[qubes-users] traveling - best practice

[haaber]

Hello,  I wonder how you behave when traveling, for example in places
with cameras all around. I feel uncomfortable to enter my passwords in
such situations. Of course I can simply not turn my computer on.  But
sometimes you have several hours in an airport ..  I thought about 3
options.

0) Change all (disk / user) pwd before & after traveling (how do I
change the disk pwd?).

1) Pull out my tails usbkey and surf with that?

2) maybe it woud be nice to have an additional  "single cube"
usr/password : when using this user name, one would get a single
disposable untrusted VM,  no dom0 acces, no USB, and so forth. Is that
feasable / reasonable?

how do you cope with that? Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8966eb59-45e3-e8d5-9ece-cae31d719f90%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] two-factor authentication thoughts

[haaber]

Hi everyone,

seeing all these yubikey mails, I was thinking about the hardware of 2
factor auth. I admit a small usb-key is handy, but so widespread as it
is, it will also be in the focus of government spy agencies. Even with
open source software : who knows what happens in the hardware? On the
other hand, I admit, using a password AND a possibly unsafe key is
better than using a password alone .. unless: (1) the password is weaker
than otherwise since the user trusts in the ybikey or (2) the usb were a
problem!

So I mediated a bit, how to do better: somehow, sending ~64 bits should
be possible by other, safer means than usb. Observe that with so little
data, speed is not a real problem, all imaginable communications  are
fast enough for that.  Of course a serial port would be most natural
choice, but they are inexistent on modern notebooks (sometimes you may
solder them on a main board, but that is not practical at all :). So I
took a look what else to "abuse" for communication.

idea 1: The monitor VGA could be great (unless you have an apple :) and
indeed there are serial protocols available, initially meant to
communicate screen resolution, etc. That could be a funny thing to look
at. Remains the question is how to use such a device without wrongly
suggesting to the operating system the existence of a real monitor ...

idea 2:  why not over the air? Imagine a device that gets power (and
only power) from usb, and receives data over the headphone / microphone
jack (kind of an old-style modem). Should be very secure; you may even
listen to it, it may be a "madelaine"  :)

Any other thoughts?   Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/afe746ca-0ac3-d53e-7deb-ad121494e54a%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] emergency help

[haaber]

Hello,


problem solved. Live-system, mount SSD, rename corresponding template-vm
(-> genearet file not fund), and qubes boots again :)  Happysmile!  
Bernhard


On 02/21/2017 09:11 PM, haa...@web.de wrote:
> Hello,
> I made a big big error. I wanted to play with i2c: there is one in the
> external vga ... I though it is a nice starting point to avaoid usb in
> certain situations. Anyhow:  Since dom0 has no i2c tools, I installed
> them in an fedora-24-minimal test VM.
> Then, since I had no acces to the vga, I gave the appVM hardware acces
> to vga - result: immediate black screen.
> Reboot: again black screen. Sniff!
>  
> So please help me how (a) to boot with NO qubes started or (b) where
> to find (and modify)
> the accessible hardware  after having botted an external rescue system.
>  
> Thanks, Bernhard
> -- 
> You received this message because you are subscribed to the Google
> Groups "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to qubes-users+unsubscr...@googlegroups.com
> .
> To post to this group, send email to qubes-users@googlegroups.com
> .
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/trinity-8104bd87-08ed-4cd6-8fd1-9cd6cb352b72-1487707873460%403capp-webde-bs46
> .
> For more options, visit https://groups.google.com/d/optout.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d3e1d2f7-57c5-66d7-449f-eb96163a96e3%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] emergency help

[haaber]

Hello,

I made a big big error. I wanted to play with i2c: there is one in the external vga ... I though it is a nice starting point to avaoid usb in certain situations. Anyhow:  Since dom0 has no i2c tools, I installed them in an fedora-24-minimal test VM.

Then, since I had no acces to the vga, I gave the appVM hardware acces to vga - result: immediate black screen.

Reboot: again black screen. Sniff!

 

So please help me how (a) to boot with NO qubes started or (b) where to find (and modify)

the accessible hardware  after having botted an external rescue system.

 

Thanks, Bernhard



-- 
You received this message because you are subscribed to the Google Groups "qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/trinity-8104bd87-08ed-4cd6-8fd1-9cd6cb352b72-1487707873460%403capp-webde-bs46.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] tox & webcam

[haaber]

Hello,

did anyone try out uTox (for example)? I had this in my pre-qubes  life.
I wonder whether a specific cloned & enriched fedora-24-minimal VM would
be a better solution, so I tried. Of course there is no binaries
available for fedora :)

So question one would be how to obtain a required package list that
allows to compile some software (in this example utox)  in a cloned 
f-24 vm.

Question two ist how to attach the internal webcam: It is visible in a
minimal-f-24 usb VM (using lsusb), I installed the missing
qubes-usb-proxy : helas, the qvm-usb command is still not available.
What do I miss?

Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/83ff8422-8a2a-71d4-cb03-76220fdecc8a%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] pb with fedora templates

[haaber]

Hello,

I ask about some help to get fedora running again. Some history of my
"accident". I had installed qubes 3.2 around Christmas with f23 on
board. I installed f24 from scratch, it worked well, and deleted then
f23 manually (brutally, I regret). For some time all was fine. Then
something strange happened, that I won't understand. Suddenly Fedora
template worked no more (since then I live on debian, until I realised
that f24-minimal works well - which works as my sys-firewall)  but
"full" f24 don't even start. All I have is:

[ME@dom0 vm-templates]$ qvm-start fedora-24
--> Loading the VM (type = TemplateVM)...
--> Starting Qubes DB...
--> Setting Qubes DB info for the VM...
--> Updating firewall rules...
--> Starting the VM...
--> Starting the qrexec daemon...
Waiting for VM's qrexec agent...failed
ERROR: Cannot execute qrexec-daemon!

So I tried it the windows way (smile) : deleted f24 via qubes-manager
and reinstalled (command line) - no change! It is still dead, and I feel
once more stupid :) Must be some config file mess-up that survives
uninstall. I realise that disp-vm is still configured to the
non-existent f-23, that may be part of the proble.

So any hint is appreciated. Thanks, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9010ec1d-0c6b-ce92-0c62-df35efeb780b%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] two factor authentication

[haaber]

Hello,

inspired by many yubikey mails here I have thought a moment about 2fa.
To my pov the best thing would be to avoid usb as communication device
(I guess many agree here :))

So what else? I see in the moment 3 frequently available objects on a
notebook that may be used creatively:

a) the sound card : use it as a modem! A typical OTP is 64-128 bit long,

a normal yubikey pwd seem even shorter. => So communication speed is
of no importance.

b) the i2C bus hidden in your VGA / DVI / HDMI cable. It is a full
serial bus ... but this

may be not so easy to use.

c) a "fingerprint scanner". Of course never feed it your fingerprint.
But it is a funny input device! Did anyone of you see guys who use it to
feed other data than fingerprints?


Cheers, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a5238ce3-3414-f4c8-25df-e6f88be9f6ae%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Problem with a Privacy Guide

[haaber]

> Hello qubes-team,
>
> I'm actually facing a problem with a guide of yours. I've used the
> Privacy Guide "Tor Onion Repos" entering the following two commands:
>
> sudo sed -i 's/yum.qubes-os.org/yum.qubesos4z6n4.onion/'
> /etc/yum.repos.d/qubes-dom0.repo && cat /etc/yum.repos.d/qubes-dom0.repo
>
> sudo sed -i 's/yum.qubes-os.org/yum.qubesos4z6n4.onion/'
> /etc/yum.repos.d/qubes-templates.repo && cat
> /etc/yum.repos.d/qubes-templates.repo
>
> Now i cant resolve a connection to the update servers anymore, please
> tell me the right commands to reset it.
>
> By the way, I could not enter the other two commands because the
> following variables didnt exists on my new qubes r3.2 installation:
>
> $DebianTemplateVM
> $FedoraTemplateVM
>
> Because I ran into all these problems, I would prefer to just set it
> back.
> Please tell me how to.
You may simply use sed ("stream editor") the other way: syntax is  sed
-i 's/SEARCH/REPLACE/'
So the first command reverted will contain
sed -i 's/yum.qubesos4z6n4.onion/yum.qubes-os.org/'

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/f91643e9-5b0b-c041-439c-78671224d7bb%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qvm-run fails silently with chromium

[haaber]

On 02/09/2017 03:31 AM, Unman wrote:
> On Wed, Feb 08, 2017 at 01:42:44PM -0800, Andrew David Wong wrote:
> On 2017-02-07 06:35, m...@lamarciana.com wrote:
> >>> Hi,
> >>>
> >>> I installed chromium browser in a debian-8 based standalone VM
> called 'work'. If I run, from dom0:
> >>>
> >>> ```
> >>> qvm-run work chromium
> >>> ```
> >>>
> >>> it outputs:
> >>>
> >>> ```
> >>> Running command on VM: 'work'...
> >>> ```
> >>>
> >>> but nothing happens. It is the same if I use shortcut desktop menu
> (which I guess executes the same command).
> >>>
> >>> If, instead, I run `chromium` from within a terminal in 'work' it
> works fine.
> >>>
> >>> I thought maybe it was a permissions problem with folder
> `~/.config/chromium`, but I granted everything to everybody just to
> check it and nothing changes.
> >>>
> >>> I'm quite lost because, as there is nothing in dom0 stderr, I
> don't know how I could debug it.
> >>>
> >>> I would be thankful for any help.
> >>>
> >>> Thanks!
> >>>
>
> Is chromium the only program with which you experience this problem?
>
> > I dont see this behaviour in a TemplateBased qube, or a standalone. >
In both, the browser just opens. > That's with a standard Debian-8
template. > > You can try running with '-p' option to see if any errors
are being > thrown. >

Hello, did you run "Add more shortcuts" at least once (look which apps
are there)? I got very confused by this point in another, maybe related
situation: when changing the templateVM you *must* do so, since symbolic
links to all apps are different in fedora and debian, for example.   All
the best, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0451a2b5-2749-0825-c11c-fbfc0fb21130%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] backup failes

[haaber]

Hello,

I tried the built-in backup procedure in qubes3.2 -- it fails (from
qubes VM manager). The procedure I follow: I select only shutdown qubes,
I select sys-usb as appvm (in which the ext. harddisc is mouted on
/media/user/hexstring/ and in which I manually created a qubes-backup
folder that I select. I enter the pwd, get the summary, say next again,
and then:

Error: failed to write the backup:

Cannot create /media/user/hexstring/qubes-backup/2017-02... : permission
denied.

And that's it. Do you have some hint what my error may be? I read about
te size issue of the qubes. I have more than 100G in total. I it that
maybe? Can I only backup the old way (create a sparse file, loopback it,
cryptsetup it, put ext2 on it, mount it, copy all private.img files) ?

Thank you! Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/880a127f-8251-3946-1bf6-f8a19239c1bc%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] backup failes

[haaber]

haaber:
> > Cannot create /media/user/hexstring/qubes-backup/2017-02... : permission
> > denied.
>
> Try "sudo chown user:user /media/user/hexstring/qubes-backup".
>
> Rusty
Thank you that worked! Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/24341d31-3953-b7d1-a67e-0e9eed76984f%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Qubes using Cloudflare - Why?

[haaber]

On 01/12/2017 08:24 AM, taii...@gmx.com wrote:
> On 01/12/2017 12:33 AM, Andrew David Wong wrote:
>> -BEGIN PGP SIGNED MESSAGE-
>> Hash: SHA512
>>
>> On 2017-01-11 12:34, Andrew David Wong wrote:
>>> On 01/11/17 11:04, taii...@gmx.com wrote:
 https://www.eff.org/deeplinks/2017/01/finally-revealed-cloudflare-has-been-fighting-nsls-years

