Generating key
Key-Type: EDDSA
Key-Curve: Ed25519
Key-Usage: sign
Subkey-Type: ECDH
Subkey-Curve: Curve25519
Subkey-Usage: encrypt
Name-Real: 
Name-Email:  
Expire-Date: 1825 

Has anyone had the same issue?

Additionally, I would like to ask if anyone knows how to use the same 
work-gpg VM with multiple AppVM? I want to use also with another 
Thunderbird instance running on a regular (non-torrified) VM with another 
email account. Should I add another line in qubes.Gpg (dom0) with the "<2nd 
AppVM> work-gpg allow" statement as a second line, beneath "personal-whonix 
work-gpg allow"?

Thanks in advance

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b14ad0e5-8366-4f1b-a088-dd16195ebe09%40googlegroups.com.

Re: [qubes-users] Re: qvm-create-windows-qube 2.0

[Claudio Chinicz]

ׁHi Elliot,

I've downloaded again and succeeded creating the HVM.

I had a Windows 10 HVM I built manually just booting from the ISO and where 
I did not succeed installing the QWT (boot after the QWT install would 
freeze).

Would you recommend building a Template from this HVM?

The big advantage I saw in this implementation was that I can confortably 
run my applications with 2GB (minimum) vs 6GB in my previous HVM. Another 
advantage of the QWT is that I can send files from Windows to any other 
PV/HPV VM using qrexec.

What's intriguing me is that copy/paste between VMs is not working. When I 
ctl+shift+C on my Windows VM I see the popup saying I can ctl+shift+V on 
another VM but when I do so nothing is pasted. Any ideas?

Thank you very much for this scripts/Windows VM builder.

Regards

On Sunday, 26 January 2020 10:06:56 UTC+2, Elliot Killick wrote:
>
>
> On 2020-01-24 13:16, Claudio Chinicz wrote: 
> > Hi Elliot, 
> > 
> > I've followed the instruction, had to manually download win10x64.iso and 
> > when I ran the "./qvm-create-windows-qube.sh -n sys-firewall -oyp 
> > firefox,notepadplusplus,office365business -i win10x64.iso -a 
> > win10x64-pro.xml win10-work" command I got the following error: 
> > 
> > Error mounting /dev/loop2: GDBus.error:org.freedesktop.vdisk2.error 
> failed: 
> > error mounting /dev/loop2 at run/media/user/cccoma_x64fre_en-us_dv9: 
> wrong 
> > fs type, bad option, bad superblock on dev/loop2, missing codepage or 
> > helper program, or other error 
> > 
> > Any idea? 
> > 
> > Thanks 
>
>
> Yes, I believe I've gotten that error message before and it basically 
> means that the udisksctl command could not mount the ISO because the 
> filesystem is corrupted in some way. Where did you get the ISO from? If 
> you got if from the download-windows.sh script then make sure the 
> SHA-256 sum checks out with the one in the SHA256SUMS file. If the sums 
> don't match then just retry the download. The download-windows.sh script 
> will automatically verify the checksum. 
>
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/4ce3c0ce-eb74-4b04-9ae1-e9aaaff7250f%40googlegroups.com.

[qubes-users] Re: qvm-create-windows-qube 2.0

[Claudio Chinicz]

Hi Elliot,

I've followed the instruction, had to manually download win10x64.iso and 
when I ran the "./qvm-create-windows-qube.sh -n sys-firewall -oyp 
firefox,notepadplusplus,office365business -i win10x64.iso -a 
win10x64-pro.xml win10-work" command I got the following error:

Error mounting /dev/loop2: GDBus.error:org.freedesktop.vdisk2.error failed: 
error mounting /dev/loop2 at run/media/user/cccoma_x64fre_en-us_dv9: wrong 
fs type, bad option, bad superblock on dev/loop2, missing codepage or 
helper program, or other error

Any idea?

Thanks

On Monday, 13 January 2020 11:49:12 UTC+2, Elliot Killick wrote:
>
> -BEGIN PGP SIGNED MESSAGE- 
> Hash: SHA256 
>
> Hello, all! 
>
> Not too long ago I released qvm-create-windows-qube but quit pushing 
> changes for a while because I realized there was still a of work to be 
> done and I wanted to get it out of the dev/beta phase before releasing a 
> new version. 
>
> Well, it's over 200 commits later and I would say it's well out of 
> beta now. 
>
> Biggest new features include: 
>
>   * Use a much newer Windows 7 7601 ISO for Windows 7 
>   * Support Windows 8.1-10 Pro/Enterprise (ISO downloads from Microsoft 
> included) 
>   * Support Windows 10 Enterprise LTSC (Also download provided) 
>   * Support Windows Server 2008 R2 - Windows Server 2019 (Also downloads 
> provided) 
>   * Chocolatey integration 
>   * Option to slim down Windows installation (Similar to the following 
> but much more refined due to especially the disabling of services I 
> found could break things in a way that would result in a bad UX, 
> also expanded for Windows 10: 
> https://www.qubes-os.org/doc/windows-template-customization/) 
>   * Test signing Qubes GUI driver is now enabled during Windows 
> installation process to skip a reboot 
>   * Hardcoding trial product key in answer files (or anywhere) is no 
> longer necessary, Windows will use embedded trial key without any 
> user interaction by default 
>   * windows-mgmt is air gapped 
>   * Travis CI is being used for integration testing 
>   * Tons of code cleanup, reorganization and refactoring  (I'm of the 
> OpenBSD mindset where having clean (correct) code is just as 
> important as having functional code, so a lot of stuff just got 
> rewritten) 
>   * Everything is much more stable (No more lame sleeps for arbitrary 
> amounts of time) 
>   * MIT license 
>
> Additionally, I made a PGP key (also using Qubes Split GPG) so hopefully 
> my code and anything I else I make can reach you a lot more securely. 
>
> Repo can be found here, please star if you find it useful :) 
>
> https://github.com/elliotkillick/qvm-create-windows-qube 
> 
>  
>
> I'm working towards having this project be similar (or superior) to 
> VMWare's Windows "Easy Install" feature but on Qubes: 
> https://www.youtube.com/watch?v=1OpDXlttmE0 
>
> Regards, 
>
> Elliot 
> -BEGIN PGP SIGNATURE- 
>
> iHUEARYIAB0WIQQBj7nebfoT+xj7VVL5uQ1E+D3V8gUCXhw9CQAKCRD5uQ1E+D3V 
> 8iT9AQDlMN4TUEQV8SrvfBj3Df0utv3i/GIDLlt+6DpxnNmSAAD/Uz7tihtwjHXz 
> /Dl6qtbYhoph8DSHLKwIevhP/iKArw8= 
> =tnno 
> -END PGP SIGNATURE- 
>
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e0a1d799-7aba-4d80-b75f-35783b90a7f6%40googlegroups.com.

[qubes-users] Re: Bluetooth headphones with USB bluetooth dongle RESOLVED

[Claudio Chinicz]

Thanks a lot! It worked as you wrote. It's just that the sound from my mic 
is a little bit lower than when I use it with my phone.

Best

On Monday, 20 January 2020 11:54:34 UTC+2, tortuga verde wrote:
>
> Make sure template has these packages installed:
> qubes-usb-proxy bluez blueman pulseaudio-module-bluetooth
>  
> Start the VM. Connect the dongle to the VM. Put the speaker/headphones in 
> pairing mode. Open Bluetooth Devices and click search. Let the search 
> finish. Do NOT connect to it yet.Run these commands:
>  
> pulseaudio -k
> pulseaudio -D
>  
> Now connect the speaker/headphones. It should pair and connect 
> successfully. Run rhythmbox, sound should be routed to the headphones.
>  
> Source: 
> https://www.reddit.com/r/Qubes/comments/eppk3l/usb_bluetooth_dongle_for_audio/
>  
>  
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/2e83fd63-9750-4a51-acff-3165d9aa3dfa%40googlegroups.com.

[qubes-users] Re: Why Windows 10 is slow? Is it because of HVM?

[Claudio Chinicz]

Hi,

As far as I understand, HVMs should be faster than PV. With the latter, the 
OS makes hyper calls to the hyper-visor while HVMs simply see virtualized 
hardware through the hyper visor.
 
I use Win 10 HVM with 6GB RAM and see no difference from another notebook 
where I run Win 10 bare metal with 8GB.

Maybe you're running Win with 4GB?

Regards

On Sunday, 19 January 2020 08:34:44 UTC+2, Guerlan wrote:
>
> Windows 10 VM is considerably slower than my traditional PV VMs, the ones 
> that come with Qubes. In fact no one would notice that my PV VMs are 
> virtualized, they look just like regular bare metal machines.
>
> However, Windows 10 has lags. Anyone would notice and think either the 
> computer is slow or the system is badly virtualized. For example, when I 
> press Win button, it takes a while for the menu to appear. I can only think 
> that it's because Windows 10 is running in HVM mode. Should I try running 
> it in PV mode? If so, how?
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c13d0818-62c2-43e5-8f23-ffe4d8940807%40googlegroups.com.

[qubes-users] Cannot use bluetooth headset with Fedora-30 + Bluez

[Claudio Chinicz]

Hi All,

I've installed Bluez and Pulse Audio on a Fedora-30 based VM. When I attach 
my Bluetooth USB dongle to the VM I see the Bluetooth icon in the upper 
right corner.

