Re: [qubes-users] Mac-Spoofing Doesn’t Work
On 10/06/2017 11:26 PM, Person wrote: Cloning VMs is quite troublesome right now, so it is hard to update Fedora and Debian in order to use NetworkManager. You can easily install the Fedora 25 template that should already have the correct version of NM: $ sudo qubes-dom0-update qubes-template-fedora-25 -- Chris Laprise, tas...@posteo.net https://twitter.com/ttaskett PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886 -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/5a5dbc84-e928-f942-c998-6d3ccb4c35c1%40posteo.net. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: Unable to uninstall or reinstall Whonix
The Control Port is 9051. I’m not sure if that has anything to do with my problems. I chose Internal Relaying and started Tor through Arm, but it did not register that Tor was connected. I still received the bootstrap problem and the qrexec problem. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/d27b0200-c10a-4c84-bf71-118f1d53de4b%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Mac-Spoofing Doesn’t Work
Cloning VMs is quite troublesome right now, so it is hard to update Fedora and Debian in order to use NetworkManager. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/d4f08b00-6f0f-484f-bff4-f2e5055a212a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Error Creating Ubuntu VM in Qubes 3.2
Once again, dom0 did not reply. I took this as a sign that the iso was successfully copied, but the Standalone VM did not register something to boot from and I could not find it in the dom0 filesystem again. This puzzles me, because I am sure that the file was originally at the exact location I put in the command. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/488045c9-6a61-4c4c-a6f0-2e9d35434743%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Qubes 3.2 dnsmasq update?
On October 6, 2017 5:05:49 PM MDT, Unman wrote: >On Thu, Oct 05, 2017 at 12:41:32PM -0600, Ron Hunter-Duvar wrote: >> On 10/05/2017 01:52 AM, Ilpo Järvinen wrote: >> > On Wed, 4 Oct 2017, Ron Hunter-Duvar wrote: ... >> > FC23 has been EOL'ed for long time, you should upgrade your >template to >> > FC25 or later (as FC24 likewise, is EOL'ed). The easiest >alternative is to >> > install fedora-25 template that is nowadays included to qubes >repositories >> > (IIRC). Then change your AppVMs having fedora-23 as their template >to use >> > fedora-25 template. >> > >> >> I wondered about that too. Why does Qubes 3.2 still use FC23? Wasn't >it EOL >> in 2015? >> >> I use debian-8 for all my appvms. I changed the default before I >created any >> of them. >> >> But I still need it for my servicevms. Especially since they're the >ones >> exposed to the internet (although still behind a separate firewall, >but >> that's potentially affected too). >> >> Haven't had time to look into how to setup a new template and convert >the >> servicevms. But for this, if there's no fix coming, I guess I'll have >to >> deal with it. >> >> Thanks, >> Ron > >No, Fed 23 was EOL in December 2016. >It's still used in dom0 because there should be little call to upgrade >dom0 - see the explanation here: >www.qubes-os.org/doc/software-update-dom0/ > >The install disk still contains fed23 templates and you're expected to >update as soon as you have installed. > >To install a new template all you have to do is : >sudo qubes-dom0-update qubes-template-fedora-25 Thanks for the tip. I don't remember seeing it in the getting started material I read. Doing it now. >This will install the template and you can then just switch your >serviceVMs - either using Qubes Manager, or by: >'qvm-prefs -s template '. > >Of course, there's no reason why you shouldnt use Debian for all your >qubes, and ditch Fedora template altogether. Do you mean I can switch my servicevms to Debian? I don't want to create any unnecessary headaches for myself right now, but I much prefer Debian. >unman Thanks, Ron -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/C9A5D777-0E22-493D-B321-D53276938729%40shaw.ca. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Qubes 3.2 dnsmasq update?