>>> Three main reasons:
>>>
>>> 1. We distrust the infrastructure anyway.
>>> 2. It's low-overhead (in terms of the time and work required for
>>> administrative tasks).
>>> 3. It's free (as in beer).
>>>
>> On 2017-01-11 12:37, Alex wrote:
>>> In my understanding of the article, cloudflare is trying to challenge
>>> the secrecy around broad investigations (by challenging national
>>> security letters), not the other way around, so I can't see what you are
>>> lamenting, Taiidan... Would you care to explain?
>>>
>> I mistakenly thought that this was a new thread posing the question in
>> the subject line and providing a link to that article as a justification
>> for the question. After viewing the whole thread on Google Groups, I
>> realize that I've already answered the initial question. (I knew it
>> seemed familiar!)
>>
>> This is what happens when people reply to threads without quoting any
>> part of the existing thread to provide context. :)
>>
>> I second Alex's question. The article is clearly pro-Cloudflare from the
>> very first sentence.
>>
>> - -- Andrew David Wong (Axon)
>> Community Manager, Qubes OS
>> https://www.qubes-os.org
>> -BEGIN PGP SIGNATURE-
>>
>> iQIcBAEBCgAGBQJYdxUYAAoJENtN07w5UDAwT5IP/3j5VjBj7Txh9bC9z4gOT1bk
>> x+DzdFWPH6OAXiaUQs5BDiA/TayjN8GmJgcYi1247MV4xaoNkUqAdOa3Bv+fxprr
>> wZREP6UII3LiLlP8TMPsIZNhc/W+AGSUGinG4qtYlz/TJnn2zJnoTmiz1f3wsUVh
>> LDT4ncPIUFiVaVLhn5eFnl7nOrDh14O3CRxlu3cpYjTG6bBXBAChCLEE6EACTJgH
>> Ocl1fyGOCtlPILC7OEKPoJ1Cuo6RxhVilhv9rqkM8gh8uG4cRZAsKAaWb8C/qrJ1
>> WamA85zEApjI2xonPjkBOCfPnOpDNs21B4uG/hdRq4tPtU+69Xt0a6SCOqPdijDZ
>> An62pOlCApLEvCl26ImS0xdmKaYXZ1y0UPS2y+wJ/tMBRZxKNAKlpwYat93t3nIK
>> UOW763sA+CVpDIxTaBTGGL7Miz7wz0fGN4TAtGNyOVNnfdwSNnKQcYxwWY9rltsj
>> VWvQumHfWE1zLZ2HzknbP3CVSeIuqSrve4rifj62L3+gkKaoqxA7ndN/sSOOX6iO
>> TOZZYuWb8YE1rGoV/vznFEftc74mDe0obmF4JSraLEXGRyuZ7dnQjxetZ3BvKnQN
>> bKDgRObC78ro0O9ibslZh9rn5w9wxf8T8EQ65JvQdQxyRK4qLC+bk53tPcDz77M1
>> LJ+su7Fq2RLrcqY4/lVK
>> =0uH4
>> -END PGP SIGNATURE-
> I thought I would share this because it proves that they're fighting a
> NSL and thus had one put in to action on them in the first place.
> 
> I realize that you enjoy the "free" services from them and that you lack
> the money to use anything else, but it is just something to think about
> regarding what happens when a handful of companies control almost the
> entire internet and the bigger picture - what happens if a change of
> management leads to them dropping the challenge? what companies simply
> comply and we never hear about it?
> 
> A theoretical condition of doing business in country X (say china) would
> be messing around with certain pages to provide bad advice and
> contaminated software to people, you don't have to get the elite
> security specialist types who take extraordinary precautions you simply
> have to get the average joe who doesn't know anyone in real life who can
> provide a real root of trust (even I don't)
> 
> The cloudflare captcha is clearly designed to fingerprint the user
> (which works even with a generic DVM due to machine specs) or else it
> wouldn't need javascript, it is obvious that they have a market interest
> in tracking people even those who use VPN's.
> 
> I bet half the users on this mailing list have never considered the cost
> of "free" so my goal is to get people thinking about it.
> 

There is huge discussion on torproject.org on cloudflare ; additionally
to the annoying (and as I learned thanks to your question yesterday)
user-tracking Captcha I may add that, running a non-exit(!) tor server
at home, my home IP is banned (even with an insecure browser) from a lot
of useful sites, British Airwairs is on example (that I boycott for them
banning me), and many others. Almost all of them are linked to CF if one
looks well the whois entries.
This behaviour of Cloudflare seems clearly politically motivated to me :
there is no danger, no malicous packets, simply nothing that is emerging
from my tor middle relay!  The "com" about NSL fighting does not mean
that Cloudflare are with the good side of the force. Not at all. It is
only "com" (communication or comedy?)  Bernhard



-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9b23ff19-fb13-edf4-741c-5371f997cff6%40web.de.
For more options, visit 

[qubes-users] DVM savefile creation failed

[haaber]

Hello,
I get the error message in the title when trying to open a  DispVM.
It is my firt try to play with disposable VMs in and out-of-the-box
install.  Where do I find log files on that? Thank you,Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/03aea006-b911-dbe4-3f11-f0fe4668c16a%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Tor Client

[haaber]

Hello,

please be aware that, as explained here,
https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea you
should think twice before using torrent over tor. It can DE-anonymize
you.  Bernhard


On 01/10/2017 06:03 PM, 'Thebigthing' via qubes-users wrote:
> Hey,
> how i can install torrent client?
> I tried:
> sudo yum install transmission
> but there's  no package.
> 
> Thanks, for your time.
> 
> -- 
> You received this message because you are subscribed to the Google
> Groups "qubes-users" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to qubes-users+unsubscr...@googlegroups.com
> .
> To post to this group, send email to qubes-users@googlegroups.com
> .
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/cCUnKpEjDkzRW7F0q2bv_E1-WPCE5cb_JFDzBfjni0lEXbK-V6lyNkm31NyQVh7Ivczssh9hTOVzCRjo2G35D0HUXpGdCG3xu37zKZWoSgo%3D%40protonmail.com
> .
> For more options, visit https://groups.google.com/d/optout.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/da3743f6-b7d3-33ca-d542-a850ec0be8f9%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] How i can play video?

[haaber]

There may be an alternate solution : play videos with debian8. It should
ship ffmpeg related players, right?   Bernhard


On 01/11/2017 04:14 PM, Unman wrote:
> On Wed, Jan 11, 2017 at 09:07:17AM -0500, 'Repairing' via qubes-users wrote:
>> Still trying to figure out Qubes,
>>
>> When i open movies with "videos application", i get:
>>
>> AC-3 (ATSC A/52) decoder, MPEG-4 Video (advanced simple profile) decoder are 
>> required to play the file, but are not installed.
>>
>>
>> I also tried:
>>
>> Banshee
>> Parole
>> Snappy
>>
>> But there's just black background with them.
>>
>> Your time is much appreciated.
>>
> 
> This  comes up so often it should be a FAQ.
> The decoders you need don't ship with Fedora - they may be buggy, patent
> encumbered and nasty, so Fedora doesn't include them.
> But they are available from the RPM Fusion repository.
> 
> Look at the bottom of www.qubes-os.org/doc/software-update-vm
> Enable that repo (if you must)
> Then you'll be able to install the decoders you need - most likely from
> gstreamer, you want gstreamer good, bad and ugly plugins to cover all
> sorts of cases and ffmpeg and libav
> I'd advise you to clone your existing fedora template and pollute the
> clone with all this stuff, and then use that clone to back the qubes
> where you want to play Videos.
> 
> 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0fafcdf0-85b2-60e2-3ed1-1617d9d66231%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] debian-8 template problem

[haaber]

Hello,
I come back to my video-player problem. While I understand that qubes
won't ship fedora software that fedore accepts only in rpmfusion, there
seems an easy solution to my concrete problem: use the debian8 template
since they ship mplayer2 for example without trouble ...

However, when I shut down the appVM and change its template to debian8,
I can not even open a terminal. The appvm seems to run, qubes vm manager
says, but no application is visible. When I revert it back all is
normal. Since this is a fresh install (5 days old), I probably do some
newbe error; so I appreciate some hint of yours. Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/fb791699-5d06-287b-6be7-f9a28e645b63%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] after install - how use network (esp. wireless) ?

[haaber]

Hello,

sorry to annoy you with stupid beginner questions. I just got to install
Qubes. I feel quite helpless, which after 15 years of running "standard
linux" is an unusual thing :)

First, I am stuck with an easy sounding problem : network. The help in
"documentation"  is still a stub (I could write some parts once I
understand them:) Anyhow: so how do I activate the wireless card, select
a network, and all of that? I looked in a dom:sys-net terminal for
ifconfig, but is does not look like I am used to. I tried wpa_cli but it
hangs trying to connect to wpa_supplicant, Networkmanager is only for
root ...

A second (even more stupid) question is how configure a cube: I did some
test in dom:work and now it does no longer start - and without seeing it
in the dom-manager, I cannot undo the bad setting. 


Thanks, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/85281d6e-9277-b024-d4f8-0a91a2e41d18%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] migration std. linux -> qubes : how integrate "old" user data

[haaber]

Hello,

the question is in the title. I want to migrate from a standard linux
distro (debian) to qubes. I have an internal with my old /home/ and I
have the same content on an external hdd. The experimental qubes install
went on an SDD. I guess that within qubes I should separate my old /home
content in the appropriate qubes, otherwise I loose a big part of the
aimed security. So just adding the (encrypted) /home to dom0 or
somewhere else does not seem an intelligent way to procede.

Should I rather

a) shrink the luks system, generate a new one next to it, migrate say
work into the new, delete work on old etc. to generate one luks volume
per cube? OR

b) Since the install is new, re-do it, let qubes reformat the internal
hdd as /home and then fetch my data from the backup?


Thank you!  Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/04439094-aec8-3e7e-b1fc-6e27f3d7f468%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] installing on VM retention

[haaber]

I am far away from being expert, but as I read the doc (and tested

myself), the procedure is

1) start template VM

2) install software in template VM

3) shutdown template VM

4) restart your user VM and the software will persist.


Bernhard


On 01/07/2017 09:18 PM, 5w8ntn+1zzdj5znb09fg via qubes-users wrote:
> after performing sudo commands i can successfully install application from 
> respository
>
> it works well in the vm
>
> but if i shutdown the vm and restart it the application has vanished
>
> what am i missing when i install in the vm to keep it regardless?  kind, jim.
>
>
>
>
>
> 
> Sent using Guerrillamail.com
> Block or report abuse: 
> https://www.guerrillamail.com//abuse/?a=UFR2AB5NVqcQmh2U93EQdRjCStifx8dDiadNcQ%3D%3D
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/490c59ac-1a31-92e7-bfdf-5d8ba36e3145%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Install Problem // existing lvms

[haaber]

Hi, I have for years debian running on my machine: /boot on a usb key,
the /root on a 32g SSD and /home on a HDD. All filesystems are fully
encrypted. I want to give qubes a try, at least, if I can install it :)
So I first made a full home backup, and a full dd take of the SSD drive.
That way I hope to be able to "turn back" if install fails. Also, I can
overwrite the SSD without fear entirely, which is necessary since
otherwise there is not enough space.

I made the installer delete the SSD volume and use it as root, but then
it is unhappy with available space. It wants 250g somewhere - which is
OK, it may use the hdd. But somehow here I get stuck, warnings and
abandoned the install. Can I preserve the existing encrypted HDD volume
(providing the passphrase) on install ?

Thank you for any hint / clarifying question / comments !

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/2f9dcb0f-8b6e-a812-16d0-487850b78732%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] compose key

[haaber]

Hello,

for foreign languages (accents, etc) I used to have a compose key
configured. I have no idea how to do this within qubes. Has anyone
had/solven this problem already? Thank you!   Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/04509dfa-50dc-b285-ac6b-16d7ec342360%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] fedora - mplayer (command line)

[haaber]

Hello,

I wanted to provide my fedora template with mplayer (command line 
version). But according to dnf / yum that does not exist (?). This seems 
a subject on its own in stand-alone fedora (f22 at least), and have 
qubes-fedora won't make it more easy, I fear. I could live with vlc as 
well, but it does not exist either.


Does somebody have this problem before me? Thank you!  Bernhard

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ca5782d0-c6bb-ffe9-ef6a-65ea9278b9bc%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] DVM savefile creation failed

[haaber]

> On 01/14/2017 10:13 AM, haaber wrote:
>> Hello,
>> I get the error message in the title when trying to open a  DispVM.
>> It is my firt try to play with disposable VMs in and out-of-the-box
>> install.  Where do I find log files on that? Thank you,Bernhard
> 
> You can try manually generating the savefile with this:
> dom0$ qvm-create-default-dvm --default-template
> 
> It should complete without errors.
> 
> Chris
> 

Thank you Chris, that did it and showed the problem : I was "out of
memory". After closing some VMs it worked perfectly. All the best,
Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c71b9cb9-84f6-c0ce-b980-1f6043a3a704%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] update process question

[haaber]

Hello,
I have some understanding pb with updates. All my templates connect via
TOR (sys-whonix) to the Internet. But normal repos. When I  sudo apt-get
update, say in a debain-8 template, I have a certain number of lines like

Ignhttp://http.debian.net jessie InRelease
Ignhttp://deb.qubes-os.org jessie/main Translation-en_US
Ignhttp://deb.qubes-os.org jessie/main Translation-en

Is this "normal" ?  May I ignore it?  Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/6255ceca-9037-9513-0579-3851fa770674%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] again usb problems

[haaber]

Hello,
I need some help with USB. I cant mount them apart in sys-usb.
Concretely, I have the following contradicting informations:

On one hand:

[ me@dom0 ~]$ qvm-usb -l
sys-usb:3-2 13fe:4100 _USB_DISK_2.0_070A273523959238
[ me@dom0 ~]$ qvm-usb -a private sys-usb:3-2
ERROR: qubes-usb-proxy not installed in the VM

Although

[user @ private ]
sudo apt-get install qubes-usb-proxy
Reading package lists... Done
Building dependency tree
Reading state information... Done
qubes-usb-proxy is already the newest version.