If I click on the icon it opens Bluetooth Manager and I can scan and find 
my headset. Then I "trust" it and successfully pair it.

To my surprise, when I open the browser and play any sound it comes out of 
the embedded speakers in my computer (Dell Latitude 5590 Core i5 8th gen).

When I open  Pulse Audio Control to configure the audio I see only "Qubes 
vChan Output/Input" and not the Bluez device.

Any ideas?

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/7f1ffdd8-9911-496b-9a54-b409f06aedd2%40googlegroups.com.

Re: [qubes-users] Bluetooth USB dongle

[Claudio Chinicz]

Thanks Francesco!

On Thursday, 7 November 2019 13:53:13 UTC+2, Francesco wrote:
>
>
>
> On Thu, Nov 7, 2019 at 8:13 AM Claudio Chinicz  > wrote:
>
>> Hi,
>>
>> I want to buy a Bluetooth USB to connect my PC with Qubes 4 to an ear 
>> phone. The device I'm considering says its compatible with Fedora and Linux 
>> Kernel 3.0.34, 3.2.20, 3.4 and later.
>>
>> Has anyone done it before? Can I use it with an AppVM created from the 
>> Fedora 30 Template? 
>>
>
> Yes, but not any appVM, I would use the one to which the USB controller is 
> assigned, that is sys-usb or sys-net, according to what you selected during 
> Qubes installation.  Obviously it will work ONLY with what is played in 
> either sys-net or sys-usb. 
>
> Will I need to change the Template and install any driver?
>>
>
> probably not, check you BT adapter manual
>
> If you need to route the audio of all appVMs to BT, there is a way even if 
> the audio quality may decrease a bit. There are external hardware 3.5 audio 
> jack converters to BT. It works perfectly and they are cheap.
> Best
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/58428130-311a-480c-8a6e-b8d393d32c1f%40googlegroups.com.

[qubes-users] Bluetooth USB dongle

[Claudio Chinicz]

Hi,

I want to buy a Bluetooth USB to connect my PC with Qubes 4 to an ear 
phone. The device I'm considering says its compatible with Fedora and Linux 
Kernel 3.0.34, 3.2.20, 3.4 and later.

Has anyone done it before? Can I use it with an AppVM created from the 
Fedora 30 Template? Will I need to change the Template and install any 
driver?

Thanks in advance for any feed-back.

Claudio

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/74ce0eb3-ca6d-4ffd-9fd4-436c6b708322%40googlegroups.com.

Re: [qubes-users] Re: QSB #050: Reinstalling a TemplateVM does not reset the private volume

[Claudio Chinicz @ Gmail]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Hey,

Thanks a lot, this has ended a 3 weeks fight to reinstall whonix. I've
changed default firewall to UpdateVM and it worked.

Best Regards

On 26/07/2019 15:12, 'awokd' via qubes-users wrote:
> Claudio Chinicz: > >> Using mirage-firewall-wifi as UpdateVM to download 
> updates for
Dom0; this >> may take some time... > > Don't think Mirage supports
running as UpdateVM. Try a Debian or Fedora > based AppVM instead. >
-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEwqrWIZ87/1+fYNr8Qc96sKyouBUFAl07CcUACgkQQc96sKyo
uBXLig//VFSf5+TWjLe4xPKSiTabReLOujaPR6Ids71z9655WBmOcD70H1grLCVX
J/bxXuaLXmaJcDaLBtikExtarHh5UY5gf/hdUrSIp3nvV2gZI6bNHbvI1GXLJ4ez
Y7A9f+afQa+gVlxydCw6jwX5oc7OZYSL6RbPoiz0tclMYnggidaeIuSxqAhp7AOn
jpqR0fLCil3w6M2ALL/NfrnOHTryKTb1eFTNEaT8HH1tIz7jXgpxFSCUAqBfqUcx
PnkppqvKaB6xqZLUIcstD3y7QgipPr+uZKL+MuLGJf31T1xVwH6VXAzxSkhjp72j
+Y9PZSBz/Kg3p5yuMfmjRarNLvROZzqbdvpvoOhu5dtooultaxDL0is9cdyc96WS
rN8Nar4x5JqXDdHuFc7q48m5N38bLV8EXHw6uqrUU7q5DlhGAOMcNn9ajiB0h2MR
Ov9xjNU7exuk5jQSGdNQkeO7sgAMa9dnLS9VirLZHC6Xtvw2PZGmDYyvk25WNQWp
3aYr6vRV+uiLtnmGY8Ta/yLJ6OdRmZp6NOYOl72wXtQBtcWNceykSLaqh0mHwPbD
GBq2MCRTi+IPjF87ajT7qZmGP5amBn88Bfx+FpMEc6y4D01HW88hvZwEMYmLFMQU
4qqQ5IQTKpXz3eKrmTmTki8HZ+9ULHwLDx5ExIduyaGeXF1dwHg=
=XY4U
-END PGP SIGNATURE-

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/7098c3fd-f483-7100-4556-95f0967023df%40gmail.com.

[qubes-users] Re: QSB #050: Reinstalling a TemplateVM does not reset the private volume

[Claudio Chinicz]

Hi Andrew,

After removing all Whonix related templates and VMs, I've folllowed the 
link you suggested (https://www.whonix.org/wiki/Qubes/Install) and run into 
errors (see below).

Any ideas why the "sudo qubesctl state.sls qvm.anon-whonix" fails and 
reports the whonix-gw and ws are missing? I thought it would install the 
templates anew, specially because there are instructions saying we should 
first remove whonix completely.

Best

[claudio@dom0 ~]$ sudo qubesctl state.sls qvm.anon-whonix
[ERROR   ] Command '['systemd-run', '--scope', 'qubes-dom0-update', '-y', 
'--best', '--allowerasing', '--disablerepo=*', 
'--enablerepo=qubes-templates-community', '--clean', '--action=install', 
'qubes-template-whonix-ws-15']' failed with return code: 1
[ERROR   ] stdout: Running scope as unit: 
run-r73c74b031ca0467aa7984ab0632f7f78.scope
Using mirage-firewall-wifi as UpdateVM to download updates for Dom0; this 
may take some time...
[ERROR   ] retcode: 1
[ERROR   ] Error occurred installing package(s). Additional info follows:

errors:
- Running scope as unit: run-r73c74b031ca0467aa7984ab0632f7f78.scope
  Using mirage-firewall-wifi as UpdateVM to download updates for Dom0; 
this may take some time...
[WARNING ] /var/cache/salt/minion/extmods/states/ext_state_qvm.py:142: 
DeprecationWarning: BaseException.message has been deprecated as of Python 
2.6
  status = Status(retcode=1, result=False, stderr=err.message + '\n')

[ERROR   ] == ['features'] ==
Virtual Machine does not exist!

== ['tags'] ==
[SKIP] Skipping due to previous failure!
[ERROR   ] Command '['systemd-run', '--scope', 'qubes-dom0-update', '-y', 
'--best', '--allowerasing', '--disablerepo=*', 
'--enablerepo=qubes-templates-community', '--action=install', 
'qubes-template-whonix-gw-15']' failed with return code: 1
[ERROR   ] stdout: Running scope as unit: 
run-r40ec4f8030284021a2f80d44af49d36f.scope
Using mirage-firewall-wifi as UpdateVM to download updates for Dom0; this 
may take some time...
[ERROR   ] retcode: 1
[ERROR   ] Error occurred installing package(s). Additional info follows:

errors:
- Running scope as unit: run-r40ec4f8030284021a2f80d44af49d36f.scope
  Using mirage-firewall-wifi as UpdateVM to download updates for Dom0; 
this may take some time...
[ERROR   ] == ['features'] ==
Virtual Machine does not exist!

== ['tags'] ==
[SKIP] Skipping due to previous failure!
local:
--
  ID: template-whonix-ws-15
Function: pkg.installed
Name: qubes-template-whonix-ws-15
  Result: False
 Comment: Error occurred installing package(s). Additional info follows:
  
  errors:
  - Running scope as unit: 
run-r73c74b031ca0467aa7984ab0632f7f78.scope
Using mirage-firewall-wifi as UpdateVM to download 
updates for Dom0; this may take some time...
 Started: 11:16:43.589367
Duration: 5101.908 ms
 Changes:   
--
  ID: whonix-ws-tag
Function: qvm.vm
Name: whonix-ws-15
  Result: False
 Comment: == ['features'] ==
  Virtual Machine does not exist!
  
