Re: [qubes-users] Re: Q: Upgrading whonix-ws, auto-remove packages?

2021-10-06 Thread Bernhard

always use 'sudo apt autoremove' afterwards and never run into problems.
So you probably can follow, what the upgrade function told you.


Cheers :)

Ulrich Windl schrieb am Dienstag, 5. Oktober 2021 um 23:53:02 UTC+2:



Following the instructions, my upgrade ended with this message:
The following packages were automatically installed and are no longer
required:


  [50 lines removed]


acl anon-iceweasel-warning apt-file binaries-freedom bsdmainutils
bsdtar
I'm wondering whether those qubes packages may actually be removed.
I'm afraid to break my system when doing so.


I do not share TheGardner's opinion. removing libraries like libcrypto
or removing python or qubes-core-agent looks *very* suspicious to me.
I'd think apt got lost. Was there some version change in the repos ??
(like underlying debian-10 to 11 that was messed up?)

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b2b0756c-9fb9-0bd2-f159-d49f9ab55af2%40web.de.


[qubes-users] how to modify qubes-installer-ISO

2021-09-16 Thread Bernhard

Dear qubes-community,

I would like to modify the qubes-iso (add a different kernel, maybe add
a wireless driver). Did someone here solve that already? A brief google
on the subject reveals that modifying ISO's is not straightforward ...
and touching the kernel may add extra difficulties.
Thank you for your help,

Bernhard

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e9687038-0a99-59a8-cac6-16cd7421e577%40web.de.


Re: [qubes-users] i915 driver problems

2021-09-01 Thread Bernhard

On 9/1/21 3:11 PM, Sven Semmler wrote:

I do have freezes and crashes with the 5.4 kernel and have to use 4.19
consequently. But I don't know what causes it. How did you determine
that it's the i915 driver in your case?



Sad for you, but I am kind of happy that I am not alone :) Maybe you add
your experience to my bug report

 https://github.com/QubesOS/qubes-issues/issues/6397

as well?  Sometimes I need a vanilla debian (life system on usb) to
uefi-debug / emergencybackup. And even that one hangs from time to time,
by spitting out a last word

 [drm:intel_cpu_fifo_underrun_irq_handler [i915]] ERROR CPU pipe A FIFO
underrun

Since the std debian is very stable and much less complex than xen +
qubes, I take that as a hint (badly enough, when qubes freezes happen,
qubes dies faster than kernel logs are written, so I have no other
starting point anyways).

For these reasons, my suspicion was early on the i915 driver. Also, i915
seems known problematic from 5.x kernels onwards any kind of other
linuxes (google it).

 cheers, Bernhard


P.S: my chipset is an intel 620  [8086:5917] rev 07.

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ec3db828-fe92-b0b1-b7ae-5fcdafb1e718%40web.de.


[qubes-users] i915 driver problems

2021-09-01 Thread Bernhard

Hello, I wonder if some of you guys have the bad luck of an i915
graphics card and found some solutions.  For me, no >= 5.4 xen kernel
works (freezes). So I still run it on 4.19 :)

I first thought this to be an "evolution problem" since I use and update
Q4 since its beta state. So I tried a new install on a new disc, but
that fails even before finishing install, freezing as well :-(

Even a plain "live debian" freezes from time to time with i915 errors,
which gives a clue where the problem comes from.

Is there maybe a way to tweak the installer? Thanks,

best, Bernhard

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c02775dd-5079-5532-6d54-35ca012e6201%40web.de.


Re: [qubes-users] Dom0 kernel panic

2021-03-04 Thread Bernhard

On 3/3/21 3:29 PM, frag face wrote:

Hi all,

I'm running Qubes 4.0
My dom0 doesn't boot anymore (following an aborted Fedora update it
seems...).
Boot runs to kernel panic, see attached image.

 From a newly installed Qubes on a different disk, I can mount my
crashed disk, decrypt it and access all my Qubes, DOM0...

I see two options to recover my environment (and would prefer the first):
1- Fix my Dom0 environment on my crashed hard drive (I have another
drive with a newly installed Qubes 4.0-rc3)
2- Save my qubes from my crashed disk, and restore them on my new
4.0-rc3 install.

Any advise to perform a rescue for option 1 or 2 is welcomed !


1) try to boot from a life system. Mount /boot and, in case of UEFI,
have a look in efi/qubes/xen.cfg  or efi/BOOT/xen.cfg   you should be
able to select a older kernel. Maybe that allows to reboot.

2) emergency backup is a good idea in any case. Open the encrypted
   volume (using luks)then runvgchange -ayto activate all
   logical volumes. With lvscan you should be able to see the names
   (something like  qubes-...-work-private
qubes-...-work-root
etc
   It is the "private" one that you want. Mount them (they are all in
   /dev/mapper/ ) and "rsync -auv"  your data to a harddrive in
   respective subdirs. That is less safe than the paranoid version
   of qubes-backup since its grasps all  ".config" files, but at least
   you have a full take.

Good luck!

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/6ac3a6b2-9d0f-cb77-0ae0-a62e2f740d7c%40web.de.


Re: [qubes-users] Memory balancing very inefficient

2021-02-23 Thread Bernhard

This behaviour might be linked to errors (e.g. my qubes install does not
support 5.x xen kernels: crashes can be caused by "memory stress" and
even if not, they always finish by loads of qmemman log entries, before
deep freeze (not even a kernel panic, just sudden death)

What does "your qubes install" mean? Mine has been auto-updated to
kernel 5.4.88-1


mine too. But since this kernel crashes after 2-30 minutes I downgraded
(xen!) kernel back to 4.19.163. That works, at least. My App-VM's run
smoothly on 5.x kernels, even kernel-latest does fine.


I current think about limiting all small VMs to 256MB and dom0 to 2 GB
of RAM (by GRUB parameter) lacking any idea for a better approch.