The AppVM "private" runs on a up-to-date  debian8 template. How can I
narow down the problem? Thank you!  Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e37faa8f-e625-06e4-fc08-84e77c77a273%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] again usb problems

[haaber]

> On Mon, Mar 20, 2017 at 10:45:26PM +0100, haaber wrote:
>> Hello,
>> I need some help with USB. I cant mount them apart in sys-usb.
>> Concretely, I have the following contradicting informations:
>>
>> On one hand:
>>
>> [ me@dom0 ~]$ qvm-usb -l
>> sys-usb:3-2  13fe:4100 _USB_DISK_2.0_070A273523959238
>> [ me@dom0 ~]$ qvm-usb -a private sys-usb:3-2
>> ERROR: qubes-usb-proxy not installed in the VM
>>
>> Although
>>
>> [user @ private ]
>> sudo apt-get install qubes-usb-proxy
>> Reading package lists... Done
>> Building dependency tree
>> Reading state information... Done
>> qubes-usb-proxy is already the newest version.
>>
>> The AppVM "private" runs on a up-to-date  debian8 template. How can I
>> narow down the problem? Thank you!  Bernhard
> 
> What template are you using for sys-usb?
> Have you checked that you have qubes-usb-proxy installed there?

Hi Unman, thank you for helping.
the template for sys-usb is a fedora-24-minimal clone, that I called
fedora-24-usb. It has  qubes-usb-proxy-1.5.0-1 installed.

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/3fc3a9a1-bb08-3247-e644-c37430e7f127%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] again usb problems

[haaber]

> On Mon, Mar 20, 2017 at 11:13:12PM +0100, haaber wrote:
>>> On Mon, Mar 20, 2017 at 10:45:26PM +0100, haaber wrote:
>>>> Hello,
>>>> I need some help with USB. I cant mount them apart in sys-usb.
>>>> Concretely, I have the following contradicting informations:
>>>>
>>>> On one hand:
>>>>
>>>> [ me@dom0 ~]$ qvm-usb -l
>>>> sys-usb:3-213fe:4100 _USB_DISK_2.0_070A273523959238
>>>> [ me@dom0 ~]$ qvm-usb -a private sys-usb:3-2
>>>> ERROR: qubes-usb-proxy not installed in the VM
>>>>
>>>> Although
>>>>
>>>> [user @ private ]
>>>> sudo apt-get install qubes-usb-proxy
>>>> Reading package lists... Done
>>>> Building dependency tree
>>>> Reading state information... Done
>>>> qubes-usb-proxy is already the newest version.
>>>>
>>>> The AppVM "private" runs on a up-to-date  debian8 template. How can I
>>>> narow down the problem? Thank you!  Bernhard
>>>
>>> What template are you using for sys-usb?
>>> Have you checked that you have qubes-usb-proxy installed there?
>>
>> Hi Unman, thank you for helping.
>> the template for sys-usb is a fedora-24-minimal clone, that I called
>> fedora-24-usb. It has  qubes-usb-proxy-1.5.0-1 installed.
>>
>> Bernhard
> 
> Hello Bernhard,
> 
> Can you check that you have /etc/qubes-rpc/qubes.USB present in both the
> sys-usb and the "private" qube.
> 
> As you are using a disk, you could try using qvm-block to attach the
> storage - can you try that for me? (You can also use the "Block devices"
> menu from the Qubes Manager icon.)

Hello Unman,

1)  /etc/qubes-rpc/qubes.USB is present (also -attach & -detach) in
sys-usb and in private

2) the "DISK" was a usb-key - that my mother took home in the meantime.
But the problem is generic, so I just grabbed another USB key (this time
from my wife :)

[ me@dom0 ~]$ qvm-usb
sys-usb:3-3.4   058f:6366 Generic_Flash_Card_Reader_Writer_058F63666438

[ me@dom0 ~]$ qvm-usb -a private sys-usb:3-3.4
ERROR: qubes-usb-proxy not installed in the VM

3) qvm-block test:

[ me@dom0 ~]$ qvm-block -l
sys-usb:sda Card_Reader () 29 GiB
sys-usb:sda1Card_Reader () 29 GiB

[ me@dom0 ~]$ qvm-block -a private sys-usb:sda1

[ user@private] lsblk
xvdi   202:128  1 29.1G  0 disk

[ user@private] mount /dev/xvdi /mnt

works perfect ! Thank you Unman. It does solve USB-key / USB-disc
problems at least ... (and insures backups :)



On the other hand, of course, my built-in camera

sys-usb:2-1.7   05c8:0369 SunplusIT_INC._HP_HD_Webcam

won't be available in my  " phone & video "  qube. So there remains a
little path to go. If you have another hint for that?

Thanks, Bernard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/29c31917-f460-19d0-8913-381761a940a2%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] again usb problems

[haaber]

Hi Vit,

yes, sys-usb, has it installed, 'private' VM as well.

The error message is clearly not correct. This is why I ask how to find
out better what goes wrong ...  Thx Bernhard


On 03/28/2017 05:34 PM, Vít Šesták wrote:
> What about the target (“private”) VM? Does it have qubes-usb-proxy installed?
> 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/7ed8edf0-c784-cd7b-1736-d3c1b16d1f5b%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Tip: How to speed up QubesOS shutdown

[haaber]

On 03/19/2017 01:40 AM, Jean-Philippe Ouellet wrote:
> On Tue, Mar 14, 2017 at 7:11 PM, haaber <haa...@web.de> wrote:
>> I dont't have any e820 pci device as far as I know, but shutdown is
>> definitely a problem. xfce shuts down, and then I have a black screen
>> with a blinking cursor, and, afaik unless I brutally remove electricity.
>> No clue if this is related to Grzesiek's problem ... Bernhard
> 
> e820 does not refer to a device, but rather a table containing memory
> layout information provided by the bios [1].
> 
> [1]: 
> http://wiki.osdev.org/Detecting_Memory_(x86)#BIOS_Function:_INT_0x15.2C_EAX_.3D_0xE820
> 
Oups :) ! That is funny. So my shutdown pb could be related that I added
a second 8G mem bar? At least both occured approx. simultaneously. I
just never made the link.  Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/371db135-5a51-be7c-a650-53f7ab9179a4%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: can we have debian-minimal?

[haaber]

> On 2017-03-19 11:38 AM, Dominique St-Pierre Boucher wrote:
>> On Sunday, March 19, 2017 at 5:51:39 AM UTC-4, tnt_b...@keemail.me wrote:
>>> hi there,
>>>
>>> fedora minimal is great idea to have inside Qubes, i wonder why we dont 
>>> have debian minimal as well inside Qubes ?
>>>
> You can create one yourself using qubes-builder (
> https://github.com/QubesOS/qubes-builder ); I just did it myself a
> couple of days ago, and it's great! I tried to do do a stretch-minimal
> but it failed somewhere in the middle, but jessie-minimal worked fine
> and I've switched all of my service vms to use that with coldkernel.
> I'll probably get to creating a Thunderbird-only VM using that template
> soon.
Since I am one of the "very interested people", I followed your link. AT
first glance I do not know how to use that to get a debian-minimal.
Would you have time to explain the procedure a bit more ? That would be
really nice & helpful. You could even add a paragraph to the qubes-pages
to immortalize your effort :)  Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/37747fbb-7759-6836-672d-6346f7643dcd%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Tip: How to speed up QubesOS shutdown

[haaber]

>>> Have you tried the solution suggested here before of shutting down other
>>> vms first, then sys-usb and sys-net? Andrew, I think, posted a simple
>>> script that he uses. I suspect that that will have more impact with
>>> fewer consequences than this proposal, but user experience will be key
>>> here: comments ?
>>
>> Yes, I did try that, this is how I found out that on my system it is not 
>> possible to cleanly shut down VMs that hold PCI devices. If I try shutting 
>> down sys-net the VM Manager hangs for a few minutes, then the entire system 
>> stops responding then the machine gets killed, then VM manager throws an 
>> exception and then system becomes responsive again. After setting 
>> pci_e820_host to False I can cleanly shutdown sys-net and sys-usb just like 
>> any other VM.
>>
> 
> So that sounds very system specific. Why not put together a tip
> incorporating Andrew's script ( which will help on almost all
> machines), and then yours as a special case to be used where that
> doesnt help?

I dont't have any e820 pci device as far as I know, but shutdown is
definitely a problem. xfce shuts down, and then I have a black screen
with a blinking cursor, and, afaik unless I brutally remove electricity.
No clue if this is related to Grzesiek's problem ... Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8452d566-22c1-ff28-aa86-93ad7c74b750%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Curious: https for yum repos

[haaber]

Chris,

> Fedora *unfortunately* is the blacksheep here. It doesn't sign a repo
> file, therefore an attacker can hold back individual packages withing
> what appears to the user as a stream of normal update cycles.

I read this as "fedora is less safe" since exposed to described
attacks. Actually I never used it in my prequbes life, and I would still
not if there were alternatives to fedora-minimal.

So: Is there a debian-minimal available? For normal and even advanced
users it is almost impossible slim down a std debian via uninstalling
unused packages without destroying the system : which of the (in large
parts cryptic) package names are vital?

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/82474c54-4afe-cff1-ea8b-b569b56b4748%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] HDMI-related threats in Qubes OS

[haaber]

> I think having a graphics driver that disables any auxiliary modes (on
> the GPU) would be a reasonable first step in addressing the issue. It
> may also be possible to disable HDMI ports in favor of simpler ones like
> VGA. I'm not sure how much input DVI and Displayport allow, but I think
> there's a chance that DVI is similar to VGA in this regard.

I just mention that even good-old VGA has a bidirecional serial
communication build-in (google: vga & I2C).   Bernhard

P.S: A side remark is that this may be turned in a feature rather than a
problem : it is a way to replace usb for some applications (yubikey type
cards for example, where transmission speed is not a problem).

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/bfdd3d8e-2a16-c8ab-b927-02a78b78f370%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: problem with qubes xfce menu

[haaber]

On 03/10/2017 05:51 AM, cooloutac wrote:
> On Thursday, March 9, 2017 at 3:04:34 PM UTC-5, haaber wrote:
>> Hello,
>> I realise with surprise that some items in the "Q"-symbol that gives the
>> xfce menu have disappeared: the settings menu (!), the link to a dom0
>> termnal  & the link to debian-8 template.
>>
>> Is there a way to recreate these items? Bernhard
> 
> what desktop you using? xfce  try alt f3.

Hello cooloutac, that brings indeed the "application finder". But it
won't find the items I miss.  For debian-8 I fear my endless attempts to
install debian-8-dvm as standard template (involving
virsh -c xen:/// undefine debian-8-dvm )
seems to have taken away the debian-8 out of the list. This is not the
most annoying. Qubes-VM-manager still sees it, so I can start & run a
command by hand. The missing dom0-console is more annoying (I can still
do Alt+F2 + xterm), but the missing xfce settings is really annoying.

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/96101a38-f22f-8bc6-cc12-84bde5b6d78b%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] problem with qubes xfce menu

[haaber]

Hello,
I realise with surprise that some items in the "Q"-symbol that gives the
xfce menu have disappeared: the settings menu (!), the link to a dom0
termnal  & the link to debian-8 template.

Is there a way to recreate these items? Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0089084a-d6f9-c47b-32ae-29af870a71c8%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Anon-whoix

[haaber]

Hello,

I have a out-of-the-box R3.2. I am surprised about the large size of
anon-whonix : even the gateway has 3.9G and packages like imagemagick
installed ... is there a more lightweight solution as a
tor-proxy-gateway template?

Same remark for the anon-whonix template based on whonix-ws which has
even 5.9G. Do you use this template for anything else than tor-browser
?? If not, 5.9G seems a waste of space ...

Somehow, I feel I don't understand what these two template are good /
thought for. You may help me understand better?  Thanks. Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c717af4b-2aa9-b21c-937d-5d1e42dc2622%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] do I really need these packages in dom0 :?

[haaber]

> Marek wrote:
> Yes. You can start with 'dnf remove initial-setup-gui' - it will propose
> additional packages not needed anymore. But carefully review that
> list before confirming.

While this is true, it is of no help for a lot of people, myself
included. The following packets are proposed for deletion. 

ModemManager-glib
NetworkManager-wifi
anaconda-gui
anaconda-widgets
enchant
fros
geoclue2
glade-libs
harfbuzz-icu
hunspell
hunspell-en-US
initial-setup-gui
libgnomekbd
libicu
libnm-gtk
libreport-gtk
libtimezonemap
mobile-broadband-provider-info
nm-connection-editor
python3-meh-gui
webkitgtk3
wpa_supplicant
yelp
yelp-libs
yelp-xsl

While I can easily see that hunspell is not needed in dom0, for packages
named "lib*"  this much more delicate ... so, according to you Marek, is
there something important I should not delete?

Thanks, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e85a6f01-afca-b39b-bff5-37a5c0ae8aad%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] qubes wallpaper

[haaber]

Hello,

I understand that importing a custom wallpaper may open a security
breach for exploits against the image decoder inside dom0. On the other
hand side, people (me inclusive) like to customize a little bit their
system.

Nothing would be more natural as to 'sanitize' pictures that should go
to dom0. Since qubes trusts rgb format (at least to secure pdf's), this
seems a natural starting point. Helas!  xfce wallpaper management cannot
read rgb files ...

Did someone already think about a possible solution? Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/2c4aae7e-9a9c-8c08-d09c-b070e9d78a44%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: problem with qubes xfce menu

[haaber]

On 03/11/2017 01:44 PM, Unman wrote:
 Hello,
 I realise with surprise that some items in the "Q"-symbol that gives 
 the
 xfce menu have disappeared: the settings menu (!), the link to a dom0
 termnal  & the link to debian-8 template.

 Is there a way to recreate these items? Bernhard
>>>
> 
> Hello Bernhard,
> 
> I should apologise for the tone of my last email to you, which was
> pretty short. It was the end of a stressful day.