  == ['tags'] ==
  [SKIP] Skipping due to previous failure!
 Started: 11:16:48.694020
Duration: 17.289 ms
 Changes:   
--
  ID: whonix-ws-update-policy
Function: file.prepend
Name: /etc/qubes-rpc/policy/qubes.UpdatesProxy
  Result: True
 Comment: File /etc/qubes-rpc/policy/qubes.UpdatesProxy is in correct 
state
 Started: 11:16:48.713516
Duration: 3.164 ms
 Changes:   
--
  ID: whonix-get-date-policy
Function: file.prepend
Name: /etc/qubes-rpc/policy/qubes.GetDate
  Result: True
 Comment: File /etc/qubes-rpc/policy/qubes.GetDate is in correct state
 Started: 11:16:48.716793
Duration: 1.201 ms
 Changes:   
--
  ID: template-whonix-gw-15
Function: pkg.installed
Name: qubes-template-whonix-gw-15
  Result: False
 Comment: Error occurred installing package(s). Additional info follows:
  
  errors:
  - Running scope as unit: 
run-r40ec4f8030284021a2f80d44af49d36f.scope
Using mirage-firewall-wifi as UpdateVM to download 
updates for Dom0; this may take some time...
 Started: 11:16:48.718085
Duration: 2780.185 ms
 Changes:   
--
  ID: whonix-gw-tag
Function: qvm.vm
Name: whonix-gw-15
  Result: False
 Comment: == ['features'] ==
  Virtual Machine does not exist!
  
  == ['tags'] ==
  [SKIP] Skipping due to previous failure!
 Started: 11:16:51.498524
Duration: 15.627 ms
 Changes:   
--
  ID: whonix-gw-update-policy
Function: file.prepend
Name: /etc/qubes-rpc/policy/qubes.UpdatesProxy
  Result: True
 Comment: File 

[qubes-users] Re: QSB #050: Reinstalling a TemplateVM does not reset the private volume

[Claudio Chinicz]

Hi Andrew,

I needed to reinstall Whonix-gw after having removed all templates. I've 
followed the instructions contained below on "Workaround"  
https://www.qubes-os.org/doc/reinstall-template/#manual-method and issued 
command "sudo qubes-dom0-update --enablerepo=qubes-templates-community
qubes-template-whonix-gw" on dom0.

I've got a message "Using  as UpdateVM to download updates 
for Dom0; this may take some time" but after many hours nothing happened.

Did I miss something?

Thanks


On Thursday, 25 July 2019 07:14:34 UTC+3, Andrew David Wong wrote:
>
> -BEGIN PGP SIGNED MESSAGE- 
> Hash: SHA512 
>
> Dear Qubes Community, 
>
> We have just published Qubes Security Bulletin (QSB) #050: Reinstalling 
> a TemplateVM does not reset the private volume. The text of this QSB is 
> reproduced below. This QSB and its accompanying signatures will always 
> be available in the Qubes Security Pack (qubes-secpack). 
>
> View QSB #050 in the qubes-secpack: 
>
> https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-050-2019.txt 
>
> Learn about the qubes-secpack, including how to obtain, verify, and read 
> it: 
>
> https://www.qubes-os.org/security/pack/ 
>
> View all past QSBs: 
>
> https://www.qubes-os.org/security/bulletins/ 
>
> ``` 
>
>
>  ---===[ Qubes Security Bulletin #50 ]===--- 
>
>  2019-07-24 
>
>
>   Reinstalling a TemplateVM does not reset the private volume 
>
> Description 
> === 
>
> In Qubes OS, we have the ability to reinstall a TemplateVM by running 
> `qubes-dom0-update --action=reinstall qubes-template-...` in dom0. [1] 
> This is supposed to reset the corresponding TemplateVM to the state of 
> the published package, i.e., no local changes should remain. 
>
> One uncommon reason to perform such a reinstallation is that you suspect 
> that a TemplateVM may be compromised. In such cases, it is very 
> important that no local changes persist in order to ensure that the 
> TemplateVM is no longer compromised. 
>
> Due to a regression in R4.0 [2], however, reinstalling a TemplateVM 
> using qubes-dom0-update does not completely reset all local changes to 
> that TemplateVM. Although the tool itself and our documentation claim 
> that the private volume of the TemplateVM is reset during 
> reinstallation, the private volume does not actually get reset. This 
> could allow a TemplateVM to remain compromised across a reinstallation 
> of that TemplateVM using qubes-dom0-update. 
>
> Workaround 
> == 
>
> Fixed packages are forthcoming. In the meantime, we recommend avoiding 
> the qubes-dom0-update method of reinstalling a TemplateVM. Instead, we 
> recommend manually removing the TemplateVM, then installing it again. 
> Detailed instructions for this manual method are documented here: 
>
> https://www.qubes-os.org/doc/reinstall-template/#manual-method 
>
> (Note that we have updated this page with a warning against the 
> automatic method.) 
>
> Patching 
> = 
>
> We expect to have fixed packages available next week. In the meantime, 
> please follow the workaround described in the previous section. We will 
> update this QSB when fixed packages are available. 
>
> Credits 
>  
>
> Thank you to Andrey Bienkowski > for 
> discovering and reporting this issue. 
>
> References 
> === 
>
> [1] https://www.qubes-os.org/doc/reinstall-template/ 
> [2] 
> https://github.com/QubesOS/qubes-core-admin-linux/commit/552fd062ea2bb6c2d05faa1e64e172503cacbdbf#diff-6b87ee5cdb9e63b703415a14e5a505cdL192
>  
>
> - -- 
> The Qubes Security Team 
> https://www.qubes-os.org/security/ 
>
> ``` 
>
> This announcement is also available on the Qubes website: 
> https://www.qubes-os.org/news/2019/07/24/qsb-050/ 
>
> - -- 
> Andrew David Wong (Axon) 
> Community Manager, Qubes OS 
> https://www.qubes-os.org 
>
> -BEGIN PGP SIGNATURE- 
>
> iQIzBAEBCgAdFiEEZQ7rCYX0j3henGH1203TvDlQMDAFAl05LEEACgkQ203TvDlQ 
> MDCA2Q//SBZ/v5eDrOauzdvQcqpgDJHGZyT34b1POcu8u4iAFWXBrnBSYgefDN0d 
> uMoxcZOy+q+GCy9r176MWl17m1td3ev/WnSgCwcUnDvegC2jLacixqMuoVxXDW3A 
> 6Mvu/Ui73O7bh3fAemoRHP7ts4ZKCZ9LGWEcIzlzR+Sg6jYDLC2sg3xRhp+G1GLX 
> Jduisn0ZnsTOGAgPnt0MZarn2MXoQt6A+6IwbN5g48Y/2anjiwz45Etkl9y2XTQZ 
> kfWelmuraf+adKrbqEjYEapl6ARuPsuoR1rb3sSEqVApHZY1syfAioLNHbOfRrmW 
> oqNPK/GnkOo7wWXyymZPQDDXor6GojYrLbocUcI+KcObiFnGEeqzzRp+s9lm641t 
> cXHdk+309U1H+z7DRKWeeGW2UZ39hof14bxemWqQnIaLYn0flOX15ke8DANDh9dF 
> 7BRDyTuoFBqOy3W8Ab1iJoVi5ZhyNDOOmzXzkvqyP0lzAtX2AtJlXWUGMIAo+Pqp 
> z6JH3qXbpBZgJb71qIOU85Eb9FfYgseQa9y2msswiGCh/xpv+/il7WP577/w/FKr 
> GzV/h2Bw/QTcFj+nLMCnCVF0RZ8XwZ9wz6p/Qy4DxYseNyV0C4efv0zrErzX9a4x 
> /Ug8jcexTq96sawNTCLVIiIIdAtsIy3y7NCDQtjswiIxVCZKMcQ= 
> =5Wik 
> -END PGP SIGNATURE- 
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion 

Re: [qubes-users] Building Whonix Templates Error

[Claudio Chinicz]

On Tuesday, 16 July 2019 17:19:21 UTC+3, unman  wrote:
> On Mon, Jul 15, 2019 at 11:47:47PM -0700, Claudio Chinicz wrote:
> > Hi Folks,
> > 
> > I'm trying to rebuild the Whonix templates because I've broken the gateway 
> > and removed them all.
> > 
> > I've followed the steps outlined here 
> > (https://www.qubes-os.org/doc/building-whonix-template/#building-whonix-templates)
> >  and got an error when issuing the "make qubes-vm" command (see below the 
> > full output).
> > 
> > I thought it was missing Debian keys and so I've downloaded keys for Debian 
> > 8, 9 and 10 from https://ftp-master.debian.org/keys.html but still got the 
> > same error.
> > 
> > Any help is much appreciated.
> 
> > E: Release signed by unknown key (key id 7638D0442B90D010)
> >The specified keyring 
> > /home/user/qubes-builder/qubes-src/builder-debian/keys/stretch-debian-archive-keyring.gpg
> >  may be incorrect or out of date.
> >You can find the latest Debian release key at 
> > https://ftp-master.debian.org/keys.html
> > Error in debootstrap
> > make[1]: *** 
> > [/home/user/qubes-builder/qubes-src/builder-debian//Makefile-legacy.debian:20:
> >  /home/user/qubes-builder/chroot-vm-stretch/home/user/.prepared_base] Error 
> > 1
> 
> key id 7638D0442B90D010 is the Debian archive signing key.
> Whonix-15 is based on buster.
> The relevant  keys should be automatically installed, if you follow
> the process.
> Either you didnt update qubes-builder, or run make-get-sources, or you may 
> have found a bug in the Whonix builder.

