Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
Le mardi 4 octobre 2016 01:37:16 UTC+2, raah...@gmail.com a écrit : > On Monday, October 3, 2016 at 1:14:13 PM UTC-4, nishi...@gmail.com wrote: > > It isn't a configuration problem but a driver related one. I made the > > mistake to set up this mouse with a minimum DPI value that is too high. > > Anyway it has by default a high DPI value that does not fit a browsing / > > workstation profile. I bought it for gaming purpose, but I stopped playing > > video games. > > > > Problem is driver from manufacturer to Linux users is really bad as ofc > > they don't sell it for that usage. So unless someone would know how to > > properly burn a udf USB iso, I guess I'll have to reinstall baremetal > > Debian and take an afternoon to compile sources and make it work, once > > again... > > if it works in a baremetal debian, it should work in a debian based sys-usb. Thank you for the tip, I forget indeed to try this. But I found an easier solution as those drivers for Debian were considered as "outdated" by the manufacturer (confirmed xd it took me a lot of time to make them work :S) : to go for a Linux distro on where they were still implemented by developpers : ) So I just installed Ubuntu and they worked fine, took me 5mn to install and lower down DPI :) Well so once again, really sorry having went on this full paranoid mode and talking shit about Qubes, thinking my HDD was hijacked or smth wtf.. So stupid and bad mannered from me... Unfortunately it comes from a previous rootkit experience on Windows so I suppose now when I see something kinda suspicious like an USB refusing to boot, I react like this, which isn't adapted at all. I hope it's cool and that I didn't hurt anyone. Even though this ipv6 port listening surprised me, I will keep using Qubes as it is a great OS and the work done here by developpers is just awesome. Documentation is also clear and well written. I also like the fact it comes with Debian + Xfce, which is imo the best destktop manager on Linux. Simple, elegant, and still greatly customizable : ) I find it better than the current Ubuntu default desktop manager I just discovered, but I guess everyone has its own preferences ^^ But yea first I really want to try out Unix BSD as when you are running Linux since few months you might want to discover where everything started : ) Bye and thank you again for your help on closing ipv6 on Debian, I hope it might help someone else not willing to have it enabled (for now... as we will all have to use it within time !) -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/d741cfcf-18cf-48c1-9842-09e8a0f2ff43%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
On Monday, October 3, 2016 at 1:14:13 PM UTC-4, nishi...@gmail.com wrote: > It isn't a configuration problem but a driver related one. I made the mistake > to set up this mouse with a minimum DPI value that is too high. Anyway it has > by default a high DPI value that does not fit a browsing / workstation > profile. I bought it for gaming purpose, but I stopped playing video games. > > Problem is driver from manufacturer to Linux users is really bad as ofc they > don't sell it for that usage. So unless someone would know how to properly > burn a udf USB iso, I guess I'll have to reinstall baremetal Debian and take > an afternoon to compile sources and make it work, once again... if it works in a baremetal debian, it should work in a debian based sys-usb. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/59515399-10ed-4fc3-ab9a-e53fbfcdd2c1%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
It isn't a configuration problem but a driver related one. I made the mistake to set up this mouse with a minimum DPI value that is too high. Anyway it has by default a high DPI value that does not fit a browsing / workstation profile. I bought it for gaming purpose, but I stopped playing video games. Problem is driver from manufacturer to Linux users is really bad as ofc they don't sell it for that usage. So unless someone would know how to properly burn a udf USB iso, I guess I'll have to reinstall baremetal Debian and take an afternoon to compile sources and make it work, once again... -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/7b19fe03-4757-4f13-a05e-5ada915e1dc3%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
On Monday, October 3, 2016 at 9:05:01 AM UTC-4, nishi...@gmail.com wrote: > Ok thank you guys, on my next Qubes install I'll use your advices to disable > ipv6 on Debian :) Anyway I use Fedora as well, I use both. Thanks again. > > But right now as I don't want either to go back to my old crappy mouse, > either to continue with this high DPI uncontrollable skating mouse, > unfortunately I am completely locked. Since ~10 days :( > > This is really strange I never encountered problems on Qubes by the past to > use the "dd" command to burn an iso. I tried to add "bs=512" but I still > can't boot on my USB, so that I could install those mouse drivers to lower > down DPI, then uninstall Windows and continue on my way to try a BSD Unix > system.. I don't understand what you mean. Did you try the system settings, and mouse settings from the start menu? -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/e9e089c4-7dc6-477f-91fe-178d068c10ec%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