I read your very detailed and patient answers on this list for a while,
and this last one is another example. Thanks! You see, you were right, I
did not search profoundly before filling up your mailboxes with my
question. Meanwhile I did, yet without success. The log-in-logout trick
does not work.

> If ALL your dom0 entries have disappeared then I suspect that the desktop
> files have been deleted from those directories, or moved.
> So, have a look in /usr//share/applications - there should be many
> .desktop files.
There is not a single one. Strange. I had a battery failure with several
unwanted hard power-offs. Maybe orphaned inodes were removed when
rebooting? At least we have localized my problem :)

> If there aren't all is not lost - you can look for them using 'find -name
> *desktop' as root - I'd look in /lib., /usr and /var.
> What you want are files that aren't prefixed "qubes", but just say (e.g
> xfce4-terminal.desktop) If you find one open it in a text editor and
> make sure that it contains a line "Exec "
no *xfce*.desktop file in /var or /lib. I have 6 such files in /usr , 3
of which contain the word "exec":

I have no sdt fedora left over, only cloned & enriched specialized
f-24-minimals.
As you said, for dom0 I only need xfce4-terminal.desktop (no copy left
apart "helpers") and xfce4-settings-manager.desktop (no copy either).

> Alternatively, reinstalling the packages you are concerned about should,
> I think, reinstate the desktop files. 
> sudo dnf reinstall 

I accumulate problems, it seems:
[me@dom0] sudo dnf reinstall xfce4-settings-qubes
Failed to synchronize cache for repo 'qubes-dom0-cached', disabling.
Installed package xfce4-settings-qubes-3.2.2-1.fc23.x86_64 (from
anaconda) not available.
Error: Nothing to do.

> Or you could write your own .desktop file, or search for one on the web.
> If you are really stuck I can send you some.
Or I follow  Raahelps comment and reinstall everything :)  In the
meanwhile  xfce4-terminal.desktop would be nice to have (could you send
it as PM, please)? I don't really need the settings menu - and in case I
should be able to run it from the command line, don't I? But I can't
live without a terminal.

Bernhard


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/dd466b4a-e183-e443-c78e-752e6120ebad%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] qvm-clone option -p not working

[haaber]

For reasons of disk space I need to clone experimental VM's on the HDD
and not on /var/lib/qubes sitting in my small SSD. So I try in dom0

qvm-clone  -p /path-to-HDD/   existing-vm  new-name

However, the -p option is ignored:

--> Creating directory   /var/lib/qubes/vm-templates/new-name

Of course it fails a minute later by disc-full error. When I generate

 /var/lib/qubes/vm-templates/new-name

as a symlink to /path-to-HDD/  qvm-clone hurts as well. I tried a local
copy of qvm-clone where I remove the "dir exists" test, but then the
script hurts later with other symlink problems. Can I clone a VM manually?

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/017c1db4-1087-4bfe-dc6c-f3755e193b8f%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] whonix / tor question

[haaber]

Hello,

I have a question on the behavior of whonix-gw. Most of us will use
multiple mailboxes, for example one for this list, maybe one private
mails, one for shopping and one work. If they connect via sys-firewall
directly to the , e.g. MAC-spoofing is a surveyed place (a café for
example) is just a way to attract attention:  among my ~300 colleagues I
am the only one that uses this mail server quadruple: as a consequence
so I am uniquely identified, and then known as a MAC-spoofer - thus even
more suspect.

So I want to use tor. Imagine that all three/four IMAP connections leave
the tor network by the same exit-node. Then the same happens: my
tor-exit-node can be associated with me and all my whonix traffic is in
danger of de-anonymization.

Does the tor-setup / whonix setup address this problem?

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/f70f0430-a164-6433-5188-ca7e021d3e7f%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] problems by changing template on sys-net and sys-firewall

[haaber]

> i killed my fedora23 template, so it won't start because of the
> non-executed qrexec-daemon.
> So i decided to change to debian8.
> 
> but the problem is, if i change to debian, i can not see any
> network-connection. Just if i go to network manager of the sys-net, i
> can see them, but i can not start them, because they are not at the
> right top of the screen... there are NO connections at all.
> 
> is there some options i must change manually, by changing the template
> of sys-net and sys-firewall?

Please try  "Add more shortcuts" and make sure that Networkmanager is in
the selected list. This is necessary when switching from fedora-x to
debian-y back or forth.
Greets, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9ca2b562-a0e6-a15f-8be2-34ec36602f43%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] disp-vms were great - if they worked.

[haaber]

The DispVM's make me crazy. Last week (with your generous help) finally
dispVM with debian template worked. Now --without any change that I am
aware of-- it does again not.  I tried to start it within dom0 - that
way I get a max of error messages. ("the DVM savefile creation failed"
is kind of unspecific).


[me@dom0 ~]$ echo xterm | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell
dom0 DEFAULT red
time=1489389887.32, qfile-daemon-dvm init
time=1489389887.32, creating DispVM
Can't get domid of domain name 'debian-8', maybe this domain does not exist.
--> Creating volatile image:
/var/lib/qubes/appvms/debian-8-dvm/volatile.img...
--> Loading the VM (type = AppVM)...
Traceback (most recent call last):
  File "/usr/bin/qvm-start", line 136, in 
main()
  File "/usr/bin/qvm-start", line 120, in main
xid = vm.start(verbose=options.verbose,
preparing_dvm=options.preparing_dvm, start_guid=not options.noguid,
notify_function=tray_notify_generic if options.tray else None)
  File "/usr/lib64/python2.7/site-packages/qubes/modules/000QubesVm.py",
line 1942, in start
self._update_libvirt_domain()
  File "/usr/lib64/python2.7/site-packages/qubes/modules/000QubesVm.py",
line 755, in _update_libvirt_domain
raise e
libvirt.libvirtError: operation failed: domain 'debian-8-dvm' already
exists with uuid 603478e2-2d9f-4b27-c052-2910eaf6819b8


So, once again, it is libvirt / virsh. But what is it this time?? Sigh
of despair! Thank you for helping once more.

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/174c98aa-a590-fd89-553c-8a2b58cb6d30%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: problem with qubes xfce menu

[haaber]

On 03/10/2017 08:05 PM, cooloutac wrote:
>> Hello,
>> I realise with surprise that some items in the "Q"-symbol that gives the
>> xfce menu have disappeared: the settings menu (!), the link to a dom0
>> termnal  & the link to debian-8 template.
>>
>> Is there a way to recreate these items? Bernhard
>
>>>
>>> To recreate the debian-8 menu you should be able to run
>>> qvm-sync-appmenus. (You'll need to start the template first.)
>>> This is referred to at www.qubes-os.org/doc/managing-appvm-shortcuts
>>>
>>> There have been numerous threads about using and abusing the menu
>>> system in xfce - please search and read them before posting here.
>>
>> main problem with xfce menu editor is it doesn't let you "abuse" it lol.  
>> like creating or deleting new entries.  Which would be much easier then 
>> editing some files like a developer.
>>
>> Would that command also help other default shortcuts like shortcut for dom0 
>> desktop settings?
> 
> Actually  I gotta say Bernhard if that happened to me I would freak the heck 
> out and probably reinstall the whole system from another iso.  Do you know 
> how it happened or what you were doing possibly cuased it, if I'm 
> understanding you correctly? You are missing the settings shortcut? Were you 
> tinkering with anything?

This is not the only 'strange' thing, and I wait the first occasion of 1
day without anything good to do to reinstall everything. Hope this
happens before Q4 comes out .. I already tested emergency backup of
data, via a live-usb key break-in into my crypto-descs. Knowing that I
am able to do that is relaxing a lot :)

So: Unman's command worked for debian menu item, but it does not work
for dom0.
Would be too easy! But he pointed a page to read, so I rtfm.

Thnaks a lot, guys! Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8e403fa9-817b-a564-2689-fb0b08f39bfd%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] disp-vms were great - if they worked.

[haaber]

Update:

>> The DispVM's make me crazy. Last week (with your generous help)
>> finally dispVM with debian template worked. Now --without any change
>> that I am aware of-- it does again not.  I tried to start it within
>> dom0 - that way I get a max of error messages. ("the DVM savefile
>> creation failed" is kind of unspecific).

Jean Quellets hint qvm-ls & qvm-shutdown was not applicable, nothing was
running that I could have shut down...

On 03/13/2017 09:45 AM, Nick Darren wrote:
>in 'dom0', you can check it using:
>
>$ virsh -c xen:/// list
>
>then 'undefine' the dvm template as shown above and try again after >that.=
>
>
>$ virsh -c xen:/// undefine debian-8-dvm

The list contained nothing important to mention here, but the undefine &
retry command worked. Thanks!

That is a strange command to memorise just to start a disp-vm :))  Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8d986c7a-4d62-27e8-5941-536ad5633815%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Kicking the sudoers dead horse

[haaber]

Unman wrote:
> (You can configure the mime and default associations to use
> qvm-open-in-dvm, so you can double click on a file and it will
> automatically open disposableVM and display it there.) If you ensure the
> disposableVM is spawned offline there is (almost) no chance of data being
> exfiltrated.
Very nice & seducing construction.
Is that easy to set up mime-types in a graphic mail client like icedove
or do you use mutt/pine for this? I would be interested to know how to
do ensure a link sent by mail be opened in a disp-vm ...

Cheers, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/627f7ffd-53b1-490f-83ed-8d0dd3fa7ed5%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qvm-create-default-dvm fails

[haaber]

On Mon, Mar 06, 2017 at 03:49:30PM +0100, Bernhard wrote:
>> On 03/06/2017 02:55 PM, Unman wrote:
 self._update_libvirt_domain()
   File "/usr/lib64/python2.7/site-packages/qubes/modules/000QubesVm.py",
 line 755, in _update_libvirt_domain
 raise e
 libvirt.libvirtError: operation failed: domain 'debian-8-dvm' already
 exists with uuid 61320a0c2-1e2a-4bff-b064-29fe587619b8

 Bernhard
>>> Look here:
>>> www.qubes-os.org/doc/remove-vm-manually
>>>
>>> That libvirt error sghows that you have a redundant entry in the db,
>>> which you need to remove.
>>> Then try creating the dvmTemplate again. Remember, no sudo!
>> Hello Unman, I looked at your link.
>>
>> |1) rm -rf is done. 2) qvm-remove --just-db debian-8-dvm says "there is
>> no VM with this name.." (and he's right!) 3) 
>> in|||~/.local/share/applications/ there no thing such as |debian-8-dvm*
>> There is debian-8-gnome-terminal.desktop
>> debian-8-gpk-application.desktop and
>> debian-8-qubes-appmenu-select.desktop I won't touch these, will I ??
>> Still, the error persists. Find finds no debian-8-dvm* file in /var ...
>> I also find -type f -size -1M -exec grep -il debian-8-dvm \{} \;
>> verifyied my /var: no debian-8-dvm string wheresoever. However, I found
>> /etc/libvirt/libxl/debian-8-dvm.xml I moved it to 
>> |||/etc/libvirt/libxl/debian-8-dvm.xml|.old to see what happens, but the
>> error persists still. Desparate ... any ideas? Bernhard |
> Try this:
> virsh -c xen:/// undefine debian-8-dvm
>
> Then try recreating the dvmTemplate again.
This did it, thank you! I found the command some hours ago, after your
last mail that made me google libvirt issues. I posted it immediately,
but maybe I used the wrong "from" address and the mail was eaten by
google groups. Anyhow, THANK YOU so much! Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ed848df0-0bd9-eee1-9cc7-0818372a7ee6%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] qvm-create-default-dvm fails

[haaber]

Hello,

I want to base my disp-vm's on debian-8. So I run in dom0

> [me@dom0 dvmdata]$  sudo qvm-create-default-dvm debian-8
> A VM with the name 'debian-8-dvm' does not exist in the system.

this is strange, since /var/lib.qubes/appvms/debian-8-dvm DOES exist.
Running it with "sh -x" prefix, I find the problem here:
> [me@dom0 dvmdata]$  sudo sh -x qvm-create-default-dvm debian-8
> [..]
> + /usr/lib/qubes/qubes-prepare-saved-domain.sh debian-8-dvm
/var/lib/qubes/appvms/debian- 8-dvm/dvm-savefile vm-default
> A VM with the name 'debian-8-dvm' does not exist in the system.

so the error  is produced by qubes-prepare-saved-domain.sh. Prefixing
the hurting command with  "bash -x" gives

>sudo bash -x qubes-prepare-saved-domain.sh debian-8-dvm
/var/lib/qubes/appvms/debian- 8-dvm/dvm-savefile vm-default
> [..]
> + qvm-start debian-8-dvm --dvm
> A VM with the name 'debian-8-dvm' does not exist in the system.

This is a python2 script. Running it with -v reveals

> [me@dom0 dvmdata]$ sudo /usr/bin/python2 -v /usr/bin/qvm-start
debian-8-dvm --dvm
> [..]
> # /usr/lib64/python2.7/gettext.pyc matches /usr/lib64/python2.7/gettext.py
> import gettext # precompiled from /usr/lib64/python2.7/gettext.pyc
> # /usr/lib64/python2.7/locale.pyc matches /usr/lib64/python2.7/locale.py
> import locale # precompiled from /usr/lib64/python2.7/locale.pyc
> # /usr/lib64/python2.7/copy.pyc matches /usr/lib64/python2.7/copy.py
> import copy # precompiled from /usr/lib64/python2.7/copy.pyc
> A VM with the name 'debian-8-dvm' does not exist in the system.

