Qubes-Whonix Development / Qubes Integration

Patrick · June 25, 2022, 8:04am

Good news for ticket sys-net phones home to fedoraproject.org for captive portal detection · Issue #1814 · QubesOS/qubes-issues · GitHub - to quote myself:

Seems like this fixed itself.

What’s missing is a Qubes openQA test which shows an error should the package NetworkManager-config-connectivity-fedora get re-introduced into the default installation at some point.

Patrick · June 25, 2022, 8:05am

github.com/QubesOS/qubes-issues

document how to route all traffic over Tor / how to disable Qubes default clearnet traffic

opened 07:58AM - 25 Jun 22 UTC

adrelanos

T: enhancement C: doc privacy P: default

### The problem you're addressing For users that desire advanced anonymity, t…here should be no clearnet traffic while performing activities via Tor that require privacy. This is because when the user's internet connection breaks down (usual internet service provider (ISP) issues, network coverage issues, WiFi issues, hardware issues, power loss, ...) then both all clearnet and Tor connections break down at the same time. A passive advanced adversary could correlate anonymous and non-anonymous connections. An active advanced adversary (such as ISP level) could even briefly on purpose disconnect a few users at a time and thereby narrow down which users would loose a clearnet/Tor connection at the same time. That a user is connected anonymously and non-anonymously to the same server is likely nowadays due to internet centralization with very popular services such as Google Analytics almost everywhere, Cloudflare and Amazon AWS data centers to name a few omnipresent points of centralization. This is also documented here: https://www.whonix.org/wiki/DoNot#Use_Clearnet_and_Tor_at_the_Same_Time ### The solution you'd like User documentation on how to disable all Qubes clearnet default traffic. Let's start with this first before considering automation (such as Qubes salt, some button in a GUI, or what else. ### The value to a user, and who that user might be An advanced anonymity feature defeating some attacks by advanced adversaries. ### related * https://github.com/QubesOS/qubes-issues/issues/1948 ### feature request This is a feature request for Qubes core. The ones who might now best are probably the Qubes developers. Could you please list all the places in which Qubes generates default clearnet traffic? Once known, I could document how to disable these. A few coming to mind: * https://github.com/QubesOS/qubes-issues/issues/1814 * Qubes network time synchronization running in sys-net * What else?

Patrick · June 27, 2022, 2:27pm

Patrick · June 28, 2022, 10:48am

Patrick · June 28, 2022, 10:49am

github.com/QubesOS/updates-status

qubes-template-whonix-ws-16 4.0.6-202206270840 (r4.1)

opened 09:16AM - 27 Jun 22 UTC

closed 01:03PM - 13 Jul 22 UTC

qubesos-bot

r4.1-stable

Template whonix-ws-16 4.0.6-202206270840 for Qubes r4.1, see comments below for …details. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload linux-template-builder 4.0.6-202206270840 r4.1 templates-itl vm-whonix-workstation-16 repo` (available 7 days from now) * `Upload linux-template-builder 4.0.6-202206270840 r4.1 templates-community vm-whonix-workstation-16 repo` (available 7 days from now) Above commands will work only if package in testing repository isn't superseded by newer version.

github.com/QubesOS/updates-status

qubes-template-whonix-gw-16 4.0.6-202206270941 (r4.1)

opened 11:56AM - 27 Jun 22 UTC

closed 01:03PM - 13 Jul 22 UTC

qubesos-bot

r4.1-stable

Template whonix-gw-16 4.0.6-202206270941 for Qubes r4.1, see comments below for …details. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload linux-template-builder 4.0.6-202206270941 r4.1 templates-itl vm-whonix-gateway-16 repo` (available 7 days from now) * `Upload linux-template-builder 4.0.6-202206270941 r4.1 templates-community vm-whonix-gateway-16 repo` (available 7 days from now) Above commands will work only if package in testing repository isn't superseded by newer version.

Patrick · July 11, 2022, 8:34am

Stop telling VMs the exact physical CPU model in the computer · Issue #1142 · QubesOS/qubes-issues · GitHub

Patrick · July 13, 2022, 1:03pm

Now in Qubes stable community templates repository.

Patrick · July 13, 2022, 7:08pm

Stop telling VMs the exact physical CPU model in the computer · Issue #1142 · QubesOS/qubes-issues · GitHub

Patrick · August 30, 2022, 11:29am

Patrick · October 1, 2022, 4:12pm

github.com/QubesOS/qubes-issues

Qubes should keep IP forwarding in VMs with the `provides network` (Net Qube) disabled by default