On Sunday, October 2, 2016 at 10:37:45 PM UTC-4, raah...@gmail.com wrote: > On Sunday, October 2, 2016 at 9:03:03 PM UTC-4, nishi...@gmail.com wrote: > > Uh ok, this ipv6 listening on my template set me in full paranoid mode. I > > have found disappointing to see ipv6 wasn't disabled on Debian template, > > but yea sorry, I went completely mad & full retard mode about Qubes on the > > rest. > > > > I thought I was betrayed. I have been betrayed a lot by relatives but that > > doesn't mean I'm supposed to react like a dumbass and think of conspiracy > > if I got one port listening... Sadly my imagination went crazy mode. I > > guess you can call it a defense mechanism, but nevertheless, I am sorry > > about that. > > > > My boot problem is in fact related to "sudo dd if=/file.iso of=/dev/sdX" > > ends up burning a UDF partition that refuses to boot. I tried your advices > > except the ArchLinux one, but I guess I just have to keep trying. Also I > > read somewhere I need to enter "bs=512" to burn more little fragments than > > the original size to avoid boot problem with UDF. This might fix my issue, > > I will try tomorrow. > > > > Fun part is that I want to go back to Windows only very briefly, to install > > my mouse drivers and fix its sensitivity being too fast, as Linux drivers > > are really painful to install for this model (I did it on Debian, it took > > me a lot of efforts to make it work). > > > > Then I think I will probably join back in the future Qubes, as indeed it is > > a very innovative OS. It's just I am interested on trying BSD systems. I > > found a great guide to learn Korn shell scripting, watched all videos > > https://m.youtube.com/playlist?list=PLCAFDE9B81B30388E > > It was very interesting and very well made, allows you to understand better > > how command line work and the logics behind programs ! > > > > In fact I just want to learn to use a different Unix-based system than > > Linux and try there what I have learnt on this great tutorial. It's easier > > when your mouse isn't on steroids ^^ > > fedora is the default man. but its easy to disable on debian and all the > other processes. I understand your assumption though, its common sense. I personally use fedora as my default sys-net and firewall still for those reasons as well. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/08a7dee8-e118-493e-9e68-15f929897803%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
On Sunday, October 2, 2016 at 9:03:03 PM UTC-4, nishi...@gmail.com wrote: > Uh ok, this ipv6 listening on my template set me in full paranoid mode. I > have found disappointing to see ipv6 wasn't disabled on Debian template, but > yea sorry, I went completely mad & full retard mode about Qubes on the rest. > > I thought I was betrayed. I have been betrayed a lot by relatives but that > doesn't mean I'm supposed to react like a dumbass and think of conspiracy if > I got one port listening... Sadly my imagination went crazy mode. I guess you > can call it a defense mechanism, but nevertheless, I am sorry about that. > > My boot problem is in fact related to "sudo dd if=/file.iso of=/dev/sdX" ends > up burning a UDF partition that refuses to boot. I tried your advices except > the ArchLinux one, but I guess I just have to keep trying. Also I read > somewhere I need to enter "bs=512" to burn more little fragments than the > original size to avoid boot problem with UDF. This might fix my issue, I will > try tomorrow. > > Fun part is that I want to go back to Windows only very briefly, to install > my mouse drivers and fix its sensitivity being too fast, as Linux drivers are > really painful to install for this model (I did it on Debian, it took me a > lot of efforts to make it work). > > Then I think I will probably join back in the future Qubes, as indeed it is a > very innovative OS. It's just I am interested on trying BSD systems. I found > a great guide to learn Korn shell scripting, watched all videos > https://m.youtube.com/playlist?list=PLCAFDE9B81B30388E > It was very interesting and very well made, allows you to understand better > how command line work and the logics behind programs ! > > In fact I just want to learn to use a different Unix-based system than Linux > and try there what I have learnt on this great tutorial. It's easier when > your mouse isn't on steroids ^^ fedora is the default man. but its easy to disable on debian and all the other processes. I understand your assumption though, its common sense. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/cdb1638c-e4cb-4d97-893c-8be0b1fa10ae%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