On Thu, Oct 05, 2017 at 12:41:32PM -0600, Ron Hunter-Duvar wrote: > On 10/05/2017 01:52 AM, Ilpo Järvinen wrote: > > On Wed, 4 Oct 2017, Ron Hunter-Duvar wrote: > > > > > Saw the news earlier today about the major dnsmasq vulnerabilities (remote > > > code execution), and already received the update for the debian-8 > > > template, > > > but not for the fedora-23 template or dom0. > > > > > > Anyone know of an ETA for this? > > dom0 does not have network connectivity. > > Yeah, I wondered about that. Any reason for it to even have dnsmasq > installed? Because it does. > > > > FC23 has been EOL'ed for long time, you should upgrade your template to > > FC25 or later (as FC24 likewise, is EOL'ed). The easiest alternative is to > > install fedora-25 template that is nowadays included to qubes repositories > > (IIRC). Then change your AppVMs having fedora-23 as their template to use > > fedora-25 template. > > > > I wondered about that too. Why does Qubes 3.2 still use FC23? Wasn't it EOL > in 2015? > > I use debian-8 for all my appvms. I changed the default before I created any > of them. > > But I still need it for my servicevms. Especially since they're the ones > exposed to the internet (although still behind a separate firewall, but > that's potentially affected too). > > Haven't had time to look into how to setup a new template and convert the > servicevms. But for this, if there's no fix coming, I guess I'll have to > deal with it. > > Thanks, > Ron No, Fed 23 was EOL in December 2016. It's still used in dom0 because there should be little call to upgrade dom0 - see the explanation here: www.qubes-os.org/doc/software-update-dom0/ The install disk still contains fed23 templates and you're expected to update as soon as you have installed. To install a new template all you have to do is : sudo qubes-dom0-update qubes-template-fedora-25 This will install the template and you can then just switch your serviceVMs - either using Qubes Manager, or by: 'qvm-prefs -s template '. Of course, there's no reason why you shouldnt use Debian for all your qubes, and ditch Fedora template altogether. unman -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20171006230549.6qofrm4e4iy4hhop%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: Possible to add second interface to sys-firewall?
On Fri, Oct 06, 2017 at 03:41:26PM -0400, Ed wrote: > On 10/06/2017 03:14 PM, Mike Keehan wrote: > > On Fri, 6 Oct 2017 12:17:26 -0400 > > Ed wrote: > > > > > On 10/06/2017 12:10 PM, Mike Keehan wrote: > > > > > > > > > > > Wouldn't it be possible to add a second Firewall VM to be used > > > > solely by your special single vm? > > > > > > Yes I believe this would def work, and also should be > > > automatic/reliable across reboots, but I was really hoping to not > > > give up 2-4GB of RAM just for this purpose. > > > > > > > I think you will find that the firewall VM runs OK in just 500Mb, maybe > > less. Search the mail list for "vm memory" - there have been a number > > of discussions about how much is actually used by the system VMs. (I > > can't remember the details off hand, or I would give more info!) > > > > It is worth knowing that although a VM is initially set up with a 4Gb > > memory allocation, it only uses what it needs. The rest is still > > available to the other qubes etc. > > > > > > Mike. > > > > You know that's not a bad point. I never really looked into reducing the > memory allotment. I just know anecdotally on my systems the firewall vm's > use 2-3GB (when left with the default max of 4GB). I also know they will > run on less if I'm pushing a system out of memory but I never though to just > restrict them to less to start. > > I'm not really strapped for memory on the machine I'm working with here so > it does look like adding an additional firewall VM would be the easiest way > to get what I want, it just seemed a tad wasteful to me, but perfect is the > enemy of good > > Appreciate the input! I standardly reduce memory on all system qubes to 300M with no ill effects, and restrict most of my other qubes to 400M. Compiling and number crunching I set high. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20171006224554.pzwyoets53mrh53j%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Re: Possible to add second interface to sys-firewall?
On 10/06/2017 03:14 PM, Mike Keehan wrote: On Fri, 6 Oct 2017 12:17:26 -0400 Ed wrote: On 10/06/2017 12:10 PM, Mike Keehan wrote: Wouldn't it be possible to add a second Firewall VM to be used solely by your special single vm? Yes I believe this would def work, and also should be automatic/reliable across reboots, but I was really hoping to not give up 2-4GB of RAM just for this purpose. I think you will find that the firewall VM runs OK in just 500Mb, maybe less. Search the mail list for "vm memory" - there have been a number of discussions about how much is actually used by the system VMs. (I can't remember the details off hand, or I would give more info!) It is worth knowing that although a VM is initially set up with a 4Gb memory allocation, it only uses what it needs. The rest is still available to the other qubes etc. Mike. You know that's not a bad point. I never really looked into reducing the memory allotment. I just know anecdotally on my systems the firewall vm's use 2-3GB (when left with the default max of 4GB). I also know they will run on less if I'm pushing a system out of memory but I never though to just restrict them to less to start. I'm not really strapped for memory on the machine I'm working with here so it does look like adding an additional firewall VM would be the easiest way to get what I want, it just seemed a tad wasteful to me, but perfect is the enemy of good Appreciate the input! -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/or8m8v%24fq9%241%40blaine.gmane.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: Possible to add second interface to sys-firewall?