Hi Unman,

I've deleted my Builder VM and created a new one from Fedora-29 following the 
instructions from https://www.qubes-os.org/doc/building-whonix-template/

I've done copy/paste from the browser to the terminal in order to avoid typo 
errors and ended up with the same error:

E: Release signed by unknown key (key id 7638D0442B90D010)
   The specified keyring 
/home/user/qubes-builder/qubes-src/builder-debian/keys/stretch-debian-archive-keyring.gpg
 may be incorrect or out of date.
   You can find the latest Debian release key at 
https://ftp-master.debian.org/keys.html
Error in debootstrap
make[1]: *** 
[/home/user/qubes-builder/qubes-src/builder-debian//Makefile-legacy.debian:20: 
/home/user/qubes-builder/chroot-vm-stretch/home/user/.prepared_base] Error 1
make: *** [Makefile:219: mgmt-salt-vm] Error 1

Please note that I followed the instructions to build whonix-14 templates (on 
the link above there is no whonix-15). The idea was to build Whonix-14 and 
later on to update it.

Please let me know if you'd like me to run any test/command and provide 
feed-back.

I'm really willing to succeed here since I've deleted my whonix-14 templates 
(all of them) and since then I do not have whonix on my Qubes (4.0.1).

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/52d8db88-0b7d-4104-828c-4238f88c2f4a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Building Whonix Templates Error

[Claudio Chinicz]

Hi Folks,

I'm trying to rebuild the Whonix templates because I've broken the gateway and 
removed them all.

I've followed the steps outlined here 
(https://www.qubes-os.org/doc/building-whonix-template/#building-whonix-templates)
 and got an error when issuing the "make qubes-vm" command (see below the full 
output).

I thought it was missing Debian keys and so I've downloaded keys for Debian 8, 
9 and 10 from https://ftp-master.debian.org/keys.html but still got the same 
error.

Any help is much appreciated.

Thanks

[user@whonix-builder qubes-builder]$ make qubes
Currently installed dependencies:
python2-pyyaml-5.1-1.fc29.x86_64
createrepo_c-0.11.1-1.fc29.x86_64
debootstrap-1.0.109-3.fc29.noarch
devscripts-2.19.2-3.fc29.x86_64
dialog-1.3-15.20180621.fc29.x86_64
dpkg-dev-1.18.25-8.fc29.noarch
git-2.20.1-1.fc29.x86_64
perl-Digest-MD5-2.55-417.fc29.x86_64
perl-Digest-SHA-6.02-4.fc29.x86_64
python2-sh-1.12.14-10.fc29.noarch
rpm-build-4.14.2.1-2.fc29.x86_64
rpmdevtools-8.10-7.fc29.noarch
make[1]: Entering directory '/home/user/qubes-builder'
/home/user/qubes-builder/scripts/create-archive 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/gui-agent-xen-hvm-stubdom
 gui-agent-xen-hvm-stubdom-5f57a59.tar.gz gui-agent-xen-hvm-stubdom/
~/qubes-builder/chroot-dom0-fc29/home/user/qubes-src/vmm-xen/gui-agent-xen-hvm-stubdom
 ~/qubes-builder
~/qubes-builder
mv 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/gui-agent-xen-hvm-stubdom/gui-agent-xen-hvm-stubdom-5f57a59.tar.gz
 /home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen
sed -i 
"s#@gui-agent-xen-hvm-stubdom@#gui-agent-xen-hvm-stubdom-5f57a59.tar.gz#" 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/xen.spec.in
/home/user/qubes-builder/scripts/create-archive 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/core-vchan-xen
 core-vchan-xen-42d07fb.tar.gz core-vchan-xen/
~/qubes-builder/chroot-dom0-fc29/home/user/qubes-src/vmm-xen/core-vchan-xen 
~/qubes-builder
~/qubes-builder
mv 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/core-vchan-xen/core-vchan-xen-42d07fb.tar.gz
 /home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen
sed -i "s#@core-vchan-xen@#core-vchan-xen-42d07fb.tar.gz#" 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/xen.spec.in
/home/user/qubes-builder/scripts/create-archive 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/stubdom-dhcp
 stubdom-dhcp-35cbeb3.tar.gz stubdom-dhcp/
~/qubes-builder/chroot-dom0-fc29/home/user/qubes-src/vmm-xen/stubdom-dhcp 
~/qubes-builder
~/qubes-builder
mv 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/stubdom-dhcp/stubdom-dhcp-35cbeb3.tar.gz
 /home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen
sed -i "s#@stubdom-dhcp@#stubdom-dhcp-35cbeb3.tar.gz#" 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/xen.spec.in
/home/user/qubes-builder/scripts/create-archive 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/gui-common
 gui-common-c611481.tar.gz gui-common/
~/qubes-builder/chroot-dom0-fc29/home/user/qubes-src/vmm-xen/gui-common 
~/qubes-builder
~/qubes-builder
mv 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/gui-common/gui-common-c611481.tar.gz
 /home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen
sed -i "s#@gui-common@#gui-common-c611481.tar.gz#" 
/home/user/qubes-builder/chroot-dom0-fc29//home/user/qubes-src/vmm-xen/xen.spec.in
-> Building vmm-xen (xen.spec) for fc29 dom0 (logfile: 
build-logs/vmm-xen-dom0-fc29.log)
--> Done:
  qubes-src/vmm-xen/pkgs/dom0-fc29/noarch/xen-doc-4.12.0-2.fc29.noarch.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/python2-xen-4.12.0-2.fc29.x86_64.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/python2-xen-debuginfo-4.12.0-2.fc29.x86_64.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/python3-xen-4.12.0-2.fc29.x86_64.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/python3-xen-debuginfo-4.12.0-2.fc29.x86_64.rpm
  qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/xen-4.12.0-2.fc29.x86_64.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/xen-debuginfo-4.12.0-2.fc29.x86_64.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/xen-debugsource-4.12.0-2.fc29.x86_64.rpm
  qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/xen-devel-4.12.0-2.fc29.x86_64.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/xen-hypervisor-4.12.0-2.fc29.x86_64.rpm
  qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/xen-libs-4.12.0-2.fc29.x86_64.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/xen-libs-debuginfo-4.12.0-2.fc29.x86_64.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/xen-licenses-4.12.0-2.fc29.x86_64.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/xen-qemu-tools-4.12.0-2.fc29.x86_64.rpm
  
qubes-src/vmm-xen/pkgs/dom0-fc29/x86_64/xen-qubes-vm-4.12.0-2.fc29.x86_64.rpm
  

[qubes-users] Re: how to reinstall whonix-14 templates

[Claudio Chinicz]

On Monday, 8 July 2019 11:37:35 UTC+3, Claudio Chinicz  wrote:
> Hi,
> 
> I've broken my whonix-gw-14 when trying to upgrade to whonix-15 and ended up 
> removing both gw and ws templates for version 14.
> 
> I'me trying to reinstall following instructions from 
> https://www.qubes-os.org/doc/templates/ but it does not work.
> 
> Anyone can help with instructions to download whonix-14 from scratch?
> 
> Thanks in advance,
> Claudio

Hi Chris,

I tried on dom0 to issue the commands and I got a message "using sys-firewall 
as UpdateVM to download updates for Dom0; this may take some time..." but 
nothing happened.

Did I do something wrong? did I miss something?

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/fe26c995-bd47-4759-913d-743cf0854f1e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] how to reinstall whonix-14 templates

[Claudio Chinicz]

Hi,

I've broken my whonix-gw-14 when trying to upgrade to whonix-15 and ended up 
removing both gw and ws templates for version 14.

I'me trying to reinstall following instructions from 
https://www.qubes-os.org/doc/templates/ but it does not work.

Anyone can help with instructions to download whonix-14 from scratch?

Thanks in advance,
Claudio

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/3fd648f8-6dcb-441e-8a1e-48d386f3ce23%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] HCL Dell 5590 i5 8th gen 16GB RAM 512G SSD

[Claudio Chinicz]

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAOu9i0hp72yX2TVWop7xWVuekRQuMqyS9a%2BzwgW2Dp3YJJTy0g%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.


Qubes-HCL-Dell_Inc_-Latitude_5590-20190604-081450.yml
Description: application/yaml

[qubes-users] Backup while VMs are running??

[Claudio Chinicz]

Hi All,

I make few backups because I fear doing backups while using my VMs, specially 
Windows 10 and Linux Mint HVMs. So, I do it once in a while, when I have have 
some free time and can spen not using the computer while it prepares the 
backups, after having shut down the VMs.

All the discussion about updates breaking Qubes makes me wonder I should do 
backups more often.

Is it possible to do backups of HVMs and VMs in general while using them? I'm 
afraid I may have an issue when restoring.

Thanks in advance,
Claudio

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/53d9215d-b552-424b-b62c-af8ff0a8312d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Do you need to harden sys-firewall in any way?

[Claudio Chinicz]

On Thursday, 16 May 2019 09:49:25 UTC+3, Eccentric Butterfly  wrote:
> There seems to not be much information on this. Are there any steps you can 
> or should take to harden your firewall vm? There are services in the qube 
> settings called: qubes-firewall, qubes-network, qubes-update-check, 
> qubes-updates-proxy. Neither of them are used in sys-net or sys-firewall. 
> Should they be?

Hi, check this out: 
http://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewall-for-qubesos/

Maybe it"ll answer your concerns and even raise them..

Best

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ba35bb36-43c7-49eb-9f4f-b58b8e0fd481%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Dell 5590?