nishiwak...@gmail.com: > Uh ok, this ipv6 listening on my template set me in full paranoid mode. I > have found disappointing to see ipv6 wasn't disabled on Debian template, but > yea sorry, I went completely mad & full retard mode about Qubes on the rest. > > I thought I was betrayed. I have been betrayed a lot by relatives but that > doesn't mean I'm supposed to react like a dumbass and think of conspiracy if > I got one port listening... Sadly my imagination went crazy mode. I guess you > can call it a defense mechanism, but nevertheless, I am sorry about that. > > My boot problem is in fact related to "sudo dd if=/file.iso of=/dev/sdX" ends > up burning a UDF partition that refuses to boot. I tried your advices except > the ArchLinux one, but I guess I just have to keep trying. Also I read > somewhere I need to enter "bs=512" to burn more little fragments than the > original size to avoid boot problem with UDF. This might fix my issue, I will > try tomorrow. > > Fun part is that I want to go back to Windows only very briefly, to install > my mouse drivers and fix its sensitivity being too fast, as Linux drivers are > really painful to install for this model (I did it on Debian, it took me a > lot of efforts to make it work). > > Then I think I will probably join back in the future Qubes, as indeed it is a > very innovative OS. It's just I am interested on trying BSD systems. I found > a great guide to learn Korn shell scripting, watched all videos > https://m.youtube.com/playlist?list=PLCAFDE9B81B30388E > It was very interesting and very well made, allows you to understand better > how command line work and the logics behind programs ! > > In fact I just want to learn to use a different Unix-based system than Linux > and try there what I have learnt on this great tutorial. It's easier when > your mouse isn't on steroids ^^ Sincere apologies for making the inference about the agenda thing. Cheers, -Jeremy -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/01c8c10c-fac3-63dc-a349-727aaa0d78cf%40airmail.cc. For more options, visit https://groups.google.com/d/optout. signature.asc Description: OpenPGP digital signature
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
Uh ok, this ipv6 listening on my template set me in full paranoid mode. I have found disappointing to see ipv6 wasn't disabled on Debian template, but yea sorry, I went completely mad & full retard mode about Qubes on the rest. I thought I was betrayed. I have been betrayed a lot by relatives but that doesn't mean I'm supposed to react like a dumbass and think of conspiracy if I got one port listening... Sadly my imagination went crazy mode. I guess you can call it a defense mechanism, but nevertheless, I am sorry about that. My boot problem is in fact related to "sudo dd if=/file.iso of=/dev/sdX" ends up burning a UDF partition that refuses to boot. I tried your advices except the ArchLinux one, but I guess I just have to keep trying. Also I read somewhere I need to enter "bs=512" to burn more little fragments than the original size to avoid boot problem with UDF. This might fix my issue, I will try tomorrow. Fun part is that I want to go back to Windows only very briefly, to install my mouse drivers and fix its sensitivity being too fast, as Linux drivers are really painful to install for this model (I did it on Debian, it took me a lot of efforts to make it work). Then I think I will probably join back in the future Qubes, as indeed it is a very innovative OS. It's just I am interested on trying BSD systems. I found a great guide to learn Korn shell scripting, watched all videos https://m.youtube.com/playlist?list=PLCAFDE9B81B30388E It was very interesting and very well made, allows you to understand better how command line work and the logics behind programs ! In fact I just want to learn to use a different Unix-based system than Linux and try there what I have learnt on this great tutorial. It's easier when your mouse isn't on steroids ^^ -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/1045ea1b-c02f-41b5-b615-e2eb1fe9a0a5%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
Hello Andrew, How are you ? Thank you for your time, I appreciate your help. I don't know if I went full paranoid mode but I just wanted to apologize having been so aggressive. It's not the way I behave myself in real, I am really the opposite kind, being sensitive and trying to stay polite with people. I clearly failed there so I just wanted to let you know that I truly respect Qubes development team and that I am sorry having letting myself ending up being nasty... What bothers me is that I really love the American culture and I don't understand why on the political part NSA is making a war nowadays on the entire world on privacy rights. Well, as anyone I have been really shocked by 9/11 terrorist attacks. Even though I understand the US politics reacted because they have been hurt on a power symbol, I really want these paranoid policies by NSA against every privacy rights of citizen to end. Human dignity is based on privacy respect. I can tell you about it, I lost a huge part of my dignity in psychiatry, going there for wrong reasons (got fascists perverts in my family). And I mean, who doesn't love the US ? If I had to move to a desert island and only take 5 of my favorite movies ever, I would probably take 3 American one's : "Mulholland Drive", "Forrest Gump" and "Changeling". What's fascinating is that all those 3 outstanding movies express in a very different way the same universal feeling : love. I feel so grateful to the US when I watch them because actually my life sucks, got no friends, no family left. I feel like receiving a bit of love I missed. Well, all that being said, thank you for your support. I'll try your solutions when I'll wake up :) -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/79f64700-788b-4cba-9f97-53f3cc0505e3%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 2016-09-30 14:14, nishiwak...