Tell us if that works! My qubes has no grub. But you can set kernel
params in /boot/efi/EFI/qubes/xen.cfg


Again: What is special about "my qubes" ?

that is a poor try on non-violent communication. I have no grub
installed: qubes (4.0) came out of the box like that (using UEFI, as did
qubes 3.x before). I am surprised that qubes uses grub in other settings
:))


I modified /boot/grub2/grub.cfg (changing all dom0_mem=max:4096M values)
and this works as expected. After a few hours I could not figure out
limitations having the limits in place.

 very good news, thank you. Bernhard

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/5d525b4f-3906-4dde-1279-3b9c85dd5efc%40web.de.


Re: [qubes-users] Need to fix boot process broken by kernel update. Data is safe.

2021-02-10 Thread Bernhard




Is there a standard HOWTO I can follow to fix the boot process (to go
from a grub / xen.cfg that fails to LUKS decrypt and load unencrypted
rootfs)


Not that I know. Would be helpful, indeed.


Unfortunately the grub update for the kernel upgrade seems to have
messed up the boot process. How do I figure out if it's installed for
BIOS or UEFI mode ?


That is in your BIOS. If it is "legacy" it means old-school MBR, if not
it should be written UEFI somewhere.

My data is safe and LUKS encrypted . I can use a live USB to decrypt it,
access it and I also have made 2 backup copies.

good.


So with nothing to lose I tried to fix the boot manually from a live USB
including creating /etc/default/grub but situation is no better.


I had similar problems recently. If it is UEFI (and I guess so),
efibootmgr is your friend (not preinstalled on debian-live, but you grab
it easily via apt-get). Also look the "UEFI troubleshooting" qubes
webpage! You can re-do the qubes boot entry with efibootmgr (please read
the man  page, syntax is not memorisable for me).   Good luck, Bernhard



--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/9296d3c7-7ea1-b9f0-23ac-2153920095f9%40web.de.


Re: [qubes-users] qubes-mirage-firewall 0.7

2020-05-25 Thread bernhard haak

On 5/19/20 3:11 PM, sschi...@gmail.com wrote:

I'm pleased to announce the release of qubes-mirage-firewall 0.7:

  https://github.com/mirage/qubes-mirage-firewall/releases/tag/v0.7 
<https://github.com/mirage/qubes-mirage-firewall/releases/tag/v0.7>


I try to build on buster, but already new-docker fails.

DKMS: install completed.
Building initial module for 4.19.120-1.pvops.qubes.x86_64
Error! Bad return status for module build on kernel: 
4.19.120-1.pvops.qubes.x86_64 (x86_64)
Consult /var/lib/dkms/aufs/4.19+20190211/build/make.log for more 
information.

dpkg: error processing package aufs-dkms (--configure):
 installed aufs-dkms package post-installation script subprocess 
returned error exit status 10

Errors were encountered while processing:
 aufs-dkms


If I ignore it, (docker is installed, but incomplete), the build fails, 
without surprise. Someone has a hint on that?  Cheers, Bernhard


--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b8f1d893-192b-7722-4962-18bb14cfce33%40free.fr.


Re: [qubes-users] ANN: Wyng beta, a fast incremental backup tool

2020-02-26 Thread Bernhard

'Wyng' is a backup program I've been working on for a while that can
quickly backup "thin LVM" storage, the kind Qubes uses by default:

Link  https://github.com/tasket/wyng-backup  


I like your other scripts, so I had a look. That seems so damn complex
at first glance! Maybe you want to improve your "readme" by some simple
examples of "mise en oeuvre": assume I have a qubes machine and a
backup-harddrive in my hand. What would be the steps to do?  Can you
stock your backup in a luks-container?  Since you use "streams" can
(can't?) there be a -whatever cipher- in the middle of your stream
treatment?
I did not get these informations from your text within reasonable time.
Maybe I am stupid, but maybe I am not alone with that :)

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/6cca1a41-186a-ad5c-e420-520ad85b2cc5%40web.de.


Re: [qubes-users] Scary Systemd Security Report

2020-02-13 Thread Bernhard




Also, I see that you have many services that need not be there - some
of these will be disabled by Qubes- some you do not need in every qube
(cups-browsed, exim4, tinyproxy etc).

how do get rid of them? exim for example looks to me like a virus. I
found no way to uninstall it without destroying debian ... the trick is
maybe to keep them, but disabled? Cheers, Bernhard





--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/ffa60bad-0bd8-156e-597a-1cc90b056a41%40web.de.


Re: [qubes-users] How do I get Started?

2019-12-04 Thread Bernhard




By default network cards are assigned to sys-net and are not visible
in dom0 (as far as I know). Open the Qubes Manager -> sys-net -> VM
settings -> Devices tab, and make sure your network card is assigned
to it. So you need to run lsusb or lspci from within sys-net, not
dom0. You should also run `iw list`, `iwconfig`, and/or `ifconfig` in
sys-net.

Let me clarify: PCI network cards are assigned to sys-net and not
visible in dom0 by default, regardless of USB Qube. Other PCI devices
remain in dom0.

I can "see" they exist by typing lspci in dom0 (including network cards,
and the usb controller).  My understanding is that while dom0 can see
them, they cannot see dom0 nor other qubes than the one they are
attached to (and dom0 will not talk to them unless a game-over event
occurred).


If using a USB Qube: all USB devices are assigned to sys-usb and not
visible in dom0. I assume USB network cards are automatically passed
thru to sys-net from sys-usb.

I never checked that. Maybe you need to pass them over by hand. That is
what I would expect at least.

You also have the option of combining
sys-net and sys-usb into the same Qube so no passthru is necessary. (Or
is that mandatory when using USB network cards and a USB Qube?)

USB is one attack surface, network another. I would suggest to keep them
apart. In fact, a USB qube does not need any networking at all (not even
internet access). Imagine its becomes victim of a "bad-usb"  then it
still cannot 'break out' and phone home, for example. Actually my
sys-usb is halted by default unless I really need it (consequence: if
you plug any usb device, nothing happens. just nothing.).

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0bc7459b-6110-4b93-b3d7-a8cd9ed16cf9%40web.de.


Re: [qubes-users] Days since last backup

2019-11-22 Thread Bernhard

However, I am stuck on how to determine how many days it has actually

been since the last backup.


