diff --git a/opsec/qubesos/Screenshot From 2024-12-05 11-20-03.png b/opsec/qubesos/Screenshot From 2024-12-05 11-20-03.png new file mode 100755 index 0000000..bf8b0bd Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 11-20-03.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-26-38.png b/opsec/qubesos/Screenshot From 2024-12-05 16-26-38.png new file mode 100755 index 0000000..654e797 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-26-38.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-28-18.png b/opsec/qubesos/Screenshot From 2024-12-05 16-28-18.png new file mode 100755 index 0000000..f3b26a4 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-28-18.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-28-40.png b/opsec/qubesos/Screenshot From 2024-12-05 16-28-40.png new file mode 100755 index 0000000..c79d696 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-28-40.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-28-51.png b/opsec/qubesos/Screenshot From 2024-12-05 16-28-51.png new file mode 100755 index 0000000..c4ca101 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-28-51.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-00.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-00.png new file mode 100755 index 0000000..118f501 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-00.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-12.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-12.png new file mode 100755 index 0000000..7b16d78 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-12.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-23.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-23.png new file mode 100755 index 0000000..c506d67 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-23.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-33.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-33.png new file mode 100755 index 0000000..f49f169 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-33.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-47.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-47.png new file mode 100755 index 0000000..00e187e Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-47.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-29-57.png b/opsec/qubesos/Screenshot From 2024-12-05 16-29-57.png new file mode 100755 index 0000000..d3076b7 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-29-57.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-39-09.png b/opsec/qubesos/Screenshot From 2024-12-05 16-39-09.png new file mode 100755 index 0000000..c909ba0 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-39-09.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-39-27.png b/opsec/qubesos/Screenshot From 2024-12-05 16-39-27.png new file mode 100755 index 0000000..73db770 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-39-27.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-39-44.png b/opsec/qubesos/Screenshot From 2024-12-05 16-39-44.png new file mode 100755 index 0000000..a0d85dc Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-39-44.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-40-07.png b/opsec/qubesos/Screenshot From 2024-12-05 16-40-07.png new file mode 100755 index 0000000..3dd7659 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-40-07.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-40-34.png b/opsec/qubesos/Screenshot From 2024-12-05 16-40-34.png new file mode 100755 index 0000000..b226154 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-40-34.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 16-40-42.png b/opsec/qubesos/Screenshot From 2024-12-05 16-40-42.png new file mode 100755 index 0000000..96bbd6f Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 16-40-42.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 17-40-25.png b/opsec/qubesos/Screenshot From 2024-12-05 17-40-25.png new file mode 100755 index 0000000..0dbf425 Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 17-40-25.png differ diff --git a/opsec/qubesos/Screenshot From 2024-12-05 17-40-39.png b/opsec/qubesos/Screenshot From 2024-12-05 17-40-39.png new file mode 100755 index 0000000..4a07d9b Binary files /dev/null and b/opsec/qubesos/Screenshot From 2024-12-05 17-40-39.png differ diff --git a/opsec/qubesos/index.html b/opsec/qubesos/index.html new file mode 100644 index 0000000..b28b796 --- /dev/null +++ b/opsec/qubesos/index.html @@ -0,0 +1,223 @@ + + + + + + + + + + + Qubes OS guide + + + + + + + + + + + + + + + + + + + +
+
+
+ + The Nihilism Blog +
+
+ +
+ +
+
+ + + +
+
+
+
+ Previous Page

nihilist - 00 / 00 / 00

+

Qubes OS guide

+

Official site of Qubes OS https://www.qubes-os.org

+

When you land into this tutorial, I assume you already have some Linux experience, if not this might not be suitable for you, since Qubes OS is not very user friendly. I recommend you to try some normal Linux distribution first https://blog.nowhere.moe/opsec/linux/index.html

+

Qubes OS is a very cutting edge OS that uses virtualization everywhere to compartmentalize your digital life. It is technically not a Linux distribution, it is built on Xen which is a type 1 hypervisor that runs bare metal, https://en.wikipedia.org/wiki/Xen

+

First you have Xen hypervisor booted at startup, then you get separate VM for all of your activities. Because all of your activities are separated by VM, one of them get hacked will not compromise the security of your entire system. It is like manage your personal pc like a server, that is why Qubes OS is a highly secure OS if used correctly

+

If you want to dive into the tech details and concepts about Qubes, official document is the best place https://www.qubes-os.org/intro/

+
+
+
+
+ + +
+
+
+
+

Comparison

+

Why you should use Qubes OS instead of xyz config I use?

+

1.Easier network configuration

+

Qubes OS is designed to have a basket of differnt VMs with different trust level, and has a very easy menu in GUI method to manage the network of these VMs. Qubes OS also has built-in firewall function to stop unexpected leaks. In short, it is less likely for you to make mistakes in Qubes

+

For example if you want to have many different network configs like below link to satisfy your different online identities, Qubes OS is the right tool.

+

https://blog.nowhere.moe/opsec/internetsegmentation/index.html. Check this theory about online identities, with Qubes OS you can easily build up chains of vm for doing whatever you want, for example different combination of vpn/proxy/tor

+ +

A image that shows Qubes OS with different vm for different functions and identities

+ +

2.Integrated Whonix

+

Qubes OS integrate whonix gateway and workstation by default, tor browser works out of the box. You can also use whonix gateway to torrify applications that do not support tor and it is leak proof. You can achieve all of these with some clicks of buttons, and no complicated iptables needed

+

For learning what is whonix https://www.whonix.org/wiki/FAQ

+

3.Superior safety

+

Xen is a hypervisor that has a much smaller code than vmware/virtual box/kvm, it is possible to read and audit the entire code base. Besides qubes OS also put networking and usb service stack into VM, this feature greatly increases your host OS security from malicious network and usb. The days when you just plugin a bad usb into your computer and it booms are gone!