Here I am stuck. May anybody help me understand what may go wrong here? 
Bernhard


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b0b4fe5e-7d9c-2a1f-a3e6-b0a128d2eccd%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qvm-create-default-dvm fails

[haaber]

On 03/06/2017 12:49 AM, Unman wrote:
> On Sat, Mar 04, 2017 at 04:18:56AM +0100, haaber wrote:
>> Hello,
>>
>> I want to base my disp-vm's on debian-8. So I run in dom0
>>
>>> [me@dom0 dvmdata]$  sudo qvm-create-default-dvm debian-8
>>> A VM with the name 'debian-8-dvm' does not exist in the system.
>> this is strange, since /var/lib.qubes/appvms/debian-8-dvm DOES exist.
>> Running it with "sh -x" prefix, I find the problem here:
>>> [me@dom0 dvmdata]$  sudo sh -x qvm-create-default-dvm debian-8
>>> [..]
>>> + /usr/lib/qubes/qubes-prepare-saved-domain.sh debian-8-dvm
>> /var/lib/qubes/appvms/debian- 8-dvm/dvm-savefile vm-default
>>> A VM with the name 'debian-8-dvm' does not exist in the system.
>> so the error  is produced by qubes-prepare-saved-domain.sh. Prefixing
>> the hurting command with  "bash -x" gives
>>
>>> sudo bash -x qubes-prepare-saved-domain.sh debian-8-dvm
>> /var/lib/qubes/appvms/debian- 8-dvm/dvm-savefile vm-default
>>> [..]
>>> + qvm-start debian-8-dvm --dvm
>>> A VM with the name 'debian-8-dvm' does not exist in the system.
>> This is a python2 script. Running it with -v reveals
>>
>>> [me@dom0 dvmdata]$ sudo /usr/bin/python2 -v /usr/bin/qvm-start
>> debian-8-dvm --dvm
>>> [..]
>>> # /usr/lib64/python2.7/gettext.pyc matches /usr/lib64/python2.7/gettext.py
>>> import gettext # precompiled from /usr/lib64/python2.7/gettext.pyc
>>> # /usr/lib64/python2.7/locale.pyc matches /usr/lib64/python2.7/locale.py
>>> import locale # precompiled from /usr/lib64/python2.7/locale.pyc
>>> # /usr/lib64/python2.7/copy.pyc matches /usr/lib64/python2.7/copy.py
>>> import copy # precompiled from /usr/lib64/python2.7/copy.pyc
>>> A VM with the name 'debian-8-dvm' does not exist in the system.
>> Here I am stuck. May anybody help me understand what may go wrong here? 
>> Bernhard
>>
> Dont use sudo here - you may hit problems with permissions. The same
> goes for all qube operations - qvm-clone, create etc.
>
> Can you simply delete the  /var/lib/qubes/appvms/debian-8-dvm directory
> and then try 'qvm-create-default-dvm debian-8' , and report back?
>
Thanks for helping Unman! This happens:

[ me@dom0 ] rm -rf /var/lib/qubes/appvms/debian-8-dvm
[ me@dom0 ] qvm-create-default-dvm debian-8
--> Using TemplateVM: debian-8
--> Creating directory: /var/lib/qubes/appvms/debian-8-dvm
--> Copying the template's private image:
/var/lib/qubes/vm-templates/debian-8/private.img
--> Creating volatile image:
/var/lib/qubes/appvms/debian-8-dvm/volatile.img...
--> Creating icon symlink: /var/lib/qubes/appvms/debian-8-dvm/icon.png
-> /usr/share/icons/hicolor/128x128/devices/appvm-gray.png
Traceback (most recent call last):
  File "/usr/bin/qvm-create", line 223, in 
main()
  File "/usr/bin/qvm-create", line 201, in main
vm.create_on_disk(verbose=options.verbose, source_template=template)
  File "/usr/lib64/python2.7/site-packages/qubes/modules/000QubesVm.py",
line 1308, in create_on_disk
self._update_libvirt_domain()
  File "/usr/lib64/python2.7/site-packages/qubes/modules/000QubesVm.py",
line 755, in _update_libvirt_domain
raise e
libvirt.libvirtError: operation failed: domain 'debian-8-dvm' already
exists with uuid 61320a0c2-1e2a-4bff-b064-29fe587619b8

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1385c377-20b1-eebd-aa74-80e8b4dddb77%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Anonymizing hostname

[haaber]

On 02/28/2017 05:24 PM, Steve Coleman wrote:
> On 02/27/2017 03:48 PM, Dominique St-Pierre Boucher wrote:
>> Hello,
>>
>> I have setup the mac address change for qubes 3.2 with debian 9 as my
>> sys-net.
>>
>> I am trying to figure out a way to randomize the hostname that is
>> sent to the DHCP server. This is in an effort to minimize the risk of
>> os identification.
>
> I'm not quite sure why you need to hide you hostname on your local
> DHCP network. Is the purpose so that you "feel" more hidden? Anyone
> running p0f on your local network will guess your OS regardless of
> your IP/MAC/hostname randomization, and people outside your domain
> won't have your MAC or DHCP hostname, just your IP unless you/IT
> publish your name through DNS to the outside.
>
>
> But, You could try:
>
> sys-net>$ nmcli general hostname
><<< mine was empty
> sys-net>$ sudo nmcli general hostname xyzpdq.nowhere.com
> sys-net>$ sudo systemctl restart systemd-hostnamed
> sys-net>$ nmcli general hostname
> xyzpdq.nowhere.com
> sys-net>$ cat /etc/hostname
> xyzpdq.nowhere.com
>
>

Inspired by your exchange I tried to repeat at least the mac-spoof
procedure (following
https://www.qubes-os.org/doc/anonymizing-your-mac-address/ ). Since I
use an enriched f-24-minimal
I opted for macchanger .. it works well for my ethernet, but won't touch
the wireless mac address. Bizarre! I first searched a typo, but can't
find one. May this be a firmware problem (iwlwifi for Intel 7260)? How
to log the problem ??  Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a486537d-f03c-96e5-c628-3cfd1e75dde0%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] qubes-usb-proxy problem

[haaber]

Hello,

My sys-usb is based on a modified fedora-24-minimal template. I did of
course install qubes-usb-proxy in it, but --contradicting the qubes
doc-- the qvm-usb command is not available. What might go on there?
Thanks you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/f3290e17-e089-0872-0c88-092fa9dc999b%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] sys-whonix problem

[haaber]

Hello, after a bad power-loss yesterday (on qubes 3.2) my sys-whonix
won't start any more.

[me@dom0 ~]$ qvm-start Anon-whonix
--> Starting NetVM sys-whonix...
ERROR: VM kernel does not exist: /var/lib/qubes/vm-kernels/4.4.55-11/vmlinuz

I am confused by this message, since in qubes manager sys-whonix and
Anon-whonix VM are  set up to use 4.4.67-13 kernel .. can someone help
me please??

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/5d2a5333-2702-c732-04ff-63a5085543d1%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] sys-whonix problem

[haaber]

Solved. It seems a qubes VM manager bug to sometimes display wrong
kernel information. Could check & set values correct in the command
line. I think more & more that I shuold abolish the qubes VM manager,
and do everything  the old way on the dom0 console :)Bernhard


On 07/04/2017 10:19 AM, haaber wrote:
> Hello, after a bad power-loss yesterday (on qubes 3.2) my sys-whonix
> won't start any more.
> 
> [me@dom0 ~]$ qvm-start Anon-whonix
> --> Starting NetVM sys-whonix...
> ERROR: VM kernel does not exist: /var/lib/qubes/vm-kernels/4.4.55-11/vmlinuz
> 
> I am confused by this message, since in qubes manager sys-whonix and
> Anon-whonix VM are  set up to use 4.4.67-13 kernel .. can someone help
> me please??
> 
> Bernhard
> 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ce23fd43-863e-46cf-f1f9-a5a7ce824a28%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] ntp in debain-VMs

[haaber]

Dear qubes-community,  my debian-based VM's all have almost random
date/time settings. I tried to tackle this by setting up ntp correctly
in the template VM, but this does simply have no effect to the derived
appVMs. Culd someone help me with that?  Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/35bb2212-b6f8-7ae8-8685-cd7788fa9523%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] ntp in debain-VMs

[haaber]

>> Dear qubes-community,  my debian-based VM's all have almost random
>> date/time settings. I tried to tackle this by setting up ntp correctly
>> in the template VM, but this does simply have no effect to the derived
>> appVMs. Culd someone help me with that?  Thank you, Bernhard
>>
> 
> I'm getting consistent time in my Debian 9 VMs. Do you have your
> 'ClockVM' setting populated in your Qubes Manager Global Settings? Its
> normally set to sys-net.
Aha. Indeed, my sys-net died in Jan and I created a new one, called
sys-NET. So clockVM got setting lost at this moment. My sys-NET is based
on f24-minimal. Do I have to add extra packages in that VM to make ntp
work? I guess so ... thank you for further helpBernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a01f4472-ad64-fb2e-4c83-ea7840dd5ac3%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] debian 8 grsec vs thunderbird

[haaber]

Hello,
back in March I compiled a grsec kernel (precisely 4.8.13) for my debian
8 following the nice tutorial for qubes. I put my std debian-8 on this
new kernel. Since the rebranding of icedove to thunderbird, the
thunderbird executable died misrably with "killed". Funnily, it work run
under debian-9. So I was searching for differences, and I found that my
grsec kernel actually kills the thunderbird.  Any comments?

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/7a68d32a-1870-e58c-0010-470d673009e2%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] debian 8 grsec vs thunderbird

[haaber]

Some update : the same happens with 4.9.20.grsec. The reason seems
visible in ulimit -a:

core file size  (blocks, -c)   0

whereas thunderbird requests 4096 (whatsoever unit). Remains to
understand /etc/security/limits.conf

Bernhard




On 05/31/2017 09:02 AM, haaber wrote:
> Hello,
> back in March I compiled a grsec kernel (precisely 4.8.13) for my debian
> 8 following the nice tutorial for qubes. I put my std debian-8 on this
> new kernel. Since the rebranding of icedove to thunderbird, the
> thunderbird executable died misrably with "killed". Funnily, it work run
> under debian-9. So I was searching for differences, and I found that my
> grsec kernel actually kills the thunderbird.  Any comments?
> 
> Bernhard
> 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/46741116-66b2-634c-24ad-358ea8d30ad6%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: debian 8 grsec vs thunderbird

[haaber]

Thank you very much Reg! That solves miraculously the problem. I was
playing with -E instead and it did not help me. At least I learned some
minimal experience with  paxctl that way :))   Bernhard



On 05/31/2017 06:20 PM, Reg Tiangha wrote:
> On 05/31/2017 04:59 AM, haaber wrote:
>> Some update : the same happens with 4.9.20.grsec. The reason seems
>> visible in ulimit -a:
>>
>> core file size  (blocks, -c)   0
>>
>> whereas thunderbird requests 4096 (whatsoever unit). Remains to
>> understand /etc/security/limits.conf
>>
>> Bernhard
> 
> systemd actually ignores /etc/security/limits.conf, although anything
> launched by a gnome-terminal (and maybe some other things as well) does
> respect that file.
> 
> systemd looks at /etc/systemd/user.conf and /etc/systemd/system.conf
> instead so if you're changing variables in limits.conf, you could try
> setting them there as well.
> 
> Or you can disable the memory protections on Thunderbird; that's what
> coldkernel actually did by default if you used their paxctld
> configuration, but it only had a listing for Icedove and not for
> Thunderbird.
> 
> You could add a listing under /etc/paxctld.conf for Thunderbird:
> 
> /usr/lib/thunderbird/thunderbirdm
> 
> and/or manually convert the executable with paxctl if you have it installed:
> 
> sudo paxctl -cm /usr/lib/thunderbird/thunderbird
> 
> 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/716391a8-0379-5671-781f-999395456e19%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Rmove templates complitly

[haaber]

>> Hello, how do i remove templates from the Applicatiosn list?
>> i used sudo dnf remove etc etc, the template is gone, but i can still see 
>> "debain8" etc in the applicationslist.
> did you check the vm-templates folder? Its under dom0 
> /var/lib/qubes/vm-templates/
> 
> Delete and maybee reboot your system.
> 
Hello,

if it is only about the menu item in the application list, search for
corresponding .desktop files using the find command) and delete  them
(or, better, rename them in case you took the wrong ones :)

There is also the   command virsh -c xen:/// undefine[AppVM-Name]
that undefines remainders of a by-hand removal.  Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/4e599262-15ef-bbe7-6adb-3d3bef12e02b%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] qubes 4 partitioning/mount scheme

[haaber]

Hello,

I have one 32G SSD and a large HDD. In my present Q3.2 installation I am
a bit unhappy with the mount scheme of qubes: indeed, /var/lib/qubes
contains all large data. I would prefer such folders at root level, such
as /appvms  and /templatevms  etc. But this is my taste.

