Previous Page

Prism Breaker - 20 / 12 / 2024

Qubes OS guide

Official site of Qubes OS https://www.qubes-os.org

When you land into this tutorial, I assume you already have some Linux experience, if not this might not be suitable for you, since Qubes OS is not very user-friendly. I recommend you to try some normal Linux distribution first How to Install Linux as a beginner

Qubes OS is a very cutting edge OS that uses virtualization everywhere to compartmentalize your digital life. It is technically not a Linux distribution, it is built on Xen which is a type 1 hypervisor that runs on bare metal, https://en.wikipedia.org/wiki/Xen

First you have Xen hypervisor booted at startup, then you get separate VM for all of your activities. Because all of your activities are separated by VM, one of them get hacked will not compromise the security of your entire system. It is like manage your personal pc like a server, that is why Qubes OS is a highly secure OS if used correctly

If you want to dive into the tech details and concepts about Qubes, official document is the best place https://www.qubes-os.org/intro/

Sidenote: Help us improve this tutorial by letting us know if there's anything missing or incorrect on this git issue directly!

Comparison

Why you should use Qubes OS instead of xyz config I use?

1.Easier network configuration

Qubes OS is designed to have a basket of different VMs with different trust level, and has a very easy menu in GUI to manage the network of these VMs. Qubes OS also has built-in firewall function to stop unexpected leaks. In short, it is less likely for you to make mistakes in Qubes

For example if you want to have many different network configs like below link to satisfy your different online identities, Qubes OS is the right tool.

Theories about building up your online identities. Check this theory about online identities, with Qubes OS you can easily build up chains of vm for doing whatever you want, for example different combination of vpn/proxy/tor

A image that shows Qubes OS with different vm for different functions and identities

2.Integrated Whonix

Qubes OS integrate whonix gateway and workstation by default, thus tor browser works out of the box. You can also use whonix gateway to torrify applications that do not support tor and be guaranteed it is leakproof. You can achieve all of these with some clicks of buttons, and no complicated iptables needed

For learning what is whonix https://www.whonix.org/wiki/FAQ

3.Superior safety

Xen is a hypervisor that has a much smaller codebase than vmware/virtual box/kvm, it is possible to read and audit the entire code base. Besides qubes OS also put networking and usb service stack into VM, this feature greatly increases your host OS security from malicious network and usb. The days when you just plug in a bad usb into your computer and it booms are gone!

Installation preparation

If you decided to install and try Qubes OS, then you must pick the correct hardware, since Qubes OS is a very cutting edge OS you should expect some compatibility issues.

For desktop PC actually you should not worry too much, I have installed Qubes OS on many intel/amd platforms, with all kinds of peculiar combination of cpu and gpu, it all works. As long as you are on a quite modern platform with common consumer gpu, you should be fine

This is the official hardware compatibility list, but be aware it is definitely incomplete, since people runs Qubes OS without problem mostly do not bother to report their config https://www.qubes-os.org/hcl/

For laptops, you should be careful, you better get a mainstream business laptop. I tried many installations on Lenovo or hp business laptops from recent years, they all worked fine. However, you should especially try to avoid laptops from non-traditional vendors like Xiaomi or whatever Chinese brand, and any gaming laptop with very peculiar gpu setup.

Next thing is to download the installation ISO, go to their website and download

Download the ISO and hash digest

Next thing is to verify your ISO file is authentic, Qubes OS has a very detailed guide on how to do that so there is no need for me to build the wheel again https://www.qubes-os.org/security/verifying-signatures/

I will paste the master key fingerprint here for comparison:427F11FD0FAA4B080123F01CDDFA1A3E36879494

Next step is to find an usb, make sure it is at least 16GB, then find its path

$ sudo blkid	

For example my usb is located at /dev/sda, then we use dd to burn the image into usb

$ sudo dd if=file_name.iso of=/dev/sda status=progress

Warning: dd is a low level tool aka data destroyer, check the parameters carefully and make sure parameters behind "of" points towards your usb, otherwise it might nuke your computer !!!

Install

Next thing is to reboot into your computer and enter BIOS(EFI), this is different for every platform so you should find it out on google.

You need to make two changes in BIOS basically, first you need to turn off secure boot(I know this is sad), but unfortunately secure boot and Xen did not work together on most consumer grade machines. I personally recommend only use qubes at home pc, or those so called "Qubes certified" laptops equipped with heads(What is heads : https://trmm.net/Heads/) that can protect your boot partition and has anti-evil maid features https://www.qubes-os.org/doc/certified-hardware/.

Next if you are on UEFI mode you need to enable "CSM". https://superuser.com/questions/1284392/what-exactly-is-uefi-with-csm-boot-mode. You also need to find that in your bios menu, it should usually appear below boot options. This can fix a lot of potential troubles later

Final thing is remembering to turn on vt-x or cpu virtualization support, since this is needed for Qubes. Check your bios, if there is a setting called IOMMU, you also need to enable that

For example, you can expect something look like this

Finally, reboot and choose your usb as a boot device

If things worked correctly, you should see a menu like this, just click enter and wait

At this step, click "continue", if your computer is fully compatible and all bios settings are correct, you should see no warning message, otherwise go back to check bios again. If your computer is not some ancient stuff it should be compatible

At this step you need to config the disk, click the installation destination

If you are installing on a fresh drive just check the three areas on the pictures

Next is to choose a disk encryption password, notice this is the password used to encrypt your disk and is the only thing protects you when FBI kicks your door, so make sure it is strong enough

Select "delete all" and "reclaim space", make sure you backed up everything!

Next create a user with password, this is the password you will use to unlock the screen

Next choose "Begin Installation", and just wait until it is completed.

Post Install Setup

You still cannot use your qubes at this step, since you need to run post install setup.

These configs in most situation do not need to be changed, however if you are using wired connection you can make sys-net disposable, this increases your security a little bit.

If you are using wireless network through a usb dongle you might need to choose "Use sys-net qube for both networking and USB devices"

You can also enable system and template update over tor, but this will make it significantly slower for big updates. And there is no need to touch the advanced configuration.

Click done and let the scripts run, do not interrupt it by closing your computer, it might seem unresponsive for a while.

And finally we get our Qubes, in next tutorial we will start to compartmentalize our online activities by creating different qubes.

Next tutorial : How to use qubes for different online activities