[Claudio Chinicz]

On Monday, 13 May 2019 03:24:31 UTC+3, ljul...@gmail.com  wrote:
> I’ve found one the Dell Latitude i5 16 GB RAM 256 GB. Is this the one you are 
> using? If not, do you think this would work anyway?

Hey, its the same I use except for the disk size. I use 25% of 512GB and would 
use 50% of the 256GB, still ok for me. Depends on how much disk you need.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d5fcf9e1-799d-4d6c-a70a-11a2e04c4407%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Dell 5590?

[Claudio Chinicz]

On Saturday, 11 May 2019 17:33:11 UTC+3, ljul...@gmail.com  wrote:
> I’m looking for a good laptop for Qubes at around 1K and a kind fellow user 
> of this forum had said that the dell 5590 is a reliable laptop for Qubes 
> usage. Has anybody else experienced Qubes with the dell 5590? What are your 
> thoughts and experiences?

Hi, I've been using Dell 5590 (i5 8th gen, 16GB RAM and 512GB SSD) with Qubes 
for about two months with no complaints. I use Windows 10 Pro, Linux Mint 19, 
Mirage as firewall and a VM built on the Debian 9 template.

Install was easy and there is no error message on boot/shutdown. There are 
unexpected behaviours, which do not seem to be due to this particular 
brand/model but rather as general, as you can see here on this users'group.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/128e327a-424d-4b0f-884f-64ec526bc86f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Windows 10 Pro HVM does not work with Mirage Firewall

[Claudio Chinicz]

On 28/04/2019 17:29, Claudio Chinicz wrote:
> On 22/04/2019 16:28, Thomas Leonard wrote:
>> On Friday, April 19, 2019 at 12:19:28 PM UTC+1, Claudio Chinicz wrote:
>>> On 19/04/2019 12:05, Thomas Leonard wrote:
>>>> On Thursday, April 18, 2019 at 9:53:25 AM UTC+1, Claudio Chinicz wrote:
>>>>> Hi All,
>>>>>
>>>>> Once again I turn to the Qubes Community to ask for help.
>>>>>
>>>>> I have a Mirage Firewall VM that works with HVM (Linux Mint) and
>>>>> Debian/Fedora template-based PVMs.
>>>>>
>>>>> My Windows 10 HVM, which works just fine through sys-firewall
>>>>> (copy/paste and file sharing with other VMs dont, but I can live
>>>>> with it).
>>>>>
>>>>> I've tried setting up networking manually by adding its IP, mask and
>>>>> gateway and rebooting but it did not work. It works with DHCP instead
>>>>> when getting network through sys-firewall.
>>>>>
>>>>> I've followed all the ideas from here
>>>>> (https://www.windowscentral.com/how-regain-internet-access-after-installing-update-windows-10)
>>>>>
>>>>> and it still did not work.
>>>>>
>>>>> One last piece of information, my Windows 10 Pro was successfully
>>>>> activated using a key I provided.
>>>>>
>>>>> Any ideas? This is not critical, since I can continue using
>>>>> sys-firewall, but would love to free some memory by using Mirage.
>>>>
>>>> There might be clues in the firewall VM's logs. You can see them
>>>> with Qubes Manager (right-click on mirage-firewall and choose Logs
>>>> -> guest-mirage-firewall.log). Open the logs just after booting
>>>> Windows and seeing that networking doesn't work and look at the end.
>>>>
>>>> You can also do "sudo xl console mirage-firewall" in dom0 to follow
>>>> the logs and then boot Windows and watch for new entries.
>>>>
>>>
>>> Hi Thomas,
>>>
>>> Thanks in advance. Please see below logs from guest-mirage-firewall.log.
>>> My Windows VM is 10.137.0.21.
>>>
>>> What really surprises me is why I does not work even if I set my
>>> ip/mask/gateway as it works with Linux Mint? What's different with
>>> Windows?
>>>
>>> Best Regards,
>>>
>>> Claudio
>>>
>>> 2019-04-18 11:20:11 -00:00: INF [qubes.db] got update:
>>> "/mapped-ip/10.137.0.21/visible-ip" = "10.137.0.21"
>>> 2019-04-18 11:20:11 -00:00: INF [qubes.db] got update:
>>> "/mapped-ip/10.137.0.21/visible-gateway" = "10.137.0.23"
>> [...]
>>> 2019-04-18 11:20:22 -00:00: INF [client_eth] who-has 10.137.0.1?
>>> 2019-04-18 11:20:22 -00:00: INF [client_eth] unknown address; not
>>> responding
>>
>> (continued at https://github.com/mirage/qubes-mirage-firewall/issues/56)
>>
> 
> Hi everybody,
> 
> We've made progress investigating this issue (see on
> https://github.com/mirage/qubes-mirage-firewall/issues/56) and now it
> seems related to Windows drivers (I'm currently using virtual PCI
> devices provided by QEMU with is Windows 10 HVM).
> 
> There may be a solution using Windows PV network driver
> (https://xenproject.org/windows-pv-drivers/) but there are 5 options and
> I'm not sure which ones to download and install. They are WINDOWS PV
> 8.2.2 BUS DRIVER (XENBUS.TAR), WINDOWS PV 8.2.2 INTERFACE
> (XENIFACE.TAR), WINDOWS PV 8.2.2 NETWORK CLASS DRIVER (XENVIF.TAR),
> WINDOWS PV 8.2.2 NETWORK DEVICE DRIVER (XENNET.TAR), WINDOWS PV 8.2.2
> STORAGE HOST ADAPTER DRIVER (XENVBD.TAR).
> 
> One one has ever tried using Windows PV net driver with Windows HVM? any
> help much appreciated.
> 
> Thanks,
> 
> Claudio
> 
> 
> 

Hi All,

Thanks to Thomas efforts and patience, now Mirage for Qubes can be used
by Windows 10 Pro (HVM) users as a lightweight alternative to sys-firewall.

For those interested, please see on GitHub:
https://github.com/mirage/qubes-mirage-firewall/issues/56

Best

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/qaeq19%2461eb%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.


signature.asc
Description: OpenPGP digital signature

[qubes-users] Re: ThinkPad T480

[Claudio Chinicz]

On 30/04/2019 12:00, ljul8...@gmail.com wrote:
> Thank you for the reply. I just checked your laptop model, it looks nice and 
> also slightly cheaper than the ThinkPad! How much SSD are you using?
> 
24% (includes a lot of personal data, not just software) out of 512GB

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/qa930v%241lq1%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.


pEpkey.asc
Description: application/pgp-keys

[qubes-users] Re: ThinkPad T480

[Claudio Chinicz]

On 30/04/2019 11:31, ljul8...@gmail.com wrote:

Hello everyone, I think I will buy a Lenovo ThinkPad T480 since it has good 
reviews here on the list but I can’t find out which processor to choose. Which 
one do you think will work for Qubes and Whonix? I’m planning to get Qubes and 
Whonix for light browsing such as accessing Facebook and Instagram through Tor, 
no gaming, video streaming or anything like that.

- Intel Core i5-8250U Processor (6MB Cache, up to 3.40GHz).
- Intel Core i7-8550U Processor (8MB Cache, up to 4.00GHz).
- Intel Core i5-8350U Processor (6MB Cache, up to 3.60GHz).
- Intel Core i7-8650U Processor (8MB Cache, up to 4.20GHz).

Thank you for any reply.


Hi,

I'm using Dell 5590 with Intel Core i5-8250U, 16GB RAM and SSDs and 
pretty happy with my Qubes 4.0.1. I use one Windows VM with 6GB, one 
Linux Mint with 2GB and one VM based on Debian template.


Good luck!

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/qa92bf%248148%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Windows 10 Pro HVM does not work with Mirage Firewall

[Claudio Chinicz]

On 22/04/2019 16:28, Thomas Leonard wrote:

On Friday, April 19, 2019 at 12:19:28 PM UTC+1, Claudio Chinicz wrote:

On 19/04/2019 12:05, Thomas Leonard wrote:

On Thursday, April 18, 2019 at 9:53:25 AM UTC+1, Claudio Chinicz wrote:

Hi All,

Once again I turn to the Qubes Community to ask for help.

I have a Mirage Firewall VM that works with HVM (Linux Mint) and
Debian/Fedora template-based PVMs.

My Windows 10 HVM, which works just fine through sys-firewall
(copy/paste and file sharing with other VMs dont, but I can live with it).

I've tried setting up networking manually by adding its IP, mask and
gateway and rebooting but it did not work. It works with DHCP instead
when getting network through sys-firewall.

I've followed all the ideas from here
(https://www.windowscentral.com/how-regain-internet-access-after-installing-update-windows-10)
and it still did not work.

One last piece of information, my Windows 10 Pro was successfully
activated using a key I provided.

Any ideas? This is not critical, since I can continue using
sys-firewall, but would love to free some memory by using Mirage.


There might be clues in the firewall VM's logs. You can see them with Qubes 
Manager (right-click on mirage-firewall and choose Logs -> 
guest-mirage-firewall.log). Open the logs just after booting Windows and seeing 
that networking doesn't work and look at the end.

You can also do "sudo xl console mirage-firewall" in dom0 to follow the logs 
and then boot Windows and watch for new entries.



Hi Thomas,

Thanks in advance. Please see below logs from guest-mirage-firewall.log.
My Windows VM is 10.137.0.21.