In any case things are like they are in Q3.2. What bothers is the
question if the directory structure the same in Q4? It is somehow wicked
that one needs to know how Q4 will install in order to kow how to
partition the drives *before* installing it :))

So: could some Q4 user find this out for me please? Most probably 'ls
/var/lib/qubes' will suffice :)

Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/44d7e12c-6b64-5503-2cd8-67fc3dbe082a%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] qrexec daemon error in sys-usb

[haaber]

Hello, my sys-usb (based on f-24-minimal) on Q3.2 was running perfectly
- until I decided I need rsync. First dnf suggested some updates that I
accepted, the I installed rsync in the template. I got a strange message
"sending to .. dom0" and then "refused". OK, sometimes I get strange
messages, so I shut the template down & want to reboot sys-usb. It
won't. I get the qrexec daemon error, and then it dies.

Is there some hint available how to get this fixed? Need a Coldboot ???

Thanks, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/eb993aad-f59e-947e-3a80-3dcf251d2364%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] /var/log excessive filesystem usage

[haaber]

> On 09/26/2017 09:44 AM, taii...@gmx.com wrote:
> 
> Please check settings in /etc/systemd/journald.conf to make sure
> journald only logs what you need (and, in my case, does not discard what
> it thinks I don't need).
Could you me more specific which entry in the default settings are
responsible for this space-consuming logging ?Thanks, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/10b54fb4-099c-8b20-63ce-5133e639d0ed%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: qubes 4.0rc2 - debian appvm fails with qrexec-daemon message

[haaber]

On 11/23/17 00:14, Yuraeitha wrote:
> On Monday, November 20, 2017 at 12:14:16 PM UTC, Bernhard wrote:
>> Hello,
>> with your nice help I happily installed Q4.0rc2.  Then I created a bunch
>> of debian-8 based appvm's, to copy my data back from the backup. But
>> they don't start, finishing with "Cannot execute qrexec-daemon" error. I
>> hate that error : no clue where it comes from.   Any hints? Thank you!
>> Bernhard
>>
>>
> I did not read through the link due to short of time atm, but here are some 
> suggestions nontheless, as I've encountered similar issues once in Qubes 4.
> 

> - Some AppVM's restored from Qubes 3.2. has in my experience been sluggish, 
> laggy, and slow. I moved my data, bookmarks, thunderbird profile folder, etc. 
> in traditional Linux backup sense, over to a new fresh Qubes 4  AppVM. It 
> solved any lag I had, except, sometimes firefox was a bit laggy with 10 or so 
> tabs, whereas before I could easily have 40 tabs open. The firefox browser 
> update happened around same time, so not sure wihch was the cause. But 
> cleaning old firefox data did not fix it, however a clean AppVM did fix it. 
> The issue also extened outside firefox to other applications. 
Thank you for the detailed answer. This is my way too. I keep the data,
but change all of the software.  I am used to cryptsetup, losetup and
rsyncing data.

> - If you cannot start an AppVM that you restored from the backup, assuming 
> you still have the backup available in case anything goes wrong, then try 
> change the Debian AppVM to a Fedora AppVM. Then see if you can trasfer your 
> files out of the broken AppVM, either via Qubes tools, or passtrough an USB 
> pen/drive and transfer it this way. Just be careful, I've been having issues 
> where I was unable to disconnect my USB drive from within the old Qubes 3.2. 
> AppVM, when I tried to salvage my data from it. Luckily it only caused damage 
> to the last file from multiple of different transactions. In case you want to 
> avoid this issue, it may be possible to do an extra transfer, with something 
> pointless you dont mind loosing, just in case the last transfer made is 
> destroyed when trying to disconnect the USB drive. USB works just fine in 
> Qubes 4 AppVM's though, at least, that's my experience with it for now. 
> 
> Hopefully you don't encounter the worst issues. At least I feel stable on 
> Qubes 4 now, but its been a bit turbulent.
> Hopefully you'll be fine too.

I got through it, essentially via a full current-testing upgrade of
dom0. AppVM's work not both in pv and hvm, and also my mysterious rsync
errors (claiming out of space although there is plenty) disappeared
after the upgrade. Sometimes I don't try to understand the "why" if an
upgrade solves the issue :)

> Also, is it just me, or does Qubes 4 seem bloody fast in some areas after 
> recent updates? Like shutting down VM's for example, it happens almost 
> instantly, and various of other places that it seems much faster than Qubes 
> 3.2. Perhaps its just my mind playing with me. 
Well, boot is slow for me (> 1 min!), shutdown or reboot (of qubes)
finishes by a hang after log minutes (that is an issue! I have to power
off electrically in the moment). On the other side, I admit that AppVM
shutdown inside running qubes is almost immediate, and appvm-starts are
reasonably quick as well.

Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e196f438-83d7-4e68-b48a-cb5c90c44c60%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Failed to load Kernel Modules

[haaber]

This is the first line while booting. So I checked  systemctl status
systemd-modules-load.service that says the below. I see no errors .. all
OK then??

Thank you, Bernhard

[me @dom0 ]

  systemd-modules-load.service - Load Kernel Modules
   Loaded: loaded (/usr/lib/systemd/system/systemd-modules-load.service;
static; vendor preset: disabled)
   Active: active (exited) since Wed 2017-11-22 10:30:29 EST; 2min 35s ago
 Docs: man:systemd-modules-load.service(8)
   man:modules-load.d(5)
  Process: 1299 ExecStart=/usr/lib/systemd/systemd-modules-load
(code=exited, status=0/SUCCESS)
 Main PID: 1299 (code=exited, status=0/SUCCESS)
Tasks: 0 (limit: 4915)
   CGroup: /system.slice/systemd-modules-load.service

Nov 22 10:30:29 dom0 systemd-modules-load[1299]: Inserted module 'uinput'
Nov 22 10:30:29 dom0 systemd-modules-load[1299]: Module 'xen_evtchn' is
builtin
Nov 22 10:30:29 dom0 systemd[1]: Started Load Kernel Modules.


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/780717b0-d11a-7373-b249-9bdda5f12650%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Qubes OS 4.0-rc3 has been released!

[haaber]

> Current users of Qubes 4.0-rc2 can upgrade in-place by downloading the
> latest updates from the testing repositories in both
> [dom0][dom0-testing] and [TemplateVMs][domU-testing].  Further details,
> including full installation instructions, are available in the [Qubes
> 4.0 release notes][release-notes]. The new installation image is
> available on the [Downloads] page.

I read this instructions as
1) sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing
   Here I can confirm the gpg-key errors Chris posted already.
2) sudo qubes-dom0-update --enablerepo=qubes-vm-fc25-current-testing  or
   sudo qubes-dom0-update --enablerepo=qubes-vm-fc26-current-testing

   these commands fail each time, for debian-8 as well. What happens?

Cheers, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/f0b8ea4d-edbb-7bb1-59d5-6ef1e963a713%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: sys-whonix / tor / thunderbird

[haaber]

On 11/24/17 13:47, entr0py wrote:
> Yuraeitha:
>> On Friday, November 24, 2017 at 9:01:24 AM UTC, Bernhard wrote:
>>> Hello,
>>>
>>> one of the most useful features of tor-browser is Ctl-Shift-L to change
>>> the tor-path (and so, with high proba, the exit node IP) : this way,
>>> websites that block a specific exit node for a certain time can be still
>>> loaded (of course some fascist websites block all tor-exits and so that
>>> this measure does not help) .
>>>
>>> I feel that the same feature would be useful in other applications (in
>>> particular in thunderbird). How can this be done? Maybe a "forced
>>> reconnect" of IMAP connections suffices, but apart totally restarting
>>> thunderbird I don't see how this can be done. Any hints? Or is there
>>> good reason not to torify mail-fetching? Or never via IMAP?
>>>
>>> thank you, Bernhard
> 
> Each request to your Tor client (in sys-whonix) via SocksPort is accompanied 
> by a SOCKS username and password. By clicking "New Tor Circuit for this Site" 
> in Tor Browser, you are changing the password component, which causes the Tor 
> client to generate a new circuit for the same first-person domain when a 
> request is received.
> 
> Thunderbird is torrified by an extension called TorBirdy. Your requested 
> feature has been tracked for quite some time (5 years) but appears nearing 
> implementation now that Thunderbird-related roadblocks have been cleared. 
> (https://trac.torproject.org/projects/tor/ticket/6359) Also, the main reason 
> for that ticket is not circuit swapping but stream isolation. At present 
> (Whonix bonus), each different email server you connect to is given a 
> different circuit. With #6359, multiple accounts at the same email provider 
> can also be isolated by circuit.
> 
> Currently, you can generate new circuits for all future Tor requests by using 
> the "New Identity" feature via one of the following equivalent options:
> 1. From anon-whonix, use "New Identity" in Tor Browser. (applies to all Tor 
> connections, not just the browser.)
> 2. From sys-whonix, use arm/nyx (monitoring tool) to send New Identity request
> 3. From sys-whonix, send SIGNAL NEWNYM via telnet to 127.0.0.1:9051

Thank you for this detailed answer. I read over the ticket & it seems
that socks was the problem & should be fine now. I wanted to copy the
"network-connections" config form tor-browser into a thunderbird, but I
do not understand anything there. It uses
 file:///var/run/anon-ws-disable-stacked-tor/127.0.0.1_9150.sock
This folder contains a lot of 0-byte special files that are past my
understanding. Link [4] Did not help me :(

Or should I better run thunderbird inside anon-whonix? Or clone
anon-whonix and run it there?

Thanks, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/89991eca-5825-16d3-5169-94efdc0d299d%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Qubes installation hangs at 717/930

[haaber]

> Same problem here.
> ASUS with I7-7700HQ CPU.
> Qubesos 4.0rc2, now I'm going to try 3.2
Probably you are right. I admit that I have no precise memory about 717
from my install last week (sorry for that :)) However, I remember that
in the 700-750 the template vm-s are copied and appvm's created. They
are several GB each (after decompression) -- according to your usb speed
that can take dozens of minutes for one item ... have you been patient
enough? I guess so, but I still felt to mention this detail to you.
Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c4e0aec1-9d7f-7ce2-fb1d-c6626be8cbc4%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Q4rc3 debian-9 template fails to update.

[haaber]

I freshly installed debian-9 ; when installing packages, apt-get hangs
for days(!) with

81% [waiting for headers] ...
followed by Err:XX Connection failed.

Has someone an idea where to look / how to procede? (there is definitely
no other apt* running ). Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ae8b6bcf-01e7-9cd2-5b7e-c17d08195598%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] qubes won't boot, how to rescue system or save my data?

[haaber]

On 12/14/2017 04:16 PM, jerr...@openmailbox.org wrote:
> i first tried setup for my printer which has USB connected to PC...
> using the guide in Using and Managing USB Devices in qubes-os website in 
> docs..
> enabled sys-sub using the command
> sudo qubesctl top.enable qvm.sys-usb
> 
> then the command
> sudo qubesctl state.highstate
> 
> computer froze, restarted pc, the keyboard didn't work (in passphrase 
> encryption part), but if press a button only num lock color appears for a 
> second, and if i hold a button the num lock button is lighted..
> 
> i then tried installing new qubes, using manual partition configuration (not 
> the automatic), i think i didn't delete the partition with my data.. i tried 
> adding some new partitions..
> 
> now after installing qubes, after encryption password for disk, entering 
> password, it was counting number when clicking alt tab, and says unlimited...
> 
> how can i rescue

I emergency, Iwould rescue data externally: use a luks-enabled linux
(tails for example) on a usb drive, then open the discs
(cryptsetup luksOpen /dev/XXX and mount it). Inside /var/lib/qubes/ you
will find private.img in each appvm. These can be mounted individually &
rsync-ed to a rescue disc (I recommend a loopback device that is
luks-crypted as well). Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/d631a153-c537-6dec-9a12-4392f0466d7f%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Q4rc3 debian-9 template fails to update.

[haaber]

>> I freshly installed debian-9 ; when installing packages, apt-get hangs
>> for days(!) with
>>
>> 81% [waiting for headers] ...
>> followed by Err:XX Connection failed.
>>

> 2) Does restarting all of Qubes, and immediately update debian-9 after full 
> startup, make any difference? I.e. I've experienced issues on longer running 
> Qubes 4 my self, but mostly my issues are triggered by suspend/hibernate or 
> if HDMI plugged TV-screen goes to sleep mode on its own (even if laptop 
> screen is not sleeping). It triggers various of weird system issues, I'm 
> suspecting it's driver-module/kernel related, but I'm not really all that 
> sure. A full system restart however, makes everything work fully again. 
> Perhaps you experience something similar, yet different at the same time. 
> Either way, quick way to find out whether a full restart works or not. 

YES! So I guess things are linked to hilbernation problems when I close
the lid. Is there another cure than full reboot?  Bernhard


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/bd8bef46-2bd0-9448-5876-7351bdb24976%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Q4R3 - debian-stable

[haaber]

Hello,
I cloned the out-of-the-box debian-8 and brought it to debian-9 with
apt-get distupgrade. I halted it. After reboot no way to get a shell, or
anything else (not by qvm-run within dom0 either). Is there a way to get
error messages somewhere?  Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/cfb6b130-d35a-f821-c3fe-b6ce7522fee3%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Q4R3 - debian-stable

[haaber]

Thank you both for comments. That must be a *very* slow boot, it is up
for 12h now, and still no xterm available, neither via qubes-menu, nor
via qvm-run in dom0 :)) Anyhow, it seems better to download the template.

