mirror of
https://github.com/Qubes-Community/Contents.git
synced 2024-12-23 06:09:29 -05:00
merge master in new_temlates
This commit is contained in:
Anastasia Cotorobai
commit
5b67208494
@ -53,10 +53,3 @@ This applies also to any TemplateBasedVM relative to its parent TemplateVM, but
|
||||
|
||||
Credit: [Joanna Rutkovska](https://twitter.com/rootkovska/status/832571372085850112)
|
||||
|
||||
|
||||
Trim for standalone AppVMs
|
||||
---------------------
|
||||
The `qvm-trim-template` command is not available for a standalone AppVM.
|
||||
|
||||
It is still possible to trim the AppVM disks by using the `fstrim --all` command from the appvm.
|
||||
You can also add the `discard` option to the mount line in `/etc/fstab` inside the standalone AppVM if you want trimming to be performed automatically, but there may be a performance impact on writes and deletes.
|
||||
|
||||
@ -148,15 +148,9 @@ There are multiple ways to create a Kali Linux VM:
|
||||
[user@kali ~]$ sudo apt-get dist-upgrade
|
||||
[user@kali ~]$ sudo apt-get autoremove
|
||||
|
||||
8. Shutdown and trim `kali` template
|
||||
8. Shut down `kali` template
|
||||
|
||||
- Shutdown `kali` template
|
||||
|
||||
[user@kali ~]$ sudo shutdown -h now
|
||||
|
||||
- In `dom0` console:
|
||||
|
||||
[user@dom0 ~]$ qvm-trim-template kali
|
||||
[user@kali ~]$ sudo shutdown -h now
|
||||
|
||||
9. Start image
|
||||
|
||||
@ -285,10 +279,9 @@ These instructions will show you how to upgrade a Debian TemplateVM to Kali Linu
|
||||
[user@kali-rolling ~]$ sudo apt-get dist-upgrade
|
||||
[user@kali-rolling ~]$ sudo apt-get autoremove
|
||||
|
||||
9. Shut down and trim the new template.
|
||||
9. Shut down the new template.
|
||||
|
||||
[user@dom0 ~]$ qvm-shutdown kali-rolling
|
||||
[user@dom0 ~]$ qvm-trim-template kali-rolling
|
||||
|
||||
10. Ensure a terminal can be opened in the new template.
|
||||
|
||||
|
||||
@ -7,6 +7,11 @@ redirect_from:
|
||||
- /en/doc/windows-appvms/
|
||||
- /doc/WindowsAppVms/
|
||||
- /wiki/WindowsAppVms/
|
||||
- /doc/windows-tools-3/
|
||||
- /en/doc/windows-tools-3/
|
||||
- /doc/WindowsTools3/
|
||||
- /doc/WindowsTools/
|
||||
- /wiki/WindowsTools/
|
||||
---
|
||||
|
||||
Qubes Windows Tools
|
||||
@ -153,6 +158,102 @@ Then, periodically check for updates in the Template VM and the changes will be
|
||||
Once the template has been created and installed it is easy to create AppVMs based on it:
|
||||
|
||||
~~~
|
||||
qvm-create --hvm <new windows appvm name> --template <name of template vm> --label <label color>
|
||||
qvm-create --property virt_mode=hvm <new windows appvm name> --template <name of template vm> --label <label color>
|
||||
~~~
|
||||
|
||||
Components
|
||||
----------
|
||||
|
||||
Qubes Windows Tools (QWT for short) contain several components than can be enabled or disabled during installation:
|
||||
|
||||
- Shared components (required): common libraries used by QWT components.
|
||||
- Xen PV drivers: drivers for the virtual hardware exposed by Xen.
|
||||
- Base Xen PV Drivers (required): paravirtual bus and interface drivers.
|
||||
- Xen PV Disk Drivers: paravirtual storage drivers.
|
||||
- Xen PV Network Drivers: paravirtual network drivers.
|
||||
- Qubes Core Agent: qrexec agent and services. Needed for proper integration with Qubes.
|
||||
- Move user profiles: user profile directory (c:\users) is moved to VM's private disk backed by private.img file in dom0 (useful mainly for HVM templates).
|
||||
- Qubes GUI Agent: video driver and gui agent that enable seamless showing of Windows applications on the secure Qubes desktop.
|
||||
- Disable UAC: User Account Control may interfere with QWT and doesn't really provide any additional benefits in Qubes environment.
|
||||
|
||||
**In testing VMs only** it's probably a good idea to install a VNC server before installing QWT. If something goes very wrong with the Qubes gui agent, a VNC server should still allow access to the OS.
|
||||
|
||||
**NOTE**: Xen PV disk drivers are not installed by default. This is because they seem to cause problems (BSOD = Blue Screen Of Death). We're working with upstream devs to fix this. *However*, the BSOD seems to only occur after the first boot and everything works fine after that. **Enable the drivers at your own risk** of course, but we welcome reports of success/failure in any case (backup your VM first!). With disk PV drivers absent `qvm-block` will not work for the VM, but you can still use standard Qubes inter-VM file copying mechanisms.
|
||||
|
||||
Xen PV driver components may display a message box asking for reboot during installation -- it's safe to ignore them and defer the reboot.
|
||||
|
||||
Installation logs
|
||||
-----------------
|
||||
|
||||
If the install process fails or something goes wrong during it, include the installation logs in your bug report. They are created in the `%TEMP%` directory, by default `<user profile>\AppData\Local\Temp`. There are two text files, one small and one big, with names starting with `Qubes_Windows_Tools`.
|
||||
|
||||
Uninstalling QWT is supported from version 3.2.1. Uninstalling previous versions is **not recommended**.
|
||||
After uninstalling you need to manