Qubes-Whonix 14.0.0.7.9 TemplateVMs for R3.2 and R4 -- Testers Wanted!

[Patrick]

Qubes/Install/Testing

[iry]

Step 2.1:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-core-admin-addon-whonix

Complains that there is no match. Is this Qubes 4.0 only?

[iry]

I ignored the problem in Step 2.1 and went on:

Step 2.2

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-release

Says Skip one package as it is already installed. However, there is no [qubes-templates-itl-testing] section, and no /etc/yum.repos.d/qubes-templates.repo.rpmnew.

---

Note: I was testing on Qubes 3.2

[iry]

Says Skip one package as it is already installed. However, there is no [qubes-templates-itl-testing] section, and no /etc/yum.repos.d/qubes-templates.repo.rpmnew .

Fixed by running sudo qubes-dom0-update

[iry]

Step 4:

sudo qubesctl state.sls qvm.anon-whonix

I executed it once without deleting the existing sys-whonix, and the existing sys-whonix remained unchanged. Then I deleted sys-whonix and executed the command again. I got a brand new sys-whonix.

[iry]

Note: I need to manually configure the templates whonix-gw-14 and whonix-ws-14 to use sys-whonix as NetVM. Since it’s been documented, https://www.whonix.org/wiki/Qubes/Update, I think it’s fair.

[Patrick]

iry:

Step 2.1:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-core-admin-addon-whonix

Complains that there is no match. Is this Qubes 4.0 only?

Yes. Documentation updated.

[iry]

I didn’t set sys-whonix as my UpdateVM/ClockVM/netVM, however, sys-whonix is auto-started at every boot of Qubes now.

Is this the expected default behavior? People argues that https://github.com/QubesOS/qubes-issues/issues/3554:

This can weaken the anonymity, if one connects automatically to different Networks with the same sys-whonix VM because of the same entry guards.

To disable the auto-start:

1. In Qubes Manager, open the VM settings for sys-net.
2. Deselect “Start VM automatically on boot”.
3. Click “OK”.
4. Reboot the whole system.

[Patrick]

iry:

I ignored the problem in Step 2.1 and went on:

Step 2.2

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-release

Says Skip one package as it is already installed. However, there is no [qubes-templates-itl-testing] section, and no /etc/yum.repos.d/qubes-templates.repo.rpmnew.

---

Note: I was testing on Qubes 3.2

[quote=“iry, post:3, topic:5529”]
Says Skip one package as it is already installed. However, there is
no [qubes-templates-itl-testing] section, and no
/etc/yum.repos.d/qubes-templates.repo.rpmnew .
[/quote]

Fixed by running sudo qubes-dom0-update

Alright, can’t explain this but I added to the very top:

Update Qubes dom0. sudo qubes-dom0-update

Can’t be wrong to update Qubes before anything else.

[Patrick]

iry:

Note: I need to manually configure the templates whonix-gw-14 and whonix-ws-14 to use sys-whonix as NetVM. Since it’s been documented, https://www.whonix.org/wiki/Qubes/Update, I think it’s fair.

Yes. Anyhow I guess it will generate a ton of confusion. Usability issue
on Qubes R3.2. The proper way to fix this would be the following but not
sure if realistic to happen:

Issue: backport versioned Whonix template names from Qubes R4 to Qubes R3.2

[Patrick]

iry:

I didn’t set sys-whonix as my UpdateVM/ClockVM/netVM, however, sys-whonix is auto-started at every boot of Qubes now.

Is this the expected default behavior?

Expected.

QubesOS/qubes-mgmt-salt-dom0-virtual-machines/blob/master/qvm/sys-whonix.sls#L35

People argues that https://github.com/QubesOS/qubes-issues/issues/3554

This can weaken the anonymity, if one connects automatically to different Networks with the same sys-whonix VM because of the same entry guards.

Reference: https://www.whonix.org/wiki/Tor#Entry_Guards