How to you get the template name? I could not find any helpful doc on
it, so  I tried guessing the names by browsing deb.qubes-os.org for the
debian branch or yum.qubes-os.org, but this did not help either.

I ask because I'd like to get a fedora-x-minimal or a debian-9-minimal
as strating point for sys-net or sys-usb with minimized attack surface.
Bernhard



On 12/13/2017 02:00 PM, Chris Laprise wrote:
> On 12/13/2017 11:02 AM, Westley Argentum Hennigh-Palermo wrote:
>> On Tuesday, December 12, 2017 at 3:14:17 PM UTC-5, haaber wrote:
>>> Hello,
>>> I cloned the out-of-the-box debian-8 and brought it to debian-9 with
>>> apt-get distupgrade. I halted it. After reboot no way to get a shell, or
>>> anything else (not by qvm-run within dom0 either). Is there a way to get
>>> error messages somewhere?  Thank you, Bernhard
>> Hey, I'd also be interested to know more about getting detailed
>> debugging info, maybe someone can comment on that... but things I do
>> know that might be helpful:
>>
>> - You can get a debian 9 template by running: `sudo qubes-dom0-update
>> qubes-template-debian-9` (see docs here:
>> https://www.qubes-os.org/doc/templates/debian/)
>>
>> - There are some vm logs available at `/var/log/qubes/`
>>
> 
> There is issue #2913 about very long boot delay for debian-9. This means
> you have to wait about 2min. before starting programs. A fix is in the
> works, and a workaround is deleting an @service link like so:
> 
> sudo rm /etc/systemd/system/multi-user.target.wants/wpa_supplicant@.service
> 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e120dbe9-44f4-13a0-4e78-29ac57f0c13b%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] qubes 4.0rc2 install question

[haaber]

Hello,
I tried toinstall Q4.0-rc2 today. To my surprise the installer warns me
about hardware incompatibilities that should not exist, according to the
HCL : I have a i7-4600U cpu that has VT-x with EPT and VT-d as it should.
So I am confused ... qubes-hcl-report says "HVM not active", same for
"I/O MMU" and further "no HAP". Is this a maybe BIOS setting I have to
change? Or another (non-cpu) hardware incompatibility?  Thank you,
Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/399a05fb-fecb-0864-1046-f3ed338cea9a%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] mount root.img files

[haaber]

> 
> I see you've already managed to fix the issue, but for anyone else: you
> can access root using qvm-run command. For example:
> 
> qvm-run -u root debian-8 xterm
> 
That is pretty cool and quick I admit. Notice however that my solution
works even in a no-longer starting template (if this problem is due to
config files). In more complicated situations one could even install a
clone of a damaged system, chroot from the working one into the damaged
one to run apt-get  ..   best, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/6569d6ed-5ed9-8839-2f96-745c9f174512%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Q4: vm-templates and updates

[haaber]

On 12/11/2017 06:31 AM, Connor Page wrote:
> did you update it in R4 before cloning and upgrading?
> 
> templates establish a connection to a proxy running in some netvm defined in 
> dom0 over a vchan.
> 
yes, I did. I had to run apt-get dist-upgrade -d  a dozen times (and
spread over half a day) to fetch all ~800 packages. Now that they are
there, I can install normally. I got the impression that changing
identify in anon-browser (and hence resetting tor connections) improved
the #{of error messages} per apt-get run.  But this is no science, just
a feeling.  Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1aff806b-66ca-808d-1b9d-b4e00a9d05d1%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Q4: clocks in appvms are random.

[haaber]

I have another question: I recall there was a "clock" setting somewhere
in Q3.2. In the sys-net VM settings, "clock sync" is checked. Do I need
to add this to every appVM ?  Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b1b3436b-1de3-bbb1-bdca-44b001f54ff9%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Q4: vm-templates and updates

[haaber]

Hello,
I try t understand the update process in Q4: according to qvm-ls  the
vm-templates have *no* SYSNET.  How do they update (they do!) ?

I came to this question since a dist-upgrade to stretch in a
debian-8-clone is (a) slow (suggesting sys-whonix as connections) and
(b) looses 1 out of 4 package downloads with " 500 unable to connect" so
that I have to run apt-get over and over to collect all packages.

Some explanation? Best, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/23f116a5-a870-7514-cdc3-5becb67ec60b%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: install fedora 28

[haaber]

> On Thursday, 17 May 2018 13:44:49 UTC-4, john  wrote:
>> On 05/17/18 06:13, Roy Bernat wrote:
>>> I tries to install fedora 28 by upgrade 26 but at the end i am getting lot 
>>> of errors.
>>>
>>> is there any option to download clean fedora-28 / 27 ?
>>>
>>> Thanks
>>> Roy
>>>
>> why not try
>> https://www.qubes-os.org/doc/templates/fedora/
>> $ sudo qubes-dom0-update qubes-template-fedora-28  see if it works
>>
>> if not no harm no foul,  I don't think
> 
> tried and no success . 
> 
> i think the fedora-28 is in the testing branch . 

It does not even work for fedora-27 :( I guess that ths the whole point
in long-going discussions about update problems in this list.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/653ff473-965a-349d-fa03-475334429c3f%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] fedora warning

[haaber]

I just installed f27 in ins full and minimal template on Q4.0 from the 
repos. When installing extra packages (for example sys-net tools) in 
f27-minimal the download works, BUT checksums fails. The point is that 
fucking dnf ignorantly installs the packages anyhow without putting any 
questions. Result: such a tempate is compromised right from the 
beginning, I will have to delete it without ever running it.


The warning to all users is to NEVER run unattended (say, scripted) 
updates on fedora based templates since apparently they give a shit on 
security.


For me this drastically increases the motivation to compile a 
debian-minimal and kick out all fedoras (with the sad exception of dom0).

Bernard

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a9e44f3c-6274-b781-2075-d613238f21a2%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] fedora warning

[haaber]

I just installed f27 in ins full and minimal template on Q4.0 from
the repos. When installing extra packages (for example sys-net
tools) in f27-minimal the download works, BUT checksums fails. The
point is that fucking dnf ignorantly installs the packages anyhow
without putting any questions. Result: such a tempate is
compromised right from the beginning, I will have to delete it
without ever running it.

The warning to all users is to NEVER run unattended (say, scripted)
updates on fedora based templates since apparently they give a shit
on security.


Checksums are only for integrity, not authenticity. For security, PGP
signature checking is what matters.
@andrew: you are right, but if even checksums are ignored, pgp won't be 
considered either ... and that IS an issue.


@ awokd (on your question about re-downloads): I hope I was not 
complaining based on a misread and I would have liked to verify once 
more: too late for this time however, I had deleted the template this 
morning right away. I'll re-do it!


Bernhard

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/4f8a0822-e2ae-43fd-9877-050fd49024f7%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] fedora warning

[haaber]

dnf warns about failed download (for any reason, including unexpected
checksum), but then retry download from another mirror. If all mirrors
fails then package installation will fail. Example message for such
case:
https://github.com/QubesOS/qubes-issues/issues/2945#issuecomment-318877445

This is probably be true, but especially on longer download lists 
impossible to check even for a patient user (and I guess I am not that 
patient :) The point is: re-downloads are not triggered immediately, and 
until the requested package arrived (or dl fails), but appear instead 
"randomly" somewhere later in the output. This happens sometimes several 
screen pages later. Some of these re-downloads re-fail and the procedure 
reiterates (I refrain from joining hundreds of lines of actual output 
here, to deliver proof of that :) My first post was triggered because I 
overlooked in this chaotic output the important successful download 
line. This was, I admit, my fault.  However, I still argue that if there 
is some output, then it should be reasonably verifiable, to my point of 
view : (almost) unverifiable outputs may also be sent to /dev/null 
directly. Don't you agree on that? Bernhard


--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ae2c7e67-1a2a-ddbd-7225-7def92e72217%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] redshift

[haaber]

it would be a nice feature to have a program like redshift
https://doc.ubuntu-fr.org/redshift running in dom0. Did anyone have such
software running in qubes (I am on Q4).  Thank you,

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/55d5c48a-0d08-6c91-ea13-dbef0a7ec015%40web.de.
For more options, visit https://groups.google.com/d/optout.


pEpkey.asc
Description: application/pgp-keys

[qubes-users] Q4.0 rc3 (current testing) - power off/ suspend issues.

[haaber]

Happy new year!  I experience since Q4.rc2 some problems connected to
power-off or suspends. They are of minor annoyance, but maybe they can
be improved ...
1) after 0-10 succesful suspends (on a HP zbook 14 laptop) the hdd will
no longer power off any more at a new lid-down suspend. After lid-reopen
& login, I can no longer start any qubes (neither startmenu nor
qvm-start in dom0) or execute any command in running qubes (neither
start-menu nor using qvm-run in dom0); if I happen to have a terminal
open in a running qube, commands will be executed as expected.
Additonally sys-whonix connection dies.
=> The isuue requires a reboot to solve.
2) Reboots hang systematically at "Reached target shutdown" and has to
be rebooted via a coldboot.

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1e22d5cf-feca-2677-74d3-f6bc131ccfd6%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Intel ME Backdoor, called Odin's Eye

[haaber]

> https://i.redditmedia.com/5mA7LrMiwgmmhrwfYF8Jks0WEng66fxWoCcGw33dhCA.jpg?w=597=339d919645f1de31a42913c748d1d7fb
> 
> 
> Summary:
> 
> Intel Whistleblower leaks details about his role in backdooring all IME chips 
> on behalf of Intelligence Agencies. 
The post is unspecific. Of course ME is a problem: the allegations could
be true or could be disinformation. "I know exactly" is an unplausible
formulation for a backdooring engineer - it is almost surely a wrong ot
statement if it was not himself who spied ...  To conclude: unless some
details are given to enhance trustworthyness (a specific backdoor,
protocol, communication interface, whatsoever), I personally consider
this troll post.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/035a9345-d5a4-89be-b260-14387cd8715d%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Intel ME Backdoor, called Odin's Eye

[haaber]

> воскресенье, 7 января 2018 г., 18:14:26 UTC пользователь haaber написал:
>>> https://i.redditmedia.com/5mA7LrMiwgmmhrwfYF8Jks0WEng66fxWoCcGw33dhCA.jpg?w=597=339d919645f1de31a42913c748d1d7fb
>>>
>>>
>>> Summary:
>>>
>>> Intel Whistleblower leaks details about his role in backdooring all IME 
>>> chips on behalf of Intelligence Agencies. 
>> The post is unspecific. Of course ME is a problem: the allegations could
>> be true or could be disinformation. "I know exactly" is an unplausible
>> formulation for a backdooring engineer - it is almost surely a wrong ot
>> statement if it was not himself who spied ...  To conclude: unless some
>> details are given to enhance trustworthyness (a specific backdoor,
>> protocol, communication interface, whatsoever), I personally consider
>> this troll post.
> 
> Sorry but you haven't seen the full story. This "Intel guy" is legit, he 
> provided proofs like this one:
> 
> https://i.warosu.org/data/g/img/0595/40/1490327898699.png
Maybe, maybe not. Who can verify scanned and blacked papers? I would
appreciate him helping me to remove it from my mainboard though! How to
do THIS is the right discussion to my pov.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/506eac1a-d270-e5aa-ab72-27088ddd7fea%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: AW: Re: [qubes-users] Using fedora-26-minimal sys-vms

[haaber]

On 01/20/2018 07:53 PM, '[799]' via qubes-users wrote:
> Hello,
> 
> --- --- --- 8< --- --- ---
> # Install default minimal template in dom0
> sudo qubes-dom0-update qubes-template-fedora-26-minimal
> 
> # Clone template to keep the original template
> qvm-clone fedora-26-minimal t-sys
> 
> # Launch xterm in the new template as root
> qvm-run -u root t-sys xterm
> 
> # Install basic applications in the template VM
> sudo dnf -y install gnome-terminal terminus-fonts less vim-minimal nano
> dejavu-sans-fonts
> 
> # install basic tools
> dnf -y install sudo pciutils psmisc gnome-keyring
> 
> # Install missing packages für Sys-VMs
> dnf -y install qubes-core-agent-qrexec qubes-core-agent-systemd
> qubes-core-agent-passwordless-root qubes-core-agent-nautilus
> qubes-core-agent-networking qubes-core-agent-network-manager
> qubes-core-agent-dom0-updates pulseaudio-qubes usbutils
> 
> # Install missing drivers (to support the network devices)
> dnf -y install linux-firmware iwl7260-firmware
> 
> # install additional packages to get network manager working
> dnf install -y NetworkManager NetworkManager-wifi network-manager-applet
> wireless-tools
> 
> # shutdown template
> shutdown -h now
> 
> # Change Templates for sys-VMs in dom0
> qvm-prefs --set sys-net template t-sys
> qvm-prefs --set sys-firewall template t-sys
> qvm-prefs --set sys-usb template t-sys
> --- --- --- 8< --- --- ---

Thank you! That is vey helpful. One point is missing to my pov: known
wirelesses in "old sys-net" before moving over. In my Q4rc4 sys-net
/etc/Networkmanager/system-connections is a symbolic link to
/rw/config/NM-system-connections  that contains one file per wireless.