What you are looking for is this command:

qvm-prefs --get $vm backup_timestamp


Nice. In case of a "manual backup", can you also set the variable that
way? Like

qvm-prefs --set $vm backup_timestamp  2019.11.22-00:00:00

(or some other time format) ?

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/7939b014-2605-dd43-2f14-1a33a29e0b82%40web.de.


Re: [qubes-users] Re: Copying text to/from Dom0

2019-09-23 Thread Bernhard




That's the document I was referencing, but it doesn't mention using the
clipboard, only files. It seemed to me that passing plain text by the
clipboard to dom0 was going to be more secure than passing a complete
file, so assumed that would be the preferred method. Does such a
mechanism not exist then?

There is a reason. Look for example here:

https://security.stackexchange.com/questions/113627/what-is-the-risk-of-copy-and-pasting-linux-commands-from-a-website-how-can-some
https://unix.stackexchange.com/questions/15101/how-to-avoid-escape-sequence-attacks-in-terminals

better write/copy in a file, check it carefully and transfer then. And check 
again. Many other attacks are possible..

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c3fbe112-3fb8-d9db-3611-a2c4d09034c1%40web.de.


[qubes-users] boot qubes with detached luks header on sdcard ?

2018-10-02 Thread Bernhard
I wonder if I could encrypt my (only) disc is a "headerless" more and 
store the header on a separate sdcard. Once any linux-type system is 
completely is booted this is easy. But can the qubes bootloader do that? 
(this needs to find and mount the sdcard first, then fetch the header 
there ). Some experience with that? Cheers, Bernhard


--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/770005ca-4733-d831-136e-6ee5dcc5fedd%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] sys-usb needs more than default RAM to mount LUKS encrypted backup volume

2018-05-17 Thread Bernhard



You shouldn't mount encrypted drives on sys-usb. Use qvm-block to attach
the partition to a different VM, then mount it there.

This is a good question, I think. Since we distrust sys-usb I agree that 
we should not do the cryptsetup operations in sys-usb. But if you 
distrust the attached device as well (might be safer, right?), one might 
attach the luks-partition (resp. file) first to an intermediate (even 
temp !) VM, luksOpen it in there and re-attach the generated /dev/mapper 
volumes to the destination VM. That way sys-usb is blind to cryptsetup 
and the destination-vm is maximally protected from usb-based attacks. 
Overkill?


Bernhard


--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/205543a3-89e6-5a55-f607-f48a6dd73d35%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: 4.0 not updating dom0 nor fedora?

2018-04-19 Thread Bernhard

On 04/18/2018 03:58 PM, anon432 wrote:

I am getting the same error in dom0 and also getting "No New Updates" - which I 
know is not true.

Does anyone have a link to a github issue where this has been filed?


https://github.com/QubesOS/qubes-issues/issues/3737


--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/435b6012-3acc-192f-9669-45b301525757%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] extract file from image backup

2018-02-20 Thread Bernhard

> > Apologies, missed your post donoban. But looping the backup seems
interesting, I suppose it must be possible with the decryption too. >
Yes, it is. I backup by data that way since Q4  - the qubes-backup may
be more "handy", but I prefer knowing every single detail on encryption,
etc myself. You may mount a luks-container in sys-usb (for example), and
then attach one-by-one your app-vm private.img  to sys-usb using the
qubes widget; after mounting them (ro of course) you can simply rsync
your data, most conveniently to the backup volume. Your app-vm will not
be exposed to usb that way.

If you have a full dd take of your qubes system (I understood you inital
mail like that), be aware that the some image files are rather like "dd
disk images" rather than "dd partition images", which means you cannot
use the most straightforward mount on the loop device (you never mount a
disc, but a partition!). Instead, have to read the offset of the
partition start using fdisk or similar, and provide this offset to the
mount command. A quick google reveals the details on this procedure :)

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/439262ae-b08c-fb00-d7b6-06a3c4b8d871%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] reboot sys-net

2018-02-02 Thread Bernhard
On 02/02/2018 11:58 AM, Ilpo Järvinen wrote:
> On Fri, 2 Feb 2018, Bernhard wrote:
>
>> Did by chance someone write a dom0-script that
>>
>> a) fetches a list of all (running) appvm's that use sys-net.
>>
>> b) setting their net-vm to "none"
>>
>> c) reboot sys-net
>>
>> d) undoes step (b)
>>
>> That would allow to confortably reboot sys-net (same ideas apply to
>> sys-firewall & sys-whonix) and could help many people in many
>> situations. I am not a bash hero, and before losing half a day on this
>> useful script, I prefer asking if someone did it already :)
> I didn't have it already but it wasn't too difficult to do so I wrote one 
> as it seems somewhat useful.

Awesome! Thank you very much. Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/36c7f28f-90a7-f322-d5fc-3ff3a90af580%40web.de.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] reboot sys-net

2018-02-02 Thread Bernhard
Did by chance someone write a dom0-script that

a) fetches a list of all (running) appvm's that use sys-net.

b) setting their net-vm to "none"

c) reboot sys-net

d) undoes step (b)

That would allow to confortably reboot sys-net (same ideas apply to
sys-firewall & sys-whonix) and could help many people in many
situations. I am not a bash hero, and before losing half a day on this
useful script, I prefer asking if someone did it already :)  Thank you,
Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/dc35b472-0c8c-df87-a0d7-3705f9a2d1ce%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Q4rc3 debian-9 template fails to update.