@gmail.com wrote: > Hi, > > Could a Qubes developer pay attention on this ticket, please ? > > I can't reinstall any other OS than Qubes on my HDD. When I put in a USB key, > it doesn't boot on it, it switches directly to the GRUB menu. > You have to select your USB key as the first boot option in your BIOS menu. Alternatively, invoke the boot selection menu during boot, and choose your USB key. How to do this depends on your BIOS. > I am sure at 100% it comes from some sort of disk protection that Qubes put > on my disk. I am also sure that those USB keys would work on any other HDDs, > as they are properly burnt. > Qubes does not create or apply any "disk protection" of that sort. > I tried to reinstall Qubes without disk encryption. It didn't change the > outcome. > > How do I remove this disk block so I can use USB keys to install another OS > than Qubes ? If you want to make sure the disk is empty, you can simply zero-fill it, e.g., # dd if=/dev/zero of=/dev/sdX where sdX is your disk. (Make sure not to select just a single partition on the disk, but rather the whole disk.) There are also other methods, like ATA Secure Erase (hdparm). Have a read: https://wiki.archlinux.org/index.php/Securely_wipe_disk - -- Andrew David Wong (Axon) Community Manager, Qubes OS https://www.qubes-os.org -BEGIN PGP SIGNATURE- iQIcBAEBCgAGBQJX8AvxAAoJENtN07w5UDAwPh0P/j8kfG6mxNgaeR+4vp4d9Rzh 0PX5mIFKl84hZM7V1+AQ8cVVC4bp282FicDSNrlWiO8z8/U1Xza67Hpy0YFCxwvZ eQ0zrBXszV88/LGM9N74NOo+u4SE7P+vq7hDREnVPOanntpSXpo1M1ZvDiLdpU0C anl+Q6vBbV0aumqs8oxe1mvGpNXjPAghrB0qAkut8sYwahuXoy2l/Gfs9x9GuC4s 0QXm4Gw+dlgcKSADBx9Z5bd5UlE9I8L7ecXaqXElv/tGpocmh9K0WT7/zH2cDrVk Jk8R9fo0lyzUPu4Uw2rz7N93Namjwx1+FktAiurW/rfF9EotyBgBAorEJGvQVikG gaAuSjvPEGLPecZYx0VN/xw07LpzqdVWt7TpBlPst24BSowlm3+M7jk7Dlxpsp2J ZSzeF6XebzdF66z73iWpwoyK3ZQ0tyW1UAKkUAFgyyy5H0LItMsstovTm3MngZ+G AZloc7mCTM21wxd2dTzYXkYzj9xl/n82g9Btj9cMrw9eIH8ncOk16y0AoobIFIYT LMqqSkHbXHljI6KbT2o6kgOGgBQklsgoRZR7K9iknUzI1vO25v9RE0cAeNx5/S8J 2IoIkR7G95aC9wSE2QptRZ0CltbO6sXodlkgoP2rzkl7BZVZZRoFB38D+ul/L9bT 8EBPm7PKAwlt+2fhEvVf =fXAx -END PGP SIGNATURE- -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/b9371c17-da5c-dfbe-7c30-ea27af16c136%40qubes-os.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
nishiwak...@gmail.com: > I won't wait another week with my HDD disabled by this OS. I'm trying to figure out if this is a veiled threat of some kind...? FWIW, I've booted from USB drives while Qubes was installed internally before. I'm under the impression that lots of people here have done so. So perhaps you might want to consider the likely possibility that there is something different about your setup compared to mine (and everyone else's whose setup works fine), rather than this being a deliberate attempt by Qubes developers to "make [sic] hostages". Then again, based on your other posts in this thread, it's likely that I'm wasting time trying to reason with someone who has an entirely different agenda than getting an actual bug fixed. I won't be bothering to engage further if additional posts support that conclusion. Cheers, -Jeremy -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/3a46a661-d4bf-ea8b-5ff1-ba4f65520be3%40airmail.cc. For more options, visit https://groups.google.com/d/optout. signature.asc Description: OpenPGP digital signature
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
I was indeed but I lost trust in Qubes. Officially ipv6 disabled by default but hf being secretly backdoored on ipv6... Nice privacy respect policies. I won't wait another week with my HDD disabled by this OS. Come on, please, why would someone doubt on something that is so obvious ? I used 3 different USB keys and different iso images. Every USB keys fails on booting while isos have been properly burnt to USBs on a fresh new install. Can't install any other OS, my hard drive is locked. This is so disgusting. Some explanations on how to completely erase Qubes OS and his disk USB protection out of your hard disk would be really helpful, as I can't use currently my computer.. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/e53ec64e-91f0-4858-9db8-ecb58813f30f%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