When following your guide until the last dnf command that same dir
1) is not a symlink but a "hard" subdir
2) is (of course) empty


If the structure were the same I'd say a qvm-copy line is missing, but
actually I do not know what this symlink is good for. Can someone
explain this to me, Please?   Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9a543885-55b4-68a2-a4bd-f3baa35d9bdf%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: XFCE Settings menu gone

[haaber]

On 01/21/2018 07:47 AM, 'Tom Zander' via qubes-users wrote:
> On Saturday, 20 January 2018 23:25:55 CET Unman wrote:
>> You are probably missing the desktop files from /usr/share/applications
>> You can copy the files from out of a Fedora based qube if you have one.
> 
> Ohh, smart, I didn't think about that.
> 
> I did this to get the majority of them back;
> ```
> cd
> qvm-run -p sys-net 'tar cf - /usr/share/applications' | tar xvf -
> qvm-run -p sys-net 'tar cf - /usr/share/app-info/icons/fedora/' | tar xvf -
> 
> and then you can copy or move the files from $HOME/usr/share/
> into the system dir.
> I'll add the suggestion to double check they do what they are supposed to be 
> doing (check the Exec line).
Hello,
this arrived to me with Q3.2 and I recall that it was a real pain in the
b***; I start thinking I should backup these under Q4 from time to time
:) Question: Which files / dir's do I need to backup in  dom0?  Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/5cfbf0c0-1e3f-a9da-fad0-79fbd3978ae7%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: QSB #37: Information leaks due to processor speculative execution bugs (XSA-254, Meltdown & Sepctre)

[haaber]

>>
>> so people saying the intel meltdown bios patch slows performance.  I got an 
>> increase in performance lmao.  probably depends on os though.
> 
> but also in my particular case they also addressed other bugs,   but intel 
> pushed the bios patch for meltdown,  so worth a check from your boards 
> manufacturer site.
> 
When I download the (in my case with HP a win exe) BIOS update file, it
contains the "real" bios update (the .BIN file) and some other crap. The
only way to avoid tampered downloads seems to download it several times,
via tor and some other independent sources & to compare them. I guess
you all do that?

HP does not seem to deliver pgp signatures afaik. But they do ship some
signature files. Is someone aware of how checking these manually? Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/6d0c435f-6926-55ae-f5f3-39f5ee38%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Network turns off when I close laptop lid, and I can't restart it

[haaber]

On 01/27/2018 12:26 PM, billol...@gmail.com wrote:
> I recently installed Qubes 4 rc3 on my Dell laptop, and it seems to working 
> well.  However, there's a little bit of a problem with my networking.  It 
> comes up fine when I reboot the machine, and runs like a charm... but when I 
> close the laptop lid, networking turns off, and I can't figure out how to get 
> it restarted without rebooting.
> 
> I'm currently running KDE as my desktop, but it happened in the default as 
> well.
> 
> 
> I have tried the following.  In the KDE systems utilities gui, I went to 
> power management and turned off all the actions on lid closure, power 
> decline, etc. hoping to keep it from turning off at all.  That didn't seem to 
> change anything.
> 
> I wandered over to the sys-net domain and looked around.  When the network is 
> running, ifconfig shows the wireless interface wls5, as well as vif3.0,lo,and 
> ens6.  Once I close the lid, wls5 disappears though the others are unchanged.
> 
> 
> ps -ef | grep Network provides /usr/bin/NetworkManager --nodaemon and 
> sbin/dhclient with a zillion options.
> 
> after I close the lid, only /usr/bin/NetworkManager is running.
> 
> When the network goes off, I have tried 
> 
> service networking restart in sys-net domain, and I get [OK] back, but 
> nothing changes.  I tried "service network-manager restart" and "service 
> NetworkManager restart" but they come up as not existing.
> 
> So... how to I re-initialize networking and NetworkManager when the crump, 
> and how to do stop it from doing that on lid closing?
Did you check out the blacklisting section here ?
https://www.qubes-os.org/doc/wireless-troubleshooting/
Good luck! Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/99ffd58e-c441-fc5f-5e12-ae3aaf30581c%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] clock VM

[haaber]

Hello, all of my appVMs run on random times. I reall having had this
issue on Q3.2 but it comes back on Q4.3 - I forgot the solution in the
meantime. Qumes-Manager indicates sys-net is ClockVM. How do I configure
all AppVM's to fetch time there??  Thank you !! Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/226dbaea-92bc-5229-600b-509e0348f3cd%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] clock VM

[haaber]

> On 01/27/18 22:12, haaber wrote:
>> Hello, all of my appVMs run on random times. I reall having had this
>> issue on Q3.2 but it comes back on Q4.3 - I forgot the solution in the
>> meantime. Qumes-Manager indicates sys-net is ClockVM. How do I configure
>> all AppVM's to fetch time there??  Thank you !! Bernhard
> 
> Do you have a laptop and are you suspending/resuming ? If yes, do you
> have totally random times, or is the clock lagging ? You are right it is a 
> laptop that is sometimes suspended, and yes, all
times are lagging. And they are not lagging randomly, as I first
thought: this mail-VM and dom0 for example are precisely 6h late. My
anon-whonix is exactly 1h late and sys-whonix as well (so the TOR
circuit cannot be set up due to timing errors). qvm-sync-clock (run as
root) does not change anything. This observation, together with the
entire-number of hours delta suggests that I may just need to set
timeszones in each VM correctly! I try that out ... Thank you. Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9c71cfcf-0c50-9152-d517-ae5181f90b55%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] dom0 autocomplete in dom0 terminal

[haaber]

Hi, did someone try to program qubes-* and qvm-* specific
"autocompletes" in the terminal, like

qvm-start w[TAB]  to obtain   qvm-start work
qvm-shutdown v[TAB]  to obatin qvm-shutdown vault

Since Q4 trained me to use a terminal for everything, I think that  an
autocomplete really speeds up daily life... Thank you!

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9ff7858e-2cd4-18f4-10c2-02182f356abe%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] reboot sys-net

[haaber]

> I remember some issues with reattaching in the past, but recently, the 
> qvm-shutdown --wait --force sys-net && qvm-start sys-net seems to be working. 
This sounded even more interesting than the script. But: It does not
work in my Q4rc4 install. last experience of this type was with
sys-whonix and anon-whonix. The latter running, the former did not power
off (even with --force); after some wait I kill it, but it won't reboot:
on boot it spills out "network device with MAC ... already exists"
before dying. I had to power off anon-whonix, then restart sys-whonix.

Same thing happen with the sys-net - sys-firewall - sys-whonix -
anon-whonix chain. I need to power off all of them to get sys-net to
rebbot, which is, frankly, annoying. So finally a script is a good idea,
even if Ilpo's did not work out of the box in my install (may be a Q3.2
- Q4 issue).

Best, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/688e1318-b7e4-f7e0-0b8a-b73b67a5c6b4%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: [qubes-devel] Re: [qubes-announce] QSB #38: Qrexec policy bypass and possible information leak

[haaber]

On 02/21/2018 05:41 PM, qubenix wrote:
>> So let me be blunt as this is likely the last email from me to qubes
> anyway;
> 
> Bye, I'm happy to see you go away finally. It was killing me inside that
> you were working on the new gui controller. Fuck off back to bcash.
> 
I really hope that you will understand one day that the first victim of
your hate is yourself. Until this day I prefer that you keep such kind
of language out of this mailing list ... Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8bef9fe3-5fbe-8025-8885-e60bb9fe5a85%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] How to play videos in qubes? says needs codec H.264, Mpeg-4 something

[haaber]

On 01/16/2018 11:50 AM, jerr...@disroot.org wrote:
> i can't install this codec from fedora 26 from software add ons.. also
> i've tried doing yum search h.264, there's nothing that seems like this
> codec..
> 
I think, most easy is to use a debian instead of a fedora template and
to install vlc or mplayer that ships with its codecs.   Best, Bernhard


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/5d811004-3cb7-ecd4-aced-c2f270b64291%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] whonix-?? update

[haaber]

> On 01/24/2018 08:47 AM, haaber wrote:
>> I was used to start templates from time to time & update them with
>> apt-get. However my out-of-the-box Q4rc3 wnonix-xx systems complain
>>
>> Cannot initiate connection to 127.0.0.1:8082
>>
>> although I can update other appvm templates (debian, fedora) and dom0
>> via sys-whonix. Do I miss something on how to update whonix-templates?
>>  Cheers, Bernhard
>>
> 
> Are you using tor? Try to run whonixcheck on sys-whonix.
> 
I have the impression that template updates run by default over tor
(sys-whonix) .. otherwise the slowness could not be explained :)) My
problem disappeared either by "time has passed" and a better tor-access
or, maybe,  because I tried apt-get instead of aptitude (?). I fear I
will never know. Thank you anyhow.  Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c83b8d79-b1ea-0055-8c6f-a39c30b769a4%40web.de.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] funny "bug"

[haaber]

on my Q4rc5 install I get the little black notification "Domain .. is
halting" when I actually start it. I guess this is just a copy-paste
thing inside a script ...  cheees, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/5962d20b-5ed4-9b8c-2a2c-2751bb595c23%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Re: Qubes OS 4.0-rc5 has been released!

[haaber]

> Le mercredi 7 mars 2018 22:21:58 UTC+2, sevas a écrit :
>> Whoo hoo! 
>>
>> I went to download qvm-dom0-update and it says no new updates available
> 
> Same thing for me ...
> 
and   sudo qubes-dom0-update --enablerepo=qubes*testing ?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1961d5fc-5bf2-6b96-7718-b3c82f96bf13%40web.de.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] bash autocomplete

[haaber]

Thank you Holger,
I don't know what this 3D-thing, is I'll learn it. I have, in the
meanwhile, tested the attached file, that distinguishes also running,
paused and halted VM's. For the moment this is completely sufficient for
me. Maybe I'll add the completion "root" when I complete "qvm-run -u",
since this is what I need for updating sudo-less minimal templates :)

I put the file it in /etc/bash_completion.d/ within dom0, and source it
in .bashrc.   Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b99595c0-2cda-a92e-b0b1-e36bd827c33e%40web.de.
For more options, visit https://groups.google.com/d/optout.
#!/bin/bash
_qvmall()
{   local cur VMS
COMPREPLY=()
cur="${COMP_WORDS[COMP_CWORD]}"
VMS=$(qvm-ls --raw-list)
COMPREPLY=( $(compgen -W "${VMS}"  ${cur}) )
return 0
}
_qvmrunning()
{   local cur VMS
COMPREPLY=()
cur="${COMP_WORDS[COMP_CWORD]}"
VMS=$(qvm-ls --raw-data|grep -i running|cut -f1 -d"|")
COMPREPLY=( $(compgen -W "${VMS}"  ${cur}) )
return 0
}
_qvmhalted()
{   local cur VMS
COMPREPLY=()
cur="${COMP_WORDS[COMP_CWORD]}"
VMS=$(qvm-ls --raw-data|grep -i halted|cut -f1 -d"|")
COMPREPLY=( $(compgen -W "${VMS}"  ${cur}) )
return 0
}
_qvmpaused()
{   local cur VMS
COMPREPLY=()
cur="${COMP_WORDS[COMP_CWORD]}"
VMS=$(qvm-ls --raw-data|grep -i paused|cut -f1 -d"|")
COMPREPLY=( $(compgen -W "${VMS}"  ${cur}) )
return 0
}



complete -F _qvmall qvm-appmenus  
complete -F _qvmall qvm-clone 
complete -F _qvmall qvm-firewall  
complete -F _qvmall qvm-move-to-vm
complete -F _qvmall qvm-remove
complete -F _qvmall qvm-start-gui 
complete -F _qvmpaused qvm-unpause
complete -F _qvmall qvm-backup
complete -F _qvmall qvm-copy-to-vm
complete -F _qvmrunning qvm-pause 
complete -F _qvmall qvm-run   
complete -F _qvmall qvm-usb
complete -F _qvmhall qvm-backup-restore
complete -F _qvmall qvm-service   
complete -F _qvmrunning qvm-kill  
complete -F _qvmrunning qvm-shutdown  
complete -F _qvmall qvm-tags  
complete -F _qvmall qvm-check 
complete -F _qvmall qvm-features  
complete -F _qvmall qvm-prefs 
complete -F _qvmhalted qvm-start 

Re: [qubes-users] Re: funny "bug"

[haaber]

> @Bernhard
> On Wednesday, March 7, 2018 at 9:25:45 PM UTC+1, haaber wrote:
>> on my Q4rc5 install I get the little black notification "Domain .. is
>> halting" when I actually start it. I guess this is just a copy-paste
>> thing inside a script ...  cheees, Bernhard
> 
> Did you make a fresh install or was it an upgrade from a previous RC-x 
> version? This might help solve the issue, or quicker narrow it down.
> 
I upgraded form Q4.rc2 on to rc3, rc4, rc5.  If Unman sees it on clean
rc5, it is not an artefact of old installs.  In any case it is more or
less just funny, since I am not aware of any negative effect. Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/587b6305-91a3-a208-1202-505540942ee6%40web.de.
For more options, visit https://groups.google.com/d/optout.