2017-12-19 Thread Bernhard
On 12/18/2017 07:34 PM, David Hobach wrote:
>
>
> On 12/18/2017 03:58 PM, Chris Laprise wrote:
>> On 12/16/2017 07:49 AM, Yuraeitha wrote:
>>> On Saturday, December 16, 2017 at 10:51:30 AM UTC, Chris Laprise wrote:
>>>> On 12/16/2017 04:21 AM, haaber wrote:
>>>>> I freshly installed debian-9 ; when installing packages, apt-get
>>>>> hangs
>>>>> for days(!) with
>>>>>
>>>>> 81% [waiting for headers] ...
>>>>> followed by Err:XX Connection failed.
>>>>>
>>>>> Has someone an idea where to look / how to procede? (there is
>>>>> definitely
>>>>> no other apt* running ). Thank you, Bernhard
>>>>
>>>> I just updated a freshly-installed debian-9 on 4.0rc3 two days ago
>>>> without connection errors.
>>>>
>>>> The difference may be that I have been updating my dom0 with
>>>> --enablerepo=qubes*testing, and a template having connection errors
>>>> suggests a problem with dom0/xen or with whatever is running sys-net.
>>>>
>>
>> Now I'm experiencing this with fedora-26 updates.
>
> Yes, I know that issue for quite some time as well on debian-8 (I had
> done a testing upgrade there some time ago as well). Disabling the
> Qubes proxy & allowing a direct connection fixes it for me, but of
> course that shouldn't become a permanent solution.
>
I don't like direct connection. I am more and more convinced that
hilbernate/suspend is the origin of these problems. I tried out a full
reboot of all net-related qubes (sys-net, sys-firewall, sys-whonix) ,
and that indeed solves the pb.  I now look, as a better workaround, for
a dom0-script that: on running qubes saves the NetVM setting, then sets
NetVM to none, then reboots these 3 bad guys, and finally restores old
NetVM's. How could this be done?  Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b21b25a3-4188-be6d-aad1-325360ba8d78%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Re: Q4rc3 debian-9 template fails to update.

2017-12-18 Thread Bernhard

2) Does restarting all of Qubes, and immediately update debian-9 after full 
startup, make any difference? I.e. I've experienced issues on longer running 
Qubes 4 my self, but mostly my issues are triggered by suspend/hibernate or if 
HDMI plugged TV-screen goes to sleep mode on its own (even if laptop screen is 
not sleeping). It triggers various of weird system issues, I'm suspecting it's 
driver-module/kernel related, but I'm not really all that sure. A full system 
restart however, makes everything work fully again. Perhaps you experience 
something similar, yet different at the same time. Either way, quick way to 
find out whether a full restart works or not. 

>> YES! So I guess things are linked to hilbernation problems when I close
>> the lid. Is there another cure than full reboot?  Bernhard
> aha, this should narrow it down to possible suspects indeed. 
>
> Just to be sure, there might still be a possibility that the restart fixed 
> another issue, of an origin we didn't speculate about. Was it a single case 
> issue the restart fixed? Or do you encounter repeatedly issues after 
> hibernation which are fixed with restarts? Just to verify, so we don't jump 
> to conclusions too fast.
>
> I'm guessing your issue is pretty much similar to my own, except we 
> experience somewhat different symptoms, originating from the same cause - 
> hibernate/suspend. You can see my github issue rapport here from a few weeks 
> back (I haven't had the time to keep the rapport updated due to emerging 
> deadlines hunting me down, but I plan to return to it eventually. Also it was 
> different back then, the issue I rapported back then has changed somewhat 
> (slightly) between that date and today. I plan to update there soon as well); 
> https://github.com/QubesOS/qubes-issues/issues/3359
> Feel free to add your own experiences of the issue if you think it has 
> similar root causes. The symptoms might be different, but the cause/trigger 
> appears to the similar.
>
> Possibly it's the admin mechanism that breaks down? I experience issues in 
> the domU windows, like the Qubes coloured panels, or Qubes widgets, general 
> graphical freezes, or entire forced restarts during suspend because it 
> doesn't suspend while in my bag but stays awake when it's supposed to be 
> suspending, etc. Perhaps, your issue is similar, but you get networking 
> issues instead, i.e. when updating. 
>
> So all this might be somehow related to the admin mechanism, I'm speculating 
> now though, but it seems like a good place to start given the clues so far 
> seems indirectly to point towards it.
>
> You can throw a link there back to this thread on github, if you find it 
> useful to do so, if you decide to make a post on the github thread. If you 
> don't plan to post on github, do you mind if I link to this thread instead 
> for extra references? Once I get around to it of course. I think it's a good 
> idea to show more people have this issue (assuming it indeed has a shared 
> trigger/cause), perhaps it can provide extra clues of the overall bug.
>
> The problem right now though, is to narrow it down more precisely, so the 
> exact issue can be found. 
>
> Also, something that changed in recent updates (I'm sitting on 
> current-testing updates), is that it now appears to be enough to only restart 
> all network based VM's (non network based VM's are fine and don't need 
> restart). Basically, sys-net and sys-firewall are messed up. This makes it 
> easier, as it no longer requires a full system restart. Is this the same for 
> you too?
>
I am not on github, but feel free to link our discussion there.

I confirm that strange things happen after (too many?) hilbernations.
One amazing behaviour is that I cannot start new applications neither
from qubes menu nor the dom0 terminal. A command like "qvm-run work
xterm" will just come back to command line without anything happening.
This is non-working behaviour persists when AppVMs (but not the
qubes-system) are rebooted. On the other hand side, running apps inside
an AppVM work normally, and if I happen to hold a terminal open in each
appvm I can launch new processes easily. This suggests that the problem
sits really in the "qubes part".     Bernhard

PS: For those that might want to join our discussion: Q4rc3, updated
with --enablerepo=qubes*testing.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b36103bc-c1b7-742f-9056-d2d17355a2df%40web.de.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] sys-whonix / tor / thunderbird

2017-11-24 Thread Bernhard
Hello,

one of the most useful features of tor-browser is Ctl-Shift-L to change
the tor-path (and so, with high proba, the exit node IP) : this way,
websites that block a specific exit node for a certain time can be still
loaded (of course some fascist websites block all tor-exits and so that
this measure does not help) .

I feel that the same feature would be useful in other applications (in
particular in thunderbird). How can this be done? Maybe a "forced
reconnect" of IMAP connections suffices, but apart totally restarting
thunderbird I don't see how this can be done. Any hints? Or is there
good reason not to torify mail-fetching? Or never via IMAP?

thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/e980fe7b-398f-bfe7-a13b-6b169ce06562%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] mount root.img files [solved]

2017-11-22 Thread Bernhard

>  So I would like to "break in" the vm-template as dom0, and change
> that one line in /etc/pam.d/common-auth back. But how to mount the
> root.img file?
I answer my own question, since this is more easy & efficient than I
thought, and should help others in many cases!