What really surprises me is why I does not work even if I set my
ip/mask/gateway as it works with Linux Mint? What's different with Windows?

Best Regards,

Claudio

2019-04-18 11:20:11 -00:00: INF [qubes.db] got update:
"/mapped-ip/10.137.0.21/visible-ip" = "10.137.0.21"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update:
"/mapped-ip/10.137.0.21/visible-gateway" = "10.137.0.23"

[...]

2019-04-18 11:20:22 -00:00: INF [client_eth] who-has 10.137.0.1?
2019-04-18 11:20:22 -00:00: INF [client_eth] unknown address; not responding


(continued at https://github.com/mirage/qubes-mirage-firewall/issues/56)



Hi everybody,

We've made progress investigating this issue (see on 
https://github.com/mirage/qubes-mirage-firewall/issues/56) and now it 
seems related to Windows drivers (I'm currently using virtual PCI 
devices provided by QEMU with is Windows 10 HVM).


There may be a solution using Windows PV network driver 
(https://xenproject.org/windows-pv-drivers/) but there are 5 options and 
I'm not sure which ones to download and install. They are WINDOWS PV 
8.2.2 BUS DRIVER (XENBUS.TAR), WINDOWS PV 8.2.2 INTERFACE 
(XENIFACE.TAR), WINDOWS PV 8.2.2 NETWORK CLASS DRIVER (XENVIF.TAR), 
WINDOWS PV 8.2.2 NETWORK DEVICE DRIVER (XENNET.TAR), WINDOWS PV 8.2.2 
STORAGE HOST ADAPTER DRIVER (XENVBD.TAR).


One one has ever tried using Windows PV net driver with Windows HVM? any 
help much appreciated.


Thanks,

Claudio



--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/qa4dcf%2447ip%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Fedora-29 update does not work

[Claudio Chinicz]

On 26/04/2019 7:36, Jon deps wrote:

On 4/24/19 12:58 PM, Claudio Chinicz wrote:

On 18/03/2019 12:10, Claudio Chinicz wrote:

Hi All,

I'm getting notification that I need to update Fedora-29 (Qubes 
4.0.1), I do it but it keeps asking to update.


On Qubes manager all VMs based on Fedora-29 template show they need 
to restart because I've updated Fedora-29, although it keeps asking 
to update.


I've even updated it manaully (opened terminal and issued sudo dnf 
update/upgrade) and it seems updated, but still Qubes thinks it needs 
to update.


Any insights?

Thanks,

Claudio Chinicz



Hi again,

After a long time, the issue returned and for almost I see the update 
icon on the upper right corner indicating I need to update Fedora 29 
template.


When I try to update, I get an error saying "Failed to synchronize 
cache for repo \ 'fedora-modular\'\n . Comment: System is already 
up-to-date\n".


When I try to update using command line I get this error message:

sudo dnf update

Error: Failed to synchronize cache for repo 'fedora-modular'

Anyone else has been having this same problem? any ideas how to clear it?

Thanks in advance,

Claudio




what does dom0
$qubes-prefs   say  for  updateVM  ?


did you happen to recently change anything?  I suppose you are aware 
that the Qubes Manager  sometimes  won't get rid of the  little green 
arrow even though your  up to date  ?    If your saying that  you closed 
your Fedora-29 template and then closed all your AppVM Qubes and 
restarted them and still see   the  recycle green circle on them,  I've 
never heard of that problem before .



have you ever done

$sudo dnf upgrade    vs  update




Hi,

I've just tried and it successfully updated both Debian 9 and Fedora 29 
through the qubes updater.


Answering your question:

1. updatevm is through sys-firewall
2. yes, I'd tried both sudo dnf update / upgrade with on fedora and 
debian command lines


Thank you,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/qa3c3l%24407d%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Qubes update of debian-9 templates is failing

[Claudio Chinicz]

On 25/04/2019 15:18, unman wrote:

On Thu, Apr 25, 2019 at 01:06:26PM +0300, Claudio Chinicz wrote:

Hi All,

I'm getting the following error message:

root@debian-9:/home/user# apt-get update
Ign:1 http://dl.google.com/linux/chrome/deb stable InRelease
Ign:2 https://deb.qubes-os.org/r4.0/vm stretch InRelease
Ign:3 https://deb.debian.org/debian stretch InRelease
Err:4 http://dl.google.com/linux/chrome/deb stable Release
   500  Unable to connect
Err:5 https://deb.qubes-os.org/r4.0/vm stretch Release
   Received HTTP code 500 from proxy after CONNECT
Ign:6 https://deb.debian.org/debian-security stretch/updates InRelease
Err:7 https://deb.debian.org/debian stretch Release
   Received HTTP code 500 from proxy after CONNECT
Err:8 https://deb.debian.org/debian-security stretch/updates Release
   Received HTTP code 500 from proxy after CONNECT
Reading package lists... Done
E: The repository 'http://dl.google.com/linux/chrome/deb stable Release'
does no longer have a Release file.
N: Updating from such a repository can't be done securely, and is therefore
disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration
details.
E: The repository 'https://deb.qubes-os.org/r4.0/vm stretch Release' does no
longer have a Release file.
N: Updating from such a repository can't be done securely, and is therefore
disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration
details.
E: The repository 'https://deb.debian.org/debian stretch Release' does no
longer have a Release file.
N: Updating from such a repository can't be done securely, and is therefore
disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration
details.
E: The repository 'https://deb.debian.org/debian-security stretch/updates
Release' does no longer have a Release file.
N: Updating from such a repository can't be done securely, and is therefore
disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration
details.

Have anyone faced the same issue? Any ideas how to solve it?

Thanks,

Claudio



Hi Claudio

The important is the error messages - everything else is consequential.
500 is an internal server error.
Combined with connect error suggest there's something wrong with your
proxy or your connection.

If you are using sys-whonix could be intermittent fault on Tor network.
Try again later.
If not, look closely at proxy configuration, and check qube where proxy
is running. (Look in /etc/qubes-rpc/policy/qubes.UpdatesProxy if you're
not sure.)



Hi unman,

Thanks for your prompt answer. I've reviewed my connection and made sure 
I'm using standard sys-net and sys-firewall. Also, I'm using my home 
connection (no proxy) and not updating through whonix, although internet 
is connecting ok and tor is connected through sys-whonix, as usual.


So, I could not find any issue on my side. I'll try it again Sunday or 
Monday using a different internet connection.


One thing to note is that after trying to update (this time using qubes 
updater and not command line), qubes manager shows the two arrows ("this 
qube must be restarted for its filesystem to reflect the recent 
committed changes") on all Fedora-based VMs (sys-net, sys-usb and 
sys-firewall) BUT NOT on my Personal VM, which is Debian 9 based (??).


Best Regards,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q9sefq%2411j3%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Qubes update of debian-9 templates is failing

[Claudio Chinicz]

Hi All,

I'm getting the following error message:

root@debian-9:/home/user# apt-get update
Ign:1 http://dl.google.com/linux/chrome/deb stable InRelease
Ign:2 https://deb.qubes-os.org/r4.0/vm stretch InRelease
Ign:3 https://deb.debian.org/debian stretch InRelease
Err:4 http://dl.google.com/linux/chrome/deb stable Release
  500  Unable to connect
Err:5 https://deb.qubes-os.org/r4.0/vm stretch Release
  Received HTTP code 500 from proxy after CONNECT
Ign:6 https://deb.debian.org/debian-security stretch/updates InRelease
Err:7 https://deb.debian.org/debian stretch Release
  Received HTTP code 500 from proxy after CONNECT
Err:8 https://deb.debian.org/debian-security stretch/updates Release
  Received HTTP code 500 from proxy after CONNECT
Reading package lists... Done
E: The repository 'http://dl.google.com/linux/chrome/deb stable Release' 
does no longer have a Release file.
N: Updating from such a repository can't be done securely, and is 
therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user 
configuration details.
E: The repository 'https://deb.qubes-os.org/r4.0/vm stretch Release' 
does no longer have a Release file.
N: Updating from such a repository can't be done securely, and is 
therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user 
configuration details.
E: The repository 'https://deb.debian.org/debian stretch Release' does 
no longer have a Release file.
N: Updating from such a repository can't be done securely, and is 
therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user 
configuration details.
E: The repository 'https://deb.debian.org/debian-security 
stretch/updates Release' does no longer have a Release file.
N: Updating from such a repository can't be done securely, and is 
therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user 
configuration details.


Have anyone faced the same issue? Any ideas how to solve it?

Thanks,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q9s0r3%24shk%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Fedora-29 update does not work

[Claudio Chinicz]

On 18/03/2019 12:10, Claudio Chinicz wrote:

Hi All,

I'm getting notification that I need to update Fedora-29 (Qubes 4.0.1), 
I do it but it keeps asking to update.


On Qubes manager all VMs based on Fedora-29 template show they need to 
restart because I've updated Fedora-29, although it keeps asking to update.


I've even updated it manaully (opened terminal and issued sudo dnf 
update/upgrade) and it seems updated, but still Qubes thinks it needs to 
update.


Any insights?

Thanks,

Claudio Chinicz



Hi again,

After a long time, the issue returned and for almost I see the update 
icon on the upper right corner indicating I need to update Fedora 29 
template.