On Fri, 6 Oct 2017 12:17:26 -0400 Ed wrote: > On 10/06/2017 12:10 PM, Mike Keehan wrote: > > > > > Wouldn't it be possible to add a second Firewall VM to be used > > solely by your special single vm? > > > > Yes I believe this would def work, and also should be > automatic/reliable across reboots, but I was really hoping to not > give up 2-4GB of RAM just for this purpose. > I think you will find that the firewall VM runs OK in just 500Mb, maybe less. Search the mail list for "vm memory" - there have been a number of discussions about how much is actually used by the system VMs. (I can't remember the details off hand, or I would give more info!) It is worth knowing that although a VM is initially set up with a 4Gb memory allocation, it only uses what it needs. The rest is still available to the other qubes etc. Mike. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20171006201423.20721c2b.mike%40keehan.net. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: Possible to get usable Win7 gui?
Hello, > I work around the issue by using Remmina (or other RDP client) in an > appVM, and allowing IP forwarding in the firewall vm. This solution does > not suffer from increasing lag, and should be usable for everything > except gaming. See instructions here: > Remmina indeed seems to make this problem go away. So, I've tried the following which also seems to improve the performance: disable **all** visual effects (effectively the same thing RDP is doing I think): Right click computer -> Properties -> Advanced System Settings -> Advanced Tab -> Performance (Settings button) -> Adjust for best performance. Cya, Matheus. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/9a6a5fdc-4a7a-4fe9-a7b7-b7d1eafaf314%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Re: Possible to add second interface to sys-firewall?
On 10/06/2017 12:14 PM, filtration wrote: Can you create another sys-net chain with the second interface? You could keep things isolated without scripting. Assuming you are using Qubes 3.2, the interface could be assigned to sys-net-2 via VM Settings->Devices. Looks like you and both Mike Keehan had the same/similar idea. I could add a second firewall vm and use the same sys-net (I don't think I could use a different sys-net as easily because I want to use the same pci network device, just attach another IP) In fact this machine already has two NIC's and two separate sys-net/sys-firewall setups on it so I can route some vm's out entirely separate physical interfaces. But really I was hoping to accomplish this without adding the additional memory overhead of another sys-firewall instance. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/or8ahe%2435a%241%40blaine.gmane.org. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Re: Possible to add second interface to sys-firewall?
Assuming you mean a physical interface. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/or8a8m%2448c%242%40blaine.gmane.org. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Re: Possible to add second interface to sys-firewall?
On 10/06/2017 12:10 PM, Mike Keehan wrote: Wouldn't it be possible to add a second Firewall VM to be used solely by your special single vm? Yes I believe this would def work, and also should be automatic/reliable across reboots, but I was really hoping to not give up 2-4GB of RAM just for this purpose. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/or8aaf%24bvb%241%40blaine.gmane.org. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Re: Possible to add second interface to sys-firewall?
> What I would like to do is add a second IP to both sys-firewall and > sys-net so that I can NAT traffic from one of my VM's in/out through > these IP's. So what I end up with is two IP's on sys-net, one handling > all the traffic for most of my VM's, the other handling traffic for one > specific VM. This way I can do additional firewall restrictions on this > VM in my networks. > > If I manually add the IP addresses to sys-net and sys-firewall, manually > add the destination NAT and source NAT rules to both as well, then > manually add a route in sys-net, and also force another rule into the > IPTABLES raw table on sys-net (to override a rule added by > /etc/xen/scripts/vif-routes-qubes which restricts all incoming traffic > from sys-firewall to the IP assigned by qubes to the default interface), > then I'm able to make this work. > > However, this is very finicky and totally unscriptable in this > configuration, and I'd really like this to be something auto configured > on boot. > > I've look and looked and don't see where I can add a second interface > definition to any config files. If I manually edit the xen > sys-firewall.conf file it just gets overwitten by qubes. I can do all > the iptables rules I need in the /rw/config scripts, but what I really > need is for sys-firewall to add another virtual interface for me. > > I tried running: sudo xl network-attach sys-firewall > script=/etc/xen/scripts/vif-route-qubes ip=10.150.10.10 backend=sys-net > This will add the interface and setup sys-net with the correct routes > and rules, HOWEVER, the interface that it adds to sys-firewall has the > same IP as the existing interface which breaks all the traffic going out > of sys-firewall > > Has anyone ever had any success doing something like this? > > Any suggestions out there? > > Thanks, > Ed > Can you create another sys-net chain with the second interface? You could keep things isolated without scripting. Assuming you are using Qubes 3.2, the interface could be assigned to sys-net-2 via VM Settings->Devices. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/or8a5b%2448c%241%40blaine.gmane.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Possible to add second interface to sys-firewall?