(0) make sure template-vm is halted.
(1) as dom0 root:
  (a)   fdisk -l path-to-root.img
 Then read off the start sector of ...root.img3,  (say,
1000). Multiply that value with 512 (512000 in my example).
  (b) mount -o loop,offset=512000 path-to-root.img /mnt  
(change 512000 by your value)
  (c) modify bad config files
  (d) umount /mnt
(2) restart  template-vm

and we're back!  Bernhard


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/bb6ea5f3-73aa-b6e0-4d32-e3f2a11d8d4c%40web.de.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] mount root.img files

2017-11-22 Thread Bernhard
Hello,

I brought myself in trouble, when I (badly) followed the vm-sudo
instructions : as non-root, I modified (using each time sudo) the file
/etc/pam.d/common-auth in debian-8.
Now, at the follwoing steps I would need to sudo again - but the process
is blocked (saying 3 times bad password), since the new VMAuth is (only)
partially set up.

- Of course, qubes-revert command for template vm does not exist in Q4,
that would be too easy.
- Actually, reinstalling debian-8-template fails as well, since there
seems no package named qubes-template-debian-8 in contrast with the
qubes documentation
-  So I would like to "break in" the vm-template as dom0, and change
that one line in /etc/pam.d/common-auth back. But how to mount the
root.img file? I tried a losetup & mount approach, but the file is
non-mountable. I have not found any documentation either.

So I ask in despair for some help. Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c601bc55-8bfa-39eb-f396-a20b08bff24a%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] A lot of trouble with qubes 4.0 rc2

2017-11-21 Thread Bernhard
On 11/20/2017 09:34 PM, Chris Laprise wrote:
>
> If possible, you should try doing a full update with testing release:
>
> qubes-dom0-update --enablerepo=qubes*testing
Thank you for helping me. I'll try this out quickly & tell (all of) you
on this list.
>> 2) I created a large (150G) personal appvm. The "max system storage" is
>> still 10G and I don't see how/where this could be changed.   When
>> playing back backups, the fs is de facto limited to these 10G - so rsync
>> fails at some stage;  from this moment on reboots fail as well (with
>> qrexec-error). journalctl gives no help (the journal keeps silent while
>> launching "qvm-start personal" in the neighbour terminal).
>
> System storage (the template) is different than private storage, and I
> believe its the latter you should be concerned about. Not sure just
> how you are using rsync... a lot depends on what your source and
> target are.
>
Here is my procedure: I have a usb disc. I attach it to the appvm, loop
the luks container to /dev/loopX, cryptsetup luksOpen it, and mount then
the /dev/mapper/backup . Then I use (as root)   rsync -auv
/backup/appvm-name  /home/user/. The data is 140G so I gave 150G to
the appvm as private storage. The rsync fails after ~6GB of data
transferred. Is this possble since the (standard install) LVM-thin
cannot provide  quickly enough disc space??

Alternatively I can start the appvm,  pause it, attach its private.img
to sys-usb and follow then the above procedure as root in sys-usb (this
is how I made the backups, since I prefer doing them by hand).

Is there some flaw in my procedure? Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/755eb516-14e5-8d93-e456-8bd8e0e73682%40web.de.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] A lot of trouble with qubes 4.0 rc2

2017-11-20 Thread Bernhard
Hello,

I jumped into cold water and have a fresh install of 4.0rc2. It seems
almost completely disfunctional at this stage. Problems are:

1) starting (larger) appvms result in a systematic qrexec-daemon error.
First I thought this would be debian specific, but it is not. I have 16G
ram, and try to start a single f25 based appvm ...I read some people
suggesting to install  xen-hvm-stubdom-linux 2001:4.8.2-10.fc25  -- I
tried this, but no notable change (after coldboot). I tested if HVM / PV
could help. Quick answer: No.

2) I created a large (150G) personal appvm. The "max system storage" is
still 10G and I don't see how/where this could be changed.   When
playing back backups, the fs is de facto limited to these 10G - so rsync
fails at some stage;  from this moment on reboots fail as well (with
qrexec-error). journalctl gives no help (the journal keeps silent while
launching "qvm-start personal" in the neighbour terminal).

I hope I can get some help here, since I will have to reinstall 3.2
otherwise :(

Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b92699b1-688b-3384-c063-babe6eb41bc2%40web.de.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] qubes 4.0rc2 - debian appvm fails with qrexec-daemon message

2017-11-20 Thread Bernhard
Hello,
with your nice help I happily installed Q4.0rc2.  Then I created a bunch
of debian-8 based appvm's, to copy my data back from the backup. But
they don't start, finishing with "Cannot execute qrexec-daemon" error. I
hate that error : no clue where it comes from.   Any hints? Thank you!
Bernhard


P.S: First, I thought that this is the annoying but harmless
"after-tempate-change-xfce-menu-messy"  bug (which forces to go to VM
settings, remove all Applications, save, go there again, put them back &
save again to get all symlinks right). But the problem is somewhere else.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/2af9d708-912a-a7b6-09e8-d510f4bdfda8%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] qubes 4.0rc2 install question

2017-11-20 Thread Bernhard
On 11/20/2017 05:38 AM, taii...@gmx.com wrote:
> I tried toinstall Q4.0-rc2 today. To my surprise the installer warns me
>> about hardware incompatibilities that should not exist, according to the
>> HCL : I have a i7-4600U cpu that has VT-x with EPT and VT-d as it
>> should.
>> So I am confused ... qubes-hcl-report says "HVM not active", same for
>> "I/O MMU" and further "no HAP". Is this a maybe BIOS setting I have to
>> change? Or another (non-cpu) hardware incompatibility?  Thank you,
>> Bernhard
> You gotta enable them in the BIOS configuration menu of course,
> assuming your motherboard has implemented those features.

Thank you, that was all. I am astonished that features of the CPU must
be enabled by BIOS, this was out of horizon of imagination to me.