When I try to update, I get an error saying "Failed to synchronize cache 
for repo \ 'fedora-modular\'\n . Comment: System is already 
up-to-date\n".


When I try to update using command line I get this error message:

sudo dnf update

Error: Failed to synchronize cache for repo 'fedora-modular'

Anyone else has been having this same problem? any ideas how to clear it?

Thanks in advance,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q9pmi9%2455u4%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Windows 10 Pro HVM does not work with Mirage Firewall

[Claudio Chinicz]

On 19/04/2019 12:05, Thomas Leonard wrote:

On Thursday, April 18, 2019 at 9:53:25 AM UTC+1, Claudio Chinicz wrote:

Hi All,

Once again I turn to the Qubes Community to ask for help.

I have a Mirage Firewall VM that works with HVM (Linux Mint) and
Debian/Fedora template-based PVMs.

My Windows 10 HVM, which works just fine through sys-firewall
(copy/paste and file sharing with other VMs dont, but I can live with it).

I've tried setting up networking manually by adding its IP, mask and
gateway and rebooting but it did not work. It works with DHCP instead
when getting network through sys-firewall.

I've followed all the ideas from here
(https://www.windowscentral.com/how-regain-internet-access-after-installing-update-windows-10)
and it still did not work.

One last piece of information, my Windows 10 Pro was successfully
activated using a key I provided.

Any ideas? This is not critical, since I can continue using
sys-firewall, but would love to free some memory by using Mirage.


There might be clues in the firewall VM's logs. You can see them with Qubes 
Manager (right-click on mirage-firewall and choose Logs -> 
guest-mirage-firewall.log). Open the logs just after booting Windows and seeing 
that networking doesn't work and look at the end.

You can also do "sudo xl console mirage-firewall" in dom0 to follow the logs 
and then boot Windows and watch for new entries.



Hi Thomas,

Thanks in advance. Please see below logs from guest-mirage-firewall.log. 
My Windows VM is 10.137.0.21.


What really surprises me is why I does not work even if I set my 
ip/mask/gateway as it works with Linux Mint? What's different with Windows?


Best Regards,

Claudio

2019-04-18 11:20:10 -00:00: INF [client_net] Client 18 (IP: 10.137.0.21) 
ready
2019-04-18 11:20:10 -00:00: INF [ethernet] Connected Ethernet interface 
00:16:3e:5e:6c:00
2019-04-18 11:20:11 -00:00: INF [client_net] add client vif 
{domid=17;device_id=0}
2019-04-18 11:20:11 -00:00: INF [qubes.db] got rm 
"/qubes-iptables-domainrules/"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-iptables-header" = "# Generated by Qubes Core on Thu Apr 18 
14:20:11 2019\n*filter\n:INPUT DROP [0:0]\n:FORWARD DROP [0:0]\n:OUTPUT 
ACCEPT [0:0]\n-A INPUT -i vif+ -p udp -m udp --dport 68 -j DROP\n-A 
INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n-A INPUT -p 
icmp -j ACCEPT\n-A INPUT -i lo -j ACCEPT\n-A INPUT -j REJECT 
--reject-with icmp-host-prohibited\n-A FORWARD -m conntrack --ctstate 
RELATED,ESTABLISHED -j ACCEPT\n-A FORWARD -i vif+ -o vif+ -j DROP\nCOMMIT\n"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-iptables-domainrules/10" = "*filter\n-A FORWARD -s 10.137.0.18 
-j ACCEPT\n-A FORWARD -s 10.137.0.18 -j DROP\nCOMMIT\n"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-iptables-domainrules/17" = "*filter\n-A FORWARD -s 10.137.0.21 
-j ACCEPT\n-A FORWARD -s 10.137.0.21 -j DROP\nCOMMIT\n"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-iptables-domainrules/14" = "*filter\n-A FORWARD -s 10.137.0.13 
-j ACCEPT\n-A FORWARD -s 10.137.0.13 -j DROP\nCOMMIT\n"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-iptables-domainrules/9" = "*filter\n-A FORWARD -s 10.137.0.8 -j 
ACCEPT\n-A FORWARD -s 10.137.0.8 -j DROP\nCOMMIT\n"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: "/qubes-iptables" 
= "reload"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/mapped-ip/10.137.0.21/visible-ip" = "10.137.0.21"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/mapped-ip/10.137.0.21/visible-gateway" = "10.137.0.23"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-firewall/10.137.0.21/" = "action=accept"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-firewall/10.137.0.21/policy" = "drop"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-firewall/10.137.0.21" = ""
2019-04-18 11:20:11 -00:00: INF [qubes.db] got rm 
"/qubes-firewall/10.137.0.21/"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-firewall/10.137.0.21/" = "action=accept"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-firewall/10.137.0.21/policy" = "drop"
2019-04-18 11:20:11 -00:00: INF [qubes.db] got update: 
"/qubes-firewall/10.137.0.21" = ""

2019-04-18 11:20:22 -00:00: INF [client_eth] who-has 10.137.0.1?
2019-04-18 11:20:22 -00:00: INF [client_eth] unknown address; not responding
2019-04-18 11:20:22 -00:00: WRN [client_net] Incorrect source IP 0.0.0.0 
in IP packet from 10.137.0.21 (dropping)
2019-04-18 11:20:22 -00:00: WRN [client_net] Incorrect source IP 
10.137.0.1 in IP packet from 10.137.0.21 (dropping)

2019-04-1

[qubes-users] Windows 10 Pro HVM does not work with Mirage Firewall

[Claudio Chinicz]

Hi All,

Once again I turn to the Qubes Community to ask for help.

I have a Mirage Firewall VM that works with HVM (Linux Mint) and 
Debian/Fedora template-based PVMs.


My Windows 10 HVM, which works just fine through sys-firewall 
(copy/paste and file sharing with other VMs dont, but I can live with it).


I've tried setting up networking manually by adding its IP, mask and 
gateway and rebooting but it did not work. It works with DHCP instead 
when getting network through sys-firewall.


I've followed all the ideas from here 
(https://www.windowscentral.com/how-regain-internet-access-after-installing-update-windows-10) 
and it still did not work.


One last piece of information, my Windows 10 Pro was successfully 
activated using a key I provided.


Any ideas? This is not critical, since I can continue using 
sys-firewall, but would love to free some memory by using Mirage.


Thank you all in advance,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q99dto%242ebj%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Installing Mirage Firewall

[Claudio Chinicz @ Gmail]

Hi There,

Thanks a lot! What a great community!

Cheers

On 17/04/2019 21:45, 799 wrote:

Hello Claudio

Claudio Chinicz mailto:cchin...@gmail.com>> 
schrieb am Mi., 17. Apr. 2019, 15:39:


Hi All,

I'm trying to install/test/play with Mirage, following
instructions from
https://github.com/mirage/qubes-mirage-firewall.

Honestly, I've got entirely lost, since I'm not a pro and not
proficient
with Linux.

Can anyone provide a step-by-step recipe how to install the unikernel?


I was also struggling with the installation, therefore (and to save 
time for the Mirage Pros to develop the firewall not helping newbies 
like myself) I have created a howto:


https://github.com/Qubes-Community/Contents/blob/master/docs/customization/mirage-firewall.md

You can run all steps from dom0 ;-)
If you need further help, to not hesitate to ask.
I'd like to hear your feedback, if we can improve the howto.

- O/799


--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e2bc679c-72a5-9517-766b-0c0e0ead616b%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Installing Mirage Firewall

[Claudio Chinicz]

Hi All,

I'm trying to install/test/play with Mirage, following instructions from 
https://github.com/mirage/qubes-mirage-firewall.


Honestly, I've got entirely lost, since I'm not a pro and not proficient 
with Linux.


Can anyone provide a step-by-step recipe how to install the unikernel?

Thanks a lot in advance,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q97a9j%242gcj%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Linux Mint gets lost when I connect lan cable (also issues with Windows 10 VM)

[Claudio Chinicz]

Thanks!