Hi, Could a Qubes developer pay attention on this ticket, please ? I can't reinstall any other OS than Qubes on my HDD. When I put in a USB key, it doesn't boot on it, it switches directly to the GRUB menu. I am sure at 100% it comes from some sort of disk protection that Qubes put on my disk. I am also sure that those USB keys would work on any other HDDs, as they are properly burnt. I tried to reinstall Qubes without disk encryption. It didn't change the outcome. How do I remove this disk block so I can use USB keys to install another OS than Qubes ? If you wanna make hostages, then say it on your web page because right now my disk is unusable and it's Qubes responsibility at 100%. I'll wait here until someone tells me how to completely erase Qubes from my disk (USB PROTECTION INCLUDED) so that EVENTUALLY I could switch to another OS and FUCKING MOVE ON, FOR GOD'S SAKE. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/39f2410c-9370-4f25-94ae-b14242d1f48d%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
On Tuesday, September 27, 2016 at 7:27:43 PM UTC-4, raah...@gmail.com wrote: > On Tuesday, September 27, 2016 at 5:38:59 PM UTC-4, Unman wrote: > > On Tue, Sep 27, 2016 at 12:41:12PM -0700, raahe...@gmail.com wrote: > > > On Sunday, September 25, 2016 at 9:46:13 AM UTC-4, nishi...@gmail.com > > > wrote: > > > > Hello, > > > > > > > > I am surprised that there is no way to disable ipv6 on Debian template. > > > > > > > > I reinstalled first the template using documentation > > > > https://www.qubes-os.org/doc/reinstall-template/ > > > > > > > > Then I added "net.ipv6.conf.all.disable_ipv6 = 1" in /etc/sysctl.conf, > > > > I did reboot the Template but it didn't change the outcome, I still had > > > > ipv6 ports opened using "netstat -antp" > > > > > > > > I even added "sudo ip6tables -P INPUT DROP" in "/rw/config/rc.local", > > > > but I still got those distant servers listening when I check using > > > > commands like "sudo lsof -i6" or "netstat -antp" on my Debian Template. > > > > > > > > What is rpcbind, avahi-dae and why you got this ipv6 bound to systemd > > > > on PID 1 ? Looks suspicious, I thought Ipv6 was disabled by default on > > > > Qubes. > > > > > > > > Regards > > > > > > You have to change kernel parameters a diff way I believe. try this > > > method from whonix instructions. > > > https://www.whonix.org/wiki/Qubes/Install > > > > > > to list the parameters use qvm-prefs -l debian-8 kernelopts > > > > > > To change them do qvm-prefs -s debian-8 kernelopts "nopat ipv6.disable=1" > > > > > > Then restart template and vms. > > > > > > > As I pointed out, changing parameters in the template will not affect the > > VMs. > > You need to change the option individually for each qube where you want > > to disable IP6. > > > > unman > > I pointed out how to change the parameters. You do the command from dom0 for > the template you want ipv6 disabled. Basically The same method whonix > instructs on how to install apparmor on debian template. This is how I > disable ipv6. you can verify this from a terminal in one of the proxies or vms based on that template with lsof or netstat and see no more ipv6 connections. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/13ed43ba-4151-4b52-9d25-3d4fff210b63%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
On Tuesday, September 27, 2016 at 5:38:59 PM UTC-4, Unman wrote: > On Tue, Sep 27, 2016 at 12:41:12PM -0700, raahe...@gmail.com wrote: > > On Sunday, September 25, 2016 at 9:46:13 AM UTC-4, nishi...@gmail.com wrote: > > > Hello, > > > > > > I am surprised that there is no way to disable ipv6 on Debian template. > > > > > > I reinstalled first the template using documentation > > > https://www.qubes-os.org/doc/reinstall-template/ > > > > > > Then I added "net.ipv6.conf.all.disable_ipv6 = 1" in /etc/sysctl.conf, I > > > did reboot the Template but it didn't change the outcome, I still had > > > ipv6 ports opened using "netstat -antp" > > > > > > I even added "sudo ip6tables -P INPUT DROP" in "/rw/config/rc.local", but > > > I still got those distant servers listening when I check using commands > > > like "sudo lsof -i6" or "netstat -antp" on my Debian Template. > > > > > > What is rpcbind, avahi-dae and why you got this ipv6 bound to systemd on > > > PID 1 ? Looks suspicious, I thought Ipv6 was disabled by default on Qubes. > > > > > > Regards > > > > You have to change kernel parameters a diff way I believe. try this > > method from whonix instructions. https://www.whonix.org/wiki/Qubes/Install > > > > to list the parameters use qvm-prefs -l debian-8 kernelopts > > > > To change them do qvm-prefs -s debian-8 kernelopts "nopat ipv6.disable=1" > > > > Then restart template and vms. > > > > As I pointed out, changing parameters in the template will not affect the > VMs. > You need to change the option individually for each qube where you want > to disable IP6. > > unman I pointed out how to change the parameters. You do the command from dom0 for the template you want ipv6 disabled. Basically The same method whonix instructs on how to install apparmor on debian template. This is how I disable ipv6. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/9d5aafb3-f3e1-4d50-b1eb-e7a681059c81%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