Best, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/4b8c8035-d366-ddaf-524a-fc6b833761c6%40web.de.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] http filter

2017-06-23 Thread Bernhard
Hello,

in the (nice) tutorial
https://www.qubes-os.org/doc/config/http-filtering-proxy/ it is
suggested to run the tinyproxy inside the FirewallVM. That is
estonishing to me. I would think the qubes way were to have a proxyVM
(based on some minimal template) that is set *behind* Firewall and on in
it. one ascii picture replaces ten phrases:

Jungle  <->  SysNet  <-> FirewallVM <-> ProxyVM  <-+-> AppVM1

 <-+-> AppVM2

So here are my two questions:

- is this better than the suggested  tinyproxy-in-FirewallVM ?

- did someone set up his filtering that way and give some hints / errors
to avoid?

Thanks, Bernhard




-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/61ea05f9-9f6a-403d-7052-4deb8f56fb0d%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Weird SSL issues

2017-06-07 Thread Bernhard

> Hello Qubes community!
>
> I have a weird issue with SSL (HTTPS) access. 
>
> Here is my setup: Debian 9 minimal sys-net - Fedora 24 minimal sys-firewall. 
> Any app-vm running Fedora 24 or Debian 9 (have not tested any other) have 
> issues connecting to https sites with Chrome, Chromium or Firefox-esr. 
> Sometimes it works, sometimes not...
>
> I have tested on numerous wired and wireless network with the same result.
>
> Please help me figure this out!
>
> Dominique
>
Hello, I sometimes have SSL issues that all from the fact that the time
in the appvm are wrong (sometimes even in the future) - although dom0 is
accurately set up. If you have a cure to that (especially for debian) I
am interested ... maybe you experience the same problem? Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/790483d5-87ae-e2e2-9f25-d1b30bade364%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] How to extract a backup from dom0

2017-05-22 Thread Bernhard

> After the recent update I lost all communications out of dom0, no
> network as already described here
> https://groups.google.com/forum/#!topic/qubes-users/unDqbBa_k_Y
> <https://groups.google.com/forum/#%21topic/qubes-users/unDqbBa_k_Y>
>
> Also  USB sticks do not mount anymore even after deleting all
> assignments of 00:1a.0  and 00:1d.00  
>
> But dom0 still works, so made a backup of  all VMs. But how to take
> the backup out of dom0?
Boot a live-linux with built-in LUKS support. Tails for example
(activate root access after boot).
Then "break in" by hand following standard tutorials "how to mount a
luks drive", and copy all
to your usb disc. consider generatinga huge sparse-file, say, BACKUP.enc
then loop-it:
losetup  -f   % findes out a free slot
losetup /dev/loopxxx   BACKUP.enc
Now /dev/loopxxx is a device that can by crypt-setuped by luks in a
standard tutorial way. Mount it, and move your data in.

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/05617375-2010-3610-db90-0ca9c8e24b46%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] debian minimal

2017-05-14 Thread Bernhard
Hi Unman & ubestemt,

thank you for your patience. I followed Unmans hints. The difference is
that, due to no-full-fedora-appvm-working-error I was using a
f-24-minimal als starting point. This is bad, since minimal means
minimal.. so the setup script failed miserably several times without
surprise. The first ones seemed easy. I added dialog, dialog-devel. Then
it was dpkg-dev and debootstrap that were missing. Got them as well.
Since gpg is used & installed I added as a guess additionally openssl &
openssl-devel as well. Now I am stuck: Setup spills out

Traceback (most recent call last)
 File ./setup, line 1919 in 
   main(sys.arg)
 File ./setup, line 1902, in main
   Wizard(DialogUI(), **args)**
 File ./setup, line 1190 in __call__
   self.verify_keys(self.keys, force=False)
 File ./setup, line 1233, in gpg-verify_key
   _env=env
..
UnicodeDecodeError: 'ascii' code can't decode byte 0xc3 in position 91:
ordinal not in range(128)

This error, as suggested here
https://stackoverflow.com/questions/21129020/how-to-fix-unicodedecodeerror-ascii-codec-cant-decode-byte

is due to some coding problems. Maybe some 'errors' in the setup script
never appear in a rich-fedora system, but fail in fedora-minimal? I have
no clue how too fix that.   Anyone might help?

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/fc72dc9f-e4ce-4ef7-e609-2380e533c73b%40web.de.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] debian minimal

2017-05-13 Thread Bernhard
Hello,
I ask again about a debian-8/9-minimal (preferably with coldkernel). I
know there was already a discussion on the subject, but I could not
gather enough information yet to start myself. There is a conf file
debian-8-minimal-3.0.2-201505170018.conf on github. The date "2015" is
not completely re-assuring. Is there a newer one? Even if it were
up-to-date, what do I do with this file? Could someone give me a brief
summary (or give diff's to the well documented archlinux building process)?

Thank you!  Bernhard


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1cccd7ad-008a-6b69-7231-5b3cc092eeb4%40web.de.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] debian8's thunderbird dead

2017-05-06 Thread Bernhard
Hello,

since debian-8 rebraded icedove thunderbird, they are all dead. On the
command line the just spill out "Killed" verbose or safe-mode give no
better information. This may or may not be linked to the change in
debian8 - it may also be linked to the "immutable script" in rc.local
that I copied after some hardening discussion here in the forum 2 months
ago. I don't see how, but since I am lost I look for any possibility.
May you help me?  Thx, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/164f213e-7364-608b-c6a7-80bf6c222c38%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Breaking the Security Model of Subgraph OS

2017-04-12 Thread Bernhard
> What exactly makes subgraph special and not just another
> apparmor/selinux MAC type clone?
>
> The firewall is a neat bit of progress however, but again that can
> also be accomplished with an apparmor MAC default profile however
> allow app to access site etc is only on an IP basis not a DNS basis
> (dns basis is sketchy anyways).
I perfectly agree that this 'phone home' business is inaccaptable. If
you consider that this type of firewall is easy to set up within qubes I
invite you to write a small tutorial on the subject for 'normal users' 
.... thank you! Bernhard


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/6c8dc688-20c2-f88e-c2ae-555258bb5da2%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Alternate net-vm

2017-03-16 Thread Bernhard
> Hello All,
>
> Does anyone use an alternate net-vm and have any notes on setting it
> up as I am having problems with internet connection? I am going to try
> getting it going but wondered if there was an alternative!
>
Hello, I used a debian-9 by the mentioned clone & update process and
also a fedora-24-minimal that just needs to be enriched by fwireless
irmware. Both work well. All the best