בתאריך יום ו׳, 12 באפר׳ 2019, 3:05, מאת unman ‏:

> On Thu, Apr 11, 2019 at 09:39:04AM +0300, Claudio Chinicz wrote:
> > On 11/04/2019 3:24, unman wrote:
> > > On Wed, Apr 10, 2019 at 09:21:07AM +0300, Claudio Chinicz wrote:
> > > > On 09/04/2019 19:27, 'qmirfw' via qubes-users wrote:
> > > > > On Monday, April 8, 2019 2:44 PM, Claudio Chinicz <
> cchin...@gmail.com> wrote:
> > > > >
> > > > > > Hi All,
> > > > > >
> > > > > > My Linux Mint VM works ok when the notebook is connected to wifi
> only.
> > > > > > When I connect the lan cable I see the icon in the upper right
> corner
> > > > > > indicating both wifi and wired connections are available and
> this VM
> > > > > > looses internet connection. In the VM, Linux still sees it is
> connected
> > > > > > ("wired" is the default - eth) but without internet connection.
> > > > > >
> > > > > > If I disconnect the lan cable the VM sees internet connection as
> before.
> > > > > >
> > > > > > By the way, my Windows 10 VM sees both but if I'm using wifi and
> connect
> > > > > > the cable or vice versa, I have to shut it down (and everything
> else
> > > > > > that uses sys-firewall) and restart sys-net.
> > > > > >
> > > > > > I need to connect through lan cable in order to access corporate
> AD
> > > > > > resources.. otherwise I'd use only wifi and forget about this
> issue.
> > > > > >
> > > > > > Thanks in advance for any insight from the community,
> > > > > >
> > > > > > Claudio
> > > > >
> > > > > My solution: split sys-net to sys-net-wifi and sys-net-eth and
> assign the respective controllers to them. Also split sys-firewall.
> > > > >
> > > > > This way you will have two completely independent networks and
> firewalls, and you can switch AppVMs between them as you wish, even while
> they are running.
> > > > >
> > > > > When you are not phisically at work, you can shut down sys-net-eth
> and sys-fw-eth to save ram.
> > > > >
> > > > >
> > > >
> > > > Hi, Thanks again for your answer.
> > > >
> > > > I've cloned sys-net as sys-net-wifi-only and started it, but when I
> click on
> > > > the icon no networks display. I've restarted Qubes but still this
> second net
> > > > VM does not display any networks.
> > > >
> > > > Any ideas?
> > > >
> > > > Regards,
> > > >
> > > > Claudio
> > > >
> > > You did allocate your wifi card to sys-net-wifi and ensure that it is
> > > loaded correctly there?
> > >
> >
> > Yes, I've done it. On dom0 I've issued command "qvm-pci attach
> --persistent
> > disp-sys-net :" and afterwards my new sys-net-wifi did not
> > start because the device is in use (I suppose by sys-net).
> >
> > Any ideas?
> >
> > Thanks,
> >
> > Claudio
> >
>
> Depending on how you configured sys-net you may have to reboot after
> removing the wifi from sys-net before it becomes available to use in
> your new sys-net-wifi.
>
> Shutdown sys-net - remove the wifi adapter - reboot - start sys-net -
> start sys-net-wifi
>
> --
> You received this message because you are subscribed to the Google Groups
> "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to qubes-users+unsubscr...@googlegroups.com.
> To post to this group, send email to qubes-users@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/20190412000523.yh7pefhk2hthqf63%40thirdeyesecurity.org
> .
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CAOu9i0gHaU77eGxAVfoU2xaMEiD3Feiw9ejcjOuScK41YQAbmw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Linux Mint gets lost when I connect lan cable (also issues with Windows 10 VM)

[Claudio Chinicz]

On 11/04/2019 3:24, unman wrote:

On Wed, Apr 10, 2019 at 09:21:07AM +0300, Claudio Chinicz wrote:

On 09/04/2019 19:27, 'qmirfw' via qubes-users wrote:

On Monday, April 8, 2019 2:44 PM, Claudio Chinicz  wrote:


Hi All,

My Linux Mint VM works ok when the notebook is connected to wifi only.
When I connect the lan cable I see the icon in the upper right corner
indicating both wifi and wired connections are available and this VM
looses internet connection. In the VM, Linux still sees it is connected
("wired" is the default - eth) but without internet connection.

If I disconnect the lan cable the VM sees internet connection as before.

By the way, my Windows 10 VM sees both but if I'm using wifi and connect
the cable or vice versa, I have to shut it down (and everything else
that uses sys-firewall) and restart sys-net.

I need to connect through lan cable in order to access corporate AD
resources.. otherwise I'd use only wifi and forget about this issue.

Thanks in advance for any insight from the community,

Claudio


My solution: split sys-net to sys-net-wifi and sys-net-eth and assign the 
respective controllers to them. Also split sys-firewall.

This way you will have two completely independent networks and firewalls, and 
you can switch AppVMs between them as you wish, even while they are running.

When you are not phisically at work, you can shut down sys-net-eth and 
sys-fw-eth to save ram.




Hi, Thanks again for your answer.

I've cloned sys-net as sys-net-wifi-only and started it, but when I click on
the icon no networks display. I've restarted Qubes but still this second net
VM does not display any networks.

Any ideas?

Regards,

Claudio


You did allocate your wifi card to sys-net-wifi and ensure that it is
loaded correctly there?



Yes, I've done it. On dom0 I've issued command "qvm-pci attach 
--persistent disp-sys-net :" and afterwards my new 
sys-net-wifi did not start because the device is in use (I suppose by 
sys-net).


Any ideas?

Thanks,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q8mne8%241vbu%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Linux Mint gets lost when I connect lan cable (also issues with Windows 10 VM)

[Claudio Chinicz]

On 09/04/2019 19:27, 'qmirfw' via qubes-users wrote:

On Monday, April 8, 2019 2:44 PM, Claudio Chinicz  wrote:


Hi All,

My Linux Mint VM works ok when the notebook is connected to wifi only.
When I connect the lan cable I see the icon in the upper right corner
indicating both wifi and wired connections are available and this VM
looses internet connection. In the VM, Linux still sees it is connected
("wired" is the default - eth) but without internet connection.

If I disconnect the lan cable the VM sees internet connection as before.

By the way, my Windows 10 VM sees both but if I'm using wifi and connect
the cable or vice versa, I have to shut it down (and everything else
that uses sys-firewall) and restart sys-net.

I need to connect through lan cable in order to access corporate AD
resources.. otherwise I'd use only wifi and forget about this issue.

Thanks in advance for any insight from the community,

Claudio


My solution: split sys-net to sys-net-wifi and sys-net-eth and assign the 
respective controllers to them. Also split sys-firewall.

This way you will have two completely independent networks and firewalls, and 
you can switch AppVMs between them as you wish, even while they are running.

When you are not phisically at work, you can shut down sys-net-eth and 
sys-fw-eth to save ram.




Hi, Thanks again for your answer.

I've cloned sys-net as sys-net-wifi-only and started it, but when I 
click on the icon no networks display. I've restarted Qubes but still 
this second net VM does not display any networks.


Any ideas?

Regards,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q8k20k%243f4r%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Linux Mint gets lost when I connect lan cable (also issues with Windows 10 VM)

[Claudio Chinicz]

Hi All,

My Linux Mint VM works ok when the notebook is connected to wifi only. 
When I connect the lan cable I see the icon in the upper right corner 
indicating both wifi and wired connections are available and this VM 
looses internet connection. In the VM, Linux still sees it is connected 
("wired" is the default - eth) but without internet connection.


If I disconnect the lan cable the VM sees internet connection as before.

By the way, my Windows 10 VM sees both but if I'm using wifi and connect 
the cable or vice versa, I have to shut it down (and everything else 
that uses sys-firewall) and restart sys-net.


I need to connect through lan cable in order to access corporate AD 
resources.. otherwise I'd use only wifi and forget about this issue.


Thanks in advance for any insight from the community,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q8ffmp%242uis%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] how to connect an external USB keyboard to a Linux HVM

[Claudio Chinicz]

Hi Folks,

I'm willing to use my Qubes notebook as my main notebook in a corporate 
environment. One of the things I use daily is an external keyboard, 
which cannot be hooked to my Linux Mint 19.1 Cinnamon 64 bits HVM 
because qurexec is not present.


Anyone has done it before? I'm looking for how to install qurexec on 
Linux Mint, hoping that it will let me attach the USB keyboard to the HVM.


Thank you all in advance,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q7s6h4%2438v9%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] "Virtualization type: none" with Dell Latitude 5590

[Claudio Chinicz]

Hi All,

I've just installed Qubes 4.0.1 on a brand new Dell Latitude 5590 (Intel 
i5/8250U, with 16GB RAM) using the downloaded ISO burnt to a UBS stick 
prepared on a Windows machine with Rufus (partition scheme GPT target 
system UEFI).


I've booted the new machine on UEFI mode and the firmware Virtualization 
settings all enabled (there are 3 parameters here: "Virtualization", 
which is I suppose is VT-x, "VT for Direct I/O", which I suppose stands 
for VT-d and "Trusted Execution").


When I issue lscpu command on dom0 I get "Virtualization type: none".

What's wrong? Why I do not see virtualization on dom0? I run a Windows 
HVM, which confirms Virtualization (VT-x) is available. But what about 
VT-d? Isnt it available for isolation purposes?


Thanks in advance for any insight.

Best Regards,

Claudio

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q7ddsc%249ne%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Fedora-29 Template (Qubes 4.0.1) keeps asking to upgrade

[Claudio Chinicz]

Hi All,

I've already upgrade a few times through the GUI and command line but 
still shows in the GUI as if required.


Has anyone experienced this? Any insights how tpo get rid of the GUI 
update reminder?


Thanks,

Claudio Chinicz

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q6o8ok%242n2j%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Fedora-29 update does not work

[Claudio Chinicz]

Hi All,

I'm getting notification that I need to update Fedora-29 (Qubes 4.0.1), 
I do it but it keeps asking to update.


On Qubes manager all VMs based on Fedora-29 template show they need to 
restart because I've updated Fedora-29, although it keeps asking to update.


I've even updated it manaully (opened terminal and issued sudo dnf 
update/upgrade) and it seems updated, but still Qubes thinks it needs to 
update.


Any insights?

Thanks,

Claudio Chinicz

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/q6nqr8%244tll%241%40blaine.gmane.org.
For more options, visit https://groups.google.com/d/optout.