On Tue, Sep 27, 2016 at 09:15:47PM +, Jeremy Rand wrote: > johnyju...@sigaint.org: > >> The "listening" services are less of a concern, since the firewall > >> wouldn't permit any incoming connections to be passed through to start > >> with. It's the "phone home" style services, like time sync, Samba name > >> lookups on microsoft servers, and such, that are more concerning, and > >> privacy-busting. > > > > The paranoid part of me (which is about 95% of me) half-suspects that NTP > > is actively monitored by the powers that be, to keep tabs on us > > security-minded Linux geeks. > > > > There's been enough major security bugs in NTP, that one must wonder if > > they're akin to the heartbleed/rng/SSL/etc. compromises that don't > > necessarily look like innocent mistakes. > > > > Qubes is good at trying to get dom0 to push the time to the VM's by its > > own means. And if you set the ClockVM to sys-whonix, say, you remove, or > > at least greatly reduce, the ability of TPTB to track your setting your > > clock. :) > > > > However, as mentioned, the default of using NTP time syncing is enabled by > > default in the Debian-8 template, which defeats that protection for Debian > > Appvms, unless you disable it in the template. Just an oversight, I'm > > sure. (No sarcasm, for once.) > > > > My PC's RT clock might drift by a few seconds each week, if that; I'm not > > sure why time synchronization has to be so damn frequent and aggressive. > > A red flag for the paranoid. :) > > > > I have a RS232 GPS dongle that spits out the time with 1-second accuracy > > (or atomic-clock level accuracy, if you use the 1-second clock-tick signal > > available on one of the chips, which I have done, lol). > > > > I plan on hooking that up to my Qubes setup in the near future, and > > disabling network-based clock sync all together. > > > > (Until Qubes 4.0 comes out, forces me to upgrade to a newer motherboard > > with no RS232 support. :) ) > > > > Might be a good open-sourced hardware project. I think I've seen some out > > there already, although not necessarily integrated smoothly into Qubes. > > > > Just one more hole to make sure we plug. > > > > JJ > > You might find Jake Appelbaum's tlsdate interesting, or Adam Langley's > Roughtime. Both are quite a bit more secure than NTP, although tlsdate > doesn't work with TLS 1.3, and Roughtime is still a proof of concept. > > Cheers, > -Jeremy > Or sdwdate in Whonix -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20160927220140.GC5446%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
On Tue, Sep 27, 2016 at 09:13:30PM -, johnyju...@sigaint.org wrote: > > My PC's RT clock might drift by a few seconds each week > > Actually, it's not even that bad. I'm sure I've fired up motherboards or > laptops that haven't been touched in years, and their clocks were accurate > within a minute. > > So there's no need for synchronizing your time so frequently. > > I just read that NTP apparently adjust the frequency of polling based upon > how fast your clock seems to be drifting, which is admirable. > > http://www.ntp.org/ntpfaq/NTP-s-algo.htm > > But the poll interface ranges from 64 to 1024 seconds; even at the high > end, that seems unnecessarily frequent from the very small amount of clock > drift I've experienced. > > But flipping to a GPS-based source instantly eliminates those concerns. > > Question: for what purpose do we require super-accurate clocks in the > first place? There are some rolling password algorithms based upon time, > and certificates handling will get cranky if you're months or years off, > but other than that, what is the necessity of keeping a PC within seconds > of the correct time? > > (On tails, when it starts up, it does a time synchronization, claiming > it's required for Tor purposes. Anyone know the nature of that?) > > JJ > Like many encrypted tunnel setups, Tor requires both ends to have similar date/time. You can easily test this by manually setting to the wrong time, and watching the Tor fail. Tor also checks your local date/time against the consensus status document, and will warn you if it's off. If it's too far, you won't get tunnels. Connecting to Hidden services , I think, requires that local date/time be within 60 mins of the service provider. Tails has a mechanism to set local time. Whonix has a similar mechanism, also available in Whonix-Qubes. unman -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20160927215839.GB5446%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