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0747ee7a-ce67-fa79-1b4f-4ecf08ba124e%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] qvm-create-default-dvm fails

2017-03-06 Thread Bernhard
On 03/06/2017 02:55 PM, Unman wrote:
>> self._update_libvirt_domain()
>>   File "/usr/lib64/python2.7/site-packages/qubes/modules/000QubesVm.py",
>> line 755, in _update_libvirt_domain
>> raise e
>> libvirt.libvirtError: operation failed: domain 'debian-8-dvm' already
>> exists with uuid 61320a0c2-1e2a-4bff-b064-29fe587619b8
>>
>> Bernhard
> Look here:
> www.qubes-os.org/doc/remove-vm-manually
>
> That libvirt error sghows that you have a redundant entry in the db,
> which you need to remove.
> Then try creating the dvmTemplate again. Remember, no sudo!

Hello Unman, I looked at your link.

|1) rm -rf is done. 2) qvm-remove --just-db debian-8-dvm says "there is
no VM with this name.." (and he's right!) 3) in|||~/.local/share/applications/ 
there no thing such as |debian-8-dvm*
There is debian-8-gnome-terminal.desktop
debian-8-gpk-application.desktop and
debian-8-qubes-appmenu-select.desktop I won't touch these, will I ??
Still, the error persists. Find finds no debian-8-dvm* file in /var ...
I also find -type f -size -1M -exec grep -il debian-8-dvm \{} \;
verifyied my /var: no debian-8-dvm string wheresoever. However, I found
/etc/libvirt/libxl/debian-8-dvm.xml I moved it to 
|||/etc/libvirt/libxl/debian-8-dvm.xml|.old to see what happens, but the
error persists still. Desparate ... any ideas? Bernhard |

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/b8a22850-7557-666b-af3a-66115bb29322%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] removed qubes-core-dom0 by accident

2017-03-02 Thread Bernhard
> upgrading from 3.1 to 3.2 broke with several hundred dupe packages. 
> package-cleanup didn't work, so I had to remove dupes by hand one by one.
>
> clicking through many y/N questions, I inadvertently removed libxml dupe, 
> which in turn removed qubes-core-dom0, all templates, and borked my system.
>
> I'm hurting here. Is there any way to restore my Qubes to a working system?
>
> No backups. (of course.)
>
> Any suggestions for system recovery?
>
> Or at least recovering my data?
I can only give some limited backup help (from memory, I did it some
moment ago). Use a live linux WITH luks support (tails is great). Boot
it (in tails activate root at startup!), open terminal, enter sudo su -
to make it a root terminal.
0) with lsblk you should see your partitions & sizes. Normally it allows
to guess which ones are the encrypted disks.
The procedure I use is (before retyping any command, read the manpage
top know / verify you do want you want to do).
1) cryptsetup luksOpen /dev/[dev-name]  ALIAS
typically  cryptsetup luksOpen /dev/sda1  HDD  and / or cryptsetup
luksOpen /dev/sdb1  SDD
2) standard installs will use a "volume group". Before mounting you may
need to activate it:
vgchange -a y   (a='available', y=yes=activate, n=no=deactivate)
3) mount them: mount /dev/mapper..[ qubes-volume-name ]   /somepath
4) mount your recue disc as well. You may want to encrypt your backups :
 (a) generate a huge sparse filetruncate -s 200G backup.luks
 (b) lopsetup -d   will give you a free loopback slot, like loop5
for example.
 (c) losetup  backup.luks   /dev/loop5
 (d) cryptsetup luksFormat /dev/loop5
 (e) cryptsetup luksOpen /dev/loop5  backup
 (f)  |mkfs.ext2 /dev/mapper/backup
(g) mkdir /backup && mount /dev/mapp/er/backup  /backup
||Now you have /backup that can be written to. Content will be
stored encrypted in your backup.luks file.
|
5) data is in  /var/lib/qubes/ 

But (here someone may expolain it to me at the same time): the
appvms seem to be in files actually,
with strange names, like qubes-0 qubes-1 or something of this type.
I presume they are loop-mounted
by qubes into their respective dirs at startup. If you want to fetch
data selectively, I guess you have
to do the same:  lopsetup -d   will give you a free loopback slot,
like loop5 for example.
losetup file  /dev/loop5   will then generate a "device" /dev/loop5
that points to your file.
Now mount /dev/loop5 /some-other-path allows to mount a filesystm
inside a file. Then you may go to
/some-other-path and grab data.

when done, close your encrypted disks correctly cryptsetup luksClose
ALIAS and shutdown live-linux
samefor backup !

Good luck, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/63332bb7-d326-a715-15e1-84bb9adcec35%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Deleted Ferdora-23 template, killed sys-net and sys-firewall

2017-02-22 Thread Bernhard
On 02/22/2017 05:28 AM, opiyv...@gmail.com wrote:
> I switched my appvms to the fedora-25 template but I forgot that sys-net and 
> sys-firewall were still on fedora-23, and then I deleted the fedora-23 
> template. Sys-net and sys-firewall both say "error no such file or directory 
> '/var/lib/qubes/vm-templates/fedora-23/apps.templates'" when I try to start 
> them (after reboot)
> Before rebooting the network still worked but I couldn't open the settings 
> thing to change the template vm for sys-net and sys-firewall
>
> How can I somehow reinstall the fedora-23 template or change the sys-net and 
> sys-firewall templates to fedora-25 or debian-8?
>
> Thanks
>
Hello I don't think it is necessary to reinstall fedora-23. You may
change the sys-net and sys-firewall to fedora-25 (in qubes manager:
right click -> "change VMsettings" and then look for the dropdown menu
for templateVM) and the start them. If wireless should not be available
immediately, you will have to use ethernet : it is good to know that any
working template VM (fedora-X, debian-X) should bring up a sys-net that
allows at least ethernet. Then you can install the hardware firmware
needed (try 'sudo lspci' to find out the chipset you have, try 'sudo dnf
search chipset-keyword'  ). Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/3a1af946-c5ba-26ce-90b6-941b35879cb8%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] qubes r3.2 bricked

2017-01-26 Thread Bernhard
On 25/01/2017 22:37, Ángel wrote:
> Bernhard wrote:
>> Thank you Angel, for helping me.
>>
> You're welcome, Bernhard.
>
>
>> and, as I said, nothing starts. I start thinking of a disaster-mode data
>> recovery since I do not know how I could possibly unbrick a system that
>> has no network anymore?! 
> That's just because most VMs depends on sys-net, and sys-net is not
> available. Can you still edit them with Qubes VM Manager? The VMs should
> at least start if you set their NetVM to none. Then you could create a
> new sys-vm if it still doesn't get fixed.
>
> Best
>
Hello Angel, that worked. With "no net" I can start the VM's.