+ +
+
+
+
+ +
+
+
+
+

Installation preparation



+

If you decided to install and try Qubes OS, then you must pick the correct hardware, since Qubes OS is a very cutting edge OS you should expect some compatibility issues.

+

For desktop PC actually you should not worry too much, I have installed Qubes OS on many intel/amd platforms, with all kinds of peculiar combination of cpu and gpu, it all works. As long as you are on a quite modern platform with common consumer gpu, you should be fine

+

This is the official hardware compatibility list, but be aware it is definitely incomplete, since people runs Qubes OS without problem mostly do not bother to report their config https://www.qubes-os.org/hcl/

+

For laptops you should be careful, you better get a mainstream business laptop. I tried many installation on lenovo or hp business laptops from recent years, they all worked fine. However you should especially try to avoid laptops from non-traditional vendors like Xiaomi or whatever Chinese brand, and any gaming laptop with very peculiar gpu setup.

+

Next thing is to download the installation ISO, go to their website and download

+ +

Download the ISO and hash digest

+

Next thing is to verify your ISO file is authentic, Qubes OS has a very detailed guide on how to do that so there is no need for me to build the wheel again https://www.qubes-os.org/security/verifying-signatures/

+

I will paste the master key fingerprint here for comparison:427F11FD0FAA4B080123F01CDDFA1A3E36879494

+ +

Next step is to find a usb, make sure it is at least 16GB, then find its path

+ +

+$ sudo blkid	
+
+ +

For example my usb is located at /dev/sda, then we use dd to burn the image into usb

+

+$ sudo dd if= of=/dev/sda status=progress
+
+

Warning: dd is a low level too aka data destroyer, check the input parameters carefully and make sure "of" points towards your usb, otherwise it might nuke your computer !!!

+
+
+
+
+ + + +
+
+
+
+

Install



+

Next thing is to reboot into your computer and BIOS(EFI), this is different for every platform so you should find it out on google.

+

You need to make two changes in BIOS basically, first you need to turn off secure boot(I know this is sad), but unfortunately secure boot and Xen did not work together on most consumer grade machines. I personally recommends only use qubes at home pc, or those so called "Qubes certified" laptops equipped with heads(What is header -> https://trmm.net/Heads/) that can protect your boot partition and has anti evil maid features https://www.qubes-os.org/doc/certified-hardware/.

+

Next if you are on UEFI mode you need to enable "CSM". https://superuser.com/questions/1284392/what-exactly-is-uefi-with-csm-boot-mode. You also need to find that in your bios menu, it should usually appear below boot options. This can fix a lot of potential troubles later

+

Final thing is remember to turn on vt-x or cpu virtualization support, since this is needed for Qubes. Check your bios, if there is a setting called IOMMU, you also need to enable that

+

Finally, reboot and choose your usb as a boot device

+ +

If things worked correctly, you should see a menu like this, just click enter and wait

+ +

At this step, click "continue", if your computer is fully compatible and all bios settings are correct, you should see no warning message, otherwise go back to check bios again. If your computer is not some ancient stuff if should be compatible

+ +

At this step you need to config the disk, click the installation destination

+ +

If you are installing on a fresh drive just check the three areas on the pictures

+ +

Next is to choose a disk encryption password, notice this is the password used to encrypt your disk and is the only thing protects you when FBI kicks your door, so make sure it is strong enough

+ +

Select "delete all" and "reclaim space", make sure you backed up everything!

+ +

Next create a user with password, this is the password you will use to unlock the screen

+ +

Next choose "Begin Installation", and just wait until it is completed.

+
+
+
+
+ +
+
+
+
+

Post Install Setup



+

You still cannot use your qubes at this step, since you need to run post install setup.

+ +

These configs in most situation do not need to be changed, however if you are using wired connection you can make sys-net disposable, this increases your security a little bit.

+

If you are using wireless network through a usb dongle you might need to choose "Use sys-net qube for both networking and USB devices"

+

You can also enable system and template update over tor, but this will become significantly slower for big updates. And there is no need to touch the advanced configuration.

+

Click done and let the scripts run, do not interrupt it by closing your computer

+ +

And finally we get our Qubes

+
+
+
+
+ + + + +
+
+
+
+

PrismBreaker

+

+ Shatter the big brother.



Creative Commons Zero: No Rights Reserved
+ +

+
+ +
+

My Links

+

+ + RSS Feed
SimpleX Chat
+ +

+
+ +
+

About nihilist

+

Donate XMR: 87iB34vdFvNULrAjyfVAZ7jMXc8vbq9tLGMLjo6WC8N9Xo2JFaa8Vkp6dwXBt8rK12Xpz5z1rTa9jSfgyRbNNjswHKTzFVh


Contact: prismbreaker@waifu.club (PGP)

+
+ +
+ +
+
+ + + + + + + + + diff --git a/opsec/qubesos/qubes-trust-level-architecture.png b/opsec/qubesos/qubes-trust-level-architecture.png new file mode 100644 index 0000000..61950c5 Binary files /dev/null and b/opsec/qubesos/qubes-trust-level-architecture.png differ