On Tue, Sep 27, 2016 at 12:41:12PM -0700, raahe...@gmail.com wrote: > On Sunday, September 25, 2016 at 9:46:13 AM UTC-4, nishi...@gmail.com wrote: > > Hello, > > > > I am surprised that there is no way to disable ipv6 on Debian template. > > > > I reinstalled first the template using documentation > > https://www.qubes-os.org/doc/reinstall-template/ > > > > Then I added "net.ipv6.conf.all.disable_ipv6 = 1" in /etc/sysctl.conf, I > > did reboot the Template but it didn't change the outcome, I still had ipv6 > > ports opened using "netstat -antp" > > > > I even added "sudo ip6tables -P INPUT DROP" in "/rw/config/rc.local", but I > > still got those distant servers listening when I check using commands like > > "sudo lsof -i6" or "netstat -antp" on my Debian Template. > > > > What is rpcbind, avahi-dae and why you got this ipv6 bound to systemd on > > PID 1 ? Looks suspicious, I thought Ipv6 was disabled by default on Qubes. > > > > Regards > > You have to change kernel parameters a diff way I believe. try this method > from whonix instructions. https://www.whonix.org/wiki/Qubes/Install > > to list the parameters use qvm-prefs -l debian-8 kernelopts > > To change them do qvm-prefs -s debian-8 kernelopts "nopat ipv6.disable=1" > > Then restart template and vms. > As I pointed out, changing parameters in the template will not affect the VMs. You need to change the option individually for each qube where you want to disable IP6. unman -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20160927213857.GA5446%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
johnyju...@sigaint.org: >> The "listening" services are less of a concern, since the firewall >> wouldn't permit any incoming connections to be passed through to start >> with. It's the "phone home" style services, like time sync, Samba name >> lookups on microsoft servers, and such, that are more concerning, and >> privacy-busting. > > The paranoid part of me (which is about 95% of me) half-suspects that NTP > is actively monitored by the powers that be, to keep tabs on us > security-minded Linux geeks. > > There's been enough major security bugs in NTP, that one must wonder if > they're akin to the heartbleed/rng/SSL/etc. compromises that don't > necessarily look like innocent mistakes. > > Qubes is good at trying to get dom0 to push the time to the VM's by its > own means. And if you set the ClockVM to sys-whonix, say, you remove, or > at least greatly reduce, the ability of TPTB to track your setting your > clock. :) > > However, as mentioned, the default of using NTP time syncing is enabled by > default in the Debian-8 template, which defeats that protection for Debian > Appvms, unless you disable it in the template. Just an oversight, I'm > sure. (No sarcasm, for once.) > > My PC's RT clock might drift by a few seconds each week, if that; I'm not > sure why time synchronization has to be so damn frequent and aggressive. > A red flag for the paranoid. :) > > I have a RS232 GPS dongle that spits out the time with 1-second accuracy > (or atomic-clock level accuracy, if you use the 1-second clock-tick signal > available on one of the chips, which I have done, lol). > > I plan on hooking that up to my Qubes setup in the near future, and > disabling network-based clock sync all together. > > (Until Qubes 4.0 comes out, forces me to upgrade to a newer motherboard > with no RS232 support. :) ) > > Might be a good open-sourced hardware project. I think I've seen some out > there already, although not necessarily integrated smoothly into Qubes. > > Just one more hole to make sure we plug. > > JJ You might find Jake Appelbaum's tlsdate interesting, or Adam Langley's Roughtime. Both are quite a bit more secure than NTP, although tlsdate doesn't work with TLS 1.3, and Roughtime is still a proof of concept. Cheers, -Jeremy -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/6179d0f8-9f5b-5180-70dc-b60aec8c0aae%40airmail.cc. For more options, visit https://groups.google.com/d/optout. signature.asc Description: OpenPGP digital signature
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
> My PC's RT clock might drift by a few seconds each week Actually, it's not even that bad. I'm sure I've fired up motherboards or laptops that haven't been touched in years, and their clocks were accurate within a minute. So there's no need for synchronizing your time so frequently. I just read that NTP apparently adjust the frequency of polling based upon how fast your clock seems to be drifting, which is admirable. http://www.ntp.org/ntpfaq/NTP-s-algo.htm But the poll interface ranges from 64 to 1024 seconds; even at the high end, that seems unnecessarily frequent from the very small amount of clock drift I've experienced. But flipping to a GPS-based source instantly eliminates those concerns. Question: for what purpose do we require super-accurate clocks in the first place? There are some rolling password algorithms based upon time, and certificates handling will get cranky if you're months or years off, but other than that, what is the necessity of keeping a PC within seconds of the correct time? (On tails, when it starts up, it does a time synchronization, claiming it's required for Tor purposes. Anyone know the nature of that?) JJ -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/e9811afeee4015304424657087604877.webmail%40localhost. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