On Fri, 6 Oct 2017 10:20:18 -0400 Ed wrote: > What I would like to do is add a second IP to both sys-firewall and > sys-net so that I can NAT traffic from one of my VM's in/out through > these IP's. So what I end up with is two IP's on sys-net, one > handling all the traffic for most of my VM's, the other handling > traffic for one specific VM. This way I can do additional firewall > restrictions on this VM in my networks. > > If I manually add the IP addresses to sys-net and sys-firewall, > manually add the destination NAT and source NAT rules to both as > well, then manually add a route in sys-net, and also force another > rule into the IPTABLES raw table on sys-net (to override a rule added > by /etc/xen/scripts/vif-routes-qubes which restricts all incoming > traffic from sys-firewall to the IP assigned by qubes to the default > interface), then I'm able to make this work. > > However, this is very finicky and totally unscriptable in this > configuration, and I'd really like this to be something auto > configured on boot. > > I've look and looked and don't see where I can add a second interface > definition to any config files. If I manually edit the xen > sys-firewall.conf file it just gets overwitten by qubes. I can do > all the iptables rules I need in the /rw/config scripts, but what I > really need is for sys-firewall to add another virtual interface for > me. > > I tried running: sudo xl network-attach sys-firewall > script=/etc/xen/scripts/vif-route-qubes ip=10.150.10.10 > backend=sys-net This will add the interface and setup sys-net with > the correct routes and rules, HOWEVER, the interface that it adds to > sys-firewall has the same IP as the existing interface which breaks > all the traffic going out of sys-firewall > > Has anyone ever had any success doing something like this? > > Any suggestions out there? > > Thanks, > Ed > Wouldn't it be possible to add a second Firewall VM to be used solely by your special single vm? -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20171006171022.71d8c133.mike%40keehan.net. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Possible to add second interface to sys-firewall?
What I would like to do is add a second IP to both sys-firewall and sys-net so that I can NAT traffic from one of my VM's in/out through these IP's. So what I end up with is two IP's on sys-net, one handling all the traffic for most of my VM's, the other handling traffic for one specific VM. This way I can do additional firewall restrictions on this VM in my networks. If I manually add the IP addresses to sys-net and sys-firewall, manually add the destination NAT and source NAT rules to both as well, then manually add a route in sys-net, and also force another rule into the IPTABLES raw table on sys-net (to override a rule added by /etc/xen/scripts/vif-routes-qubes which restricts all incoming traffic from sys-firewall to the IP assigned by qubes to the default interface), then I'm able to make this work. However, this is very finicky and totally unscriptable in this configuration, and I'd really like this to be something auto configured on boot. I've look and looked and don't see where I can add a second interface definition to any config files. If I manually edit the xen sys-firewall.conf file it just gets overwitten by qubes. I can do all the iptables rules I need in the /rw/config scripts, but what I really need is for sys-firewall to add another virtual interface for me. I tried running: sudo xl network-attach sys-firewall script=/etc/xen/scripts/vif-route-qubes ip=10.150.10.10 backend=sys-net This will add the interface and setup sys-net with the correct routes and rules, HOWEVER, the interface that it adds to sys-firewall has the same IP as the existing interface which breaks all the traffic going out of sys-firewall Has anyone ever had any success doing something like this? Any suggestions out there? Thanks, Ed -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/or83er%24efc%241%40blaine.gmane.org. For more options, visit https://groups.google.com/d/optout.
