Qubes VM-sudo → wiki
Draft complete.
Should these instructions (i.e. draft) be combined/generalized with notations for any differences in steps for TemplateVMs?
This would greatly simplify steps. Although, if there are future TemplateVM specific changes in instructions, keeping it like it is now would make sense?
Replacing Password-less root Access with Dom0 User Prompt
Unlike traditional Linux operating systems, Qubes OS installs with a password-less root access by default in all VMs. Some may argue that this is a major security hole – but seeing as all user data is accessible from the user account – there would be no direct benefit for the attacker to to gain root privileges. However, there is nothing prevents a users from modifying their their own systems and enabling user/root isolation in VMs anyways.
Warning: The steps listed here are done so without any guarantee of safety, accuracy or completeness. Proceed at your own risk. Do not rely on this for extra security!
These instructions configure TemplateVMs to prompt Dom0 for all authorization request.
1.In dom0 terminal, add VMAuth service
sudo su
echo "/usr/bin/echo 1" >/etc/qubes-rpc/qubes.VMAuth
Exit from root prompt
exit
2.In dom0 terminal, open qubes.VMAuth in an editor
sudo nano /etc/qubes-rpc/policy/qubes.VMAuth
Add the following text.
$anyvm dom0 ask,default_target=dom0
Save and exit.
Note: If users would like to preserve password-less root access for individual VMs, a second line can be specified with the following text string.
<vm_name> dom0 allow
3.Configure TemplatesVMs to prompt dom0 for any authorization requests
Fedora
In Fedora TemplateVM, edit the system authentication setting
sudo gedit /etc/pam.d/system-auth
Remove all lines that begin with “auth” and replace with the following text.
auth [success=1 default=ignore] pam_exec.so seteuid /usr/lib/qubes/qrexec-client-vm dom0 qubes.VMAuth /bin/grep -q ^1$
auth requisite pam_deny.so
auth required pam_permit.so
Save and exit.
In Fedora TemplateVM, edit sudoers configuration file to require authorization for all requests
sudo gedit /etc/sudoers.d/qubes
Replace the first line with the following text.
user ALL=(ALL) ALL
Save and exit.
In Fedora TemplateVM, disable POlKit default-allow behavior
sudo rm /etc/polkit-1/rules.d/00-qubes-allow-all.rules
sudo rm /etc/polkit-1/localauthority/50-local.d/qubes-allow-all.pkla
Debian
In Debian TemplateVM, edit system authentication settings
sudo nano /etc/pam.d/common-auth
Remove all lines that begin with “auth” and replace with the following text.
auth [success=1 default=ignore] pam_exec.so seteuid /usr/lib/qubes/qrexec-client-vm dom0 qubes.VMAuth /bin/grep -q ^1$
auth requisite pam_deny.so
auth required pam_permit.so
Save and exit.
In Debian TemplateVM, edit sudoers configuration file to require authorization for all requests
sudo nano /etc/sudoers.d/qubes
Replace the first line with the following text
user ALL=(ALL) ALL
Save and exit.
In Debian TemplateVM, disable PolKit default-allow behavior
sudo rm /etc/polkit-1/rules.d/00-qubes-allow-all.rules
sudo rm /etc/polkit-1/localauthority/50-local.d/qubes-allow-all.pkla
In Debian TemplateVM, comment out the configuration line that allows root to su without password
sudo nano /etc/pam.d/su
Users should comment out (#) the following line
auth sufficient pam_rootok.so
Whonix
Note: Whonix users must complete steps in both whonix-ws and whonix-gw TemplateVMs
In Whonix TemplateVM, edit system authentication settings
sudo nano /etc/pam.d/common-auth
Remove all lines that begin with “auth” and replace with the following text.
auth [success=1 default=ignore] pam_exec.so seteuid /usr/lib/qubes/qrexec-client-vm dom0 qubes.VMAuth /bin/grep -q ^1$
auth requisite pam_deny.so
auth required pam_permit.so
Save and exit.
In Whonix TemplateVM, edit sudoers configuration file to require authorization for all requests
sudo nano /etc/sudoers.d/qubes
Replace the first line with the following text
user ALL=(ALL) ALL
Save and exit.
In Whonix TemplateVM, disable PolKit default-allow behavior
sudo rm /etc/polkit-1/rules.d/00-qubes-allow-all.rules
sudo rm /etc/polkit-1/localauthority/50-local.d/qubes-allow-all.pkla
In Whonix TemplateVM, comment out the configuration line that allows root to su without password
sudo nano /etc/pam.d/su
Users should comment out (#) the following line
auth sufficient pam_rootok.so
Note: If prompts appear when Whonix VMs are booting, users can create a configuration file to restore the VM to default passwork-less root access.
In Whonix TemplateVM, restore default VM operation (Only neccessary if prompts appear during boot)
sudo nano /etc/sudoers.d/zz99
Cut and paste the following lines into the new file
ALL ALL=NOPASSWD: /usr/sbin/virt-what
ALL ALL=NOPASSWD: /usr/sbin/service whonixcheck restart
ALL ALL=NOPASSWD: /usr/sbin/service whonixcheck start
ALL ALL=NOPASSWD: /usr/sbin/service whonixcheck stop
ALL ALL=NOPASSWD: /usr/sbin/service whonixcheck status