That solves a big pb, I can now backup data :) Before this trick, only
with dom0 I would not have been able to attach the usb anywhere :))

1) So, may I ask you some hint how to generate a new sys-net, please?

2) Another approach is this one: I looked at the guest-sys-net.log I
cannot retype everything, so I give some extracts. The F24 part  starts 
with fsck (?!) .. and after some time  FAILED to start File System Check
on Root Device. At this point one service after the next is Stopped, the
log ends with : "Welcome to emergency mode" 

So, maybe I can first fsck  the stopped sys-net fs from within dom0 by
hand? How could I do that? I guess I loop /var/lib/qubes/(??) and then
fsck it?

Thank you, Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/cfd04e81-1334-638b-0865-678e5e349e52%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] qubes r3.2 bricked

2017-01-25 Thread Bernhard
On 24/01/2017 23:30, Ángel wrote:
> Bernhard wrote:
>> Hello, I bricked my system a bit. Yesterady I decided  to follow the
>> ..onion update procedure. For dom0 all went well (after reading that I
>> must change to whonix-net),but I had to modify the debian-8 and
>> fedora-24 repo-files "by hand". No big deal. I could update f24 (this
>> morning), but debian bugged a bit. Suddenly I thought that maybe I had
>> to put netVM to whonix for the templateVM's as well. With a doubt on it
>> I looked up what I did with f24 .. and there, by accident I let the
>> dropdown box on "sys-net" instead on sys-firewall (or whonix-net).
> I would expect that this would make you lose the firewall protection...
>
>
>> Immediately sys-net derailed and lost network. 
> ...not sys-net to die.
>
>
> Is any of your /var/lib/qubes/*/*/firewall.xml files 0-bytes?
> (if so, delete it -so it gets replaced with default settings- and
> restart)
>
Thank you Angel, for helping me.

me@dom0 qubes]$find /var/lib/qubes -iname *.xml

finds only some files qubes-*somedate* in backup two xml fies in updates
and qubes.xml itself. When I run in

me@dom0 qubes]$ dom0qvm-start [some appvm] I get  some lines like


File "/usr/bin/qvm-start, line 136 then 120

File "/usr/lib64/python2.7/../000QubesVM.py

File "/usr/lib64/python2.7/../006QubesProxyVM.py

qubes.qdb.Error: (2, 'No such file or directory')


and, as I said, nothing starts. I start thinking of a disaster-mode data
recovery since I do not know how I could possibly unbrick a system that
has no network anymore?! I add some history: after having changed to the
.onion repo's,  the fedora24 system suggested 123(!) package updates (I
agreed). That seemed a lot to me, since I check for updates every day.
If I have to guess, it is there that it became a brick. Is it sure that
the f24 on qubes-os.org and the onion repo are the same? Can I unroll
the last update?

Thank you for any hint or help  Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/3e0562fc-916d-72aa-8aa2-656bd6428c63%40web.de.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] qubes r3.2 bricked

2017-01-24 Thread Bernhard
Hello, I bricked my system a bit. Yesterady I decided  to follow the
.onion update procedure. For dom0 all went well (after reading that I
must change to whonix-net),but I had to modify the debian-8 and
fedora-24 repo-files "by hand". No big deal. I could update f24 (this
morning), but debian bugged a bit. Suddenly I thought that maybe I had
to put netVM to whonix for the templateVM's as well. With a doubt on it
I looked up what I did with f24 .. and there, by accident I let the
dropdown box on "sys-net" instead on sys-firewall (or whonix-net).
Immediately sys-net derailed and lost network. When I tried to switch
the templateVM setting back to sys-firewall, I just got a error box
saying "16". I decided to solve this with a clean reboot. This allowed
to switch back the templateVM's back to net-firewall for both, debian
and f24. But net-usb, net-sys and net-firewall (they all depend on f24)
did not come up again. I thought that this will resolve with a second
clean reboot. But nope. So, the state is that I cannot start any appVM
(they close immediately), and I have no network. Worse: I have no idea
how to fix it, so I ask you for help.

Bernhard

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/668039ad-66f2-f575-6ecd-7154de5c701d%40web.de.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] installing complete texlive in dom:work -- out of space

2017-01-05 Thread Bernhard
Hello again,  let me precise my question : how do I move appvm's
(sitting in a relatively small SSD on /var/lib/appvm/..) to the large
and empty HDD ? That would solve a lot of "space" problems. Did I
partition wrong?? I set up
 32GiB SSD: 512M   /bootand the rest   /
450Gib HD:16G   /swap   and the rest/home
Thank you, Bernhard

>   Hello,
>
> thank you for all help I got so far. The qubes adventure continues for
> me :) I do need
>
> a rather complete texlive installation, and when doing this with dnf I
> run out of space.
>
> Can someone give me a hint what to do?
>
>
> Thanks, Bernhard
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/2cb84b98-fc5d-4fa3-2b79-33180463f674%40web.de.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] installing complete texlive in dom:work -- out of space

2017-01-05 Thread Bernhard
  Hello,

thank you for all help I got so far. The qubes adventure continues for
me :) I do need

a rather complete texlive installation, and when doing this with dnf I
run out of space.

Can someone give me a hint what to do?


Thanks, Bernhard


-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/46994222-4438-948e-1df6-dcbcb138fc10%40web.de.
For more options, visit https://groups.google.com/d/optout.