opened 04:10PM - 01 Oct 22 UTC

closed 07:14PM - 01 Oct 22 UTC

adrelanos

T: bug P: default R: not a bug

### Qubes OS release R4.1 ### Brief summary When a VM is has option `pr…ovides network`, Qubes automatically enables IP forwarding. ### Steps to reproduce Enable `provides network` in QVMM. `cat /proc/sys/net/ipv4/ip_forward` ### Expected behavior `0` - IP forwarding disabled. ### Actual behavior `1` - IP forwarding enabled. ### Rationale Instructions to setup Qubes sys-vpn VMs as well as VPN packages are difficult for users to set up. When following [these Qubes VPN instructions](https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/vpn.md) and simply forgetting to edit `/rw/config/rc.local`, the setup does nothing. The user won't be using the VPN. That would result in a leak, in an unexpected connection over clearnet that was expected to be routed over the VPN. Also `/rw/config/rc.local` does not seem to be a safe mechanism to configure such scripts as networking might be up and functional before any scripts run from `/rw/config/rc.local` (firewall, vpn) have completed. Meanwhile, there could be leaks. To avoid leaks, it would be much safer if IP forwarding was disabled by default. Then how could users use some specific things that require it? In these cases, for example in case of above linked instructions, it would be up the these instructions / the scripts to enable IP forwarding should that be required. That documentation / scripts should do so after the firewall has been load. ### Impact on Qubes-Whonix This is primarily a general Qubes bug report. I.e. unspecific to Whonix. The impact on Whonix is currently very little because Whonix explicitly ships a config that disabled IP forwarding as well as systemcheck checks if IP forwarding is disabled and would show a warning if it was accidentally enabled. However for defense in depth, it would be much better if Qubes would stick with Linux's default, which is to have IP forwarding disabled by default.

Patrick · October 1, 2022, 4:16pm

Patrick · October 17, 2022, 11:46am

github.com/QubesOS/updates-status

qubes-template-whonix-gw-16 4.0.6-202210171036 (r4.1)

opened 10:38AM - 17 Oct 22 UTC

closed 03:27PM - 17 Oct 22 UTC

qubesos-bot

r4.1-testing

Template whonix-gw-16 4.0.6-202210171036 for Qubes r4.1, see comments below for …details. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload linux-template-builder 4.0.6-202210171036 r4.1 templates-itl vm-whonix-gateway-16 repo` (available 7 days from now) * `Upload linux-template-builder 4.0.6-202210171036 r4.1 templates-community vm-whonix-gateway-16 repo` (available 7 days from now) Above commands will work only if package in testing repository isn't superseded by newer version.

github.com/QubesOS/updates-status

qubes-template-whonix-ws-16 4.0.6-202210171036 (r4.1)

opened 11:22AM - 17 Oct 22 UTC

closed 03:27PM - 17 Oct 22 UTC

qubesos-bot

Template whonix-ws-16 4.0.6-202210171036 for Qubes r4.1, see comments below for …details. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload linux-template-builder 4.0.6-202210171036 r4.1 templates-itl vm-whonix-workstation-16 repo` (available 7 days from now) * `Upload linux-template-builder 4.0.6-202210171036 r4.1 templates-community vm-whonix-workstation-16 repo` (available 7 days from now) Above commands will work only if package in testing repository isn't superseded by newer version.

Patrick · October 17, 2022, 3:27pm

Build failed: template for vm (4.1 bullseye+whonix-workstation+minimal+no-recommends) · Issue #3018 · QubesOS/build-issues · GitHub

Patrick · October 18, 2022, 5:59pm

https://www.whonix.org/wiki/Dev/Qubes#Official_Builds

Place for build template commands · Issue #566 · QubesOS/updates-status · GitHub
Place for build template commands · Issue #566 · QubesOS/updates-status · GitHub

Patrick · October 19, 2022, 11:37am

Patrick · October 19, 2022, 11:39am

Place for build template commands · Issue #566 · QubesOS/updates-status · GitHub
Place for build template commands · Issue #566 · QubesOS/updates-status · GitHub

Patrick · October 23, 2022, 11:14pm

Place for build template commands · Issue #566 · QubesOS/updates-status · GitHub
Place for build template commands · Issue #566 · QubesOS/updates-status · GitHub

Patrick · October 24, 2022, 3:25pm

Place for build template commands · Issue #566 · QubesOS/updates-status · GitHub
Place for build template commands · Issue #566 · QubesOS/updates-status · GitHub

Patrick · October 25, 2022, 1:12pm

github.com/QubesOS/updates-status

qubes-template-whonix-gw-16 4.0.6-202210241524 (r4.1)

opened 03:25PM - 24 Oct 22 UTC

closed 01:54AM - 19 Nov 22 UTC

qubesos-bot

r4.1-stable

Template whonix-gw-16 4.0.6-202210241524 for Qubes r4.1, see comments below for …details. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload linux-template-builder 4.0.6-202210241524 r4.1 templates-itl vm-whonix-gateway-16 repo` (available 7 days from now) * `Upload linux-template-builder 4.0.6-202210241524 r4.1 templates-community vm-whonix-gateway-16 repo` (available 7 days from now) Above commands will work only if package in testing repository isn't superseded by newer version.

github.com/QubesOS/updates-status

qubes-template-whonix-ws-16 4.0.6-202210241524 (r4.1)

opened 04:27PM - 24 Oct 22 UTC

closed 01:54AM - 19 Nov 22 UTC

qubesos-bot

r4.1-stable

Template whonix-ws-16 4.0.6-202210241524 for Qubes r4.1, see comments below for …details. If you're release manager, you can issue GPG-inline signed command (depending on template): * `Upload linux-template-builder 4.0.6-202210241524 r4.1 templates-itl vm-whonix-workstation-16 repo` (available 7 days from now) * `Upload linux-template-builder 4.0.6-202210241524 r4.1 templates-community vm-whonix-workstation-16 repo` (available 7 days from now) Above commands will work only if package in testing repository isn't superseded by newer version.

Patrick · November 30, 2022, 6:24pm