> The "listening" services are less of a concern, since the firewall > wouldn't permit any incoming connections to be passed through to start > with. It's the "phone home" style services, like time sync, Samba name > lookups on microsoft servers, and such, that are more concerning, and > privacy-busting. The paranoid part of me (which is about 95% of me) half-suspects that NTP is actively monitored by the powers that be, to keep tabs on us security-minded Linux geeks. There's been enough major security bugs in NTP, that one must wonder if they're akin to the heartbleed/rng/SSL/etc. compromises that don't necessarily look like innocent mistakes. Qubes is good at trying to get dom0 to push the time to the VM's by its own means. And if you set the ClockVM to sys-whonix, say, you remove, or at least greatly reduce, the ability of TPTB to track your setting your clock. :) However, as mentioned, the default of using NTP time syncing is enabled by default in the Debian-8 template, which defeats that protection for Debian Appvms, unless you disable it in the template. Just an oversight, I'm sure. (No sarcasm, for once.) My PC's RT clock might drift by a few seconds each week, if that; I'm not sure why time synchronization has to be so damn frequent and aggressive. A red flag for the paranoid. :) I have a RS232 GPS dongle that spits out the time with 1-second accuracy (or atomic-clock level accuracy, if you use the 1-second clock-tick signal available on one of the chips, which I have done, lol). I plan on hooking that up to my Qubes setup in the near future, and disabling network-based clock sync all together. (Until Qubes 4.0 comes out, forces me to upgrade to a newer motherboard with no RS232 support. :) ) Might be a good open-sourced hardware project. I think I've seen some out there already, although not necessarily integrated smoothly into Qubes. Just one more hole to make sure we plug. JJ -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/bf7ec94cf1cebb9c873ff1cdb58667bf.webmail%40localhost. For more options, visit https://groups.google.com/d/optout.
Re: [qubes-users] Re: I can't disable ipv6 on Debian Template
> Also just to add qubes devs have fedora template with less listening > process then debian-8 which is not default and more community based. But > if you want to use use debian instead for your sysnet or firewall or w/e. > You can disable all the listening processes yourself. It's an outstanding ticket (among a few other related ones): https://github.com/QubesOS/qubes-issues/issues/1928 As compared to all the other stuff the Qubes devs have on their plates, I assume it's a relatively low priority, since Debian-8 is a bit of an "addon" as compared to Fedora-23, and its easy enough for someone to fix in the template themselves. The "listening" services are less of a concern, since the firewall wouldn't permit any incoming connections to be passed through to start with. It's the "phone home" style services, like time sync, Samba name lookups on microsoft servers, and such, that are more concerning, and privacy-busting. I was not pleased to see the Debian vm, by default, connecting to some microsoft servers for Samba name resolution, lol. Especially when I never use any SMB style naming, nor programs, to start with. Cheers JJ -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/3d3fd84cfffb6a89a3e285ae6981ea3d.webmail%40localhost. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Re: I can't disable ipv6 on Debian Template
Also just to add qubes devs have fedora template with less listening process then debian-8 which is not default and more community based. But if you want to use use debian instead for your sysnet or firewall or w/e. You can disable all the listening processes yourself. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/16724489-4f37-43d2-aa28-e6c68a48cdf9%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[qubes-users] Re: I can't disable ipv6 on Debian Template
On Sunday, September 25, 2016 at 9:46:13 AM UTC-4, nishi...@gmail.com wrote: > Hello, > > I am surprised that there is no way to disable ipv6 on Debian template. > > I reinstalled first the template using documentation > https://www.qubes-os.org/doc/reinstall-template/ > > Then I added "net.ipv6.conf.all.disable_ipv6 = 1" in /etc/sysctl.conf, I did > reboot the Template but it didn't change the outcome, I still had ipv6 ports > opened using "netstat -antp" > > I even added "sudo ip6tables -P INPUT DROP" in "/rw/config/rc.local", but I > still got those distant servers listening when I check using commands like > "sudo lsof -i6" or "netstat -antp" on my Debian Template. > > What is rpcbind, avahi-dae and why you got this ipv6 bound to systemd on PID > 1 ? Looks suspicious, I thought Ipv6 was disabled by default on Qubes. > > Regards You have to change kernel parameters a diff way I believe. try this method from whonix instructions. https://www.whonix.org/wiki/Qubes/Install to list the parameters use qvm-prefs -l debian-8 kernelopts To change them do qvm-prefs -s debian-8 kernelopts "nopat ipv6.disable=1" Then restart template and vms. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/3b7dc079-35be-47c7-a5a3-816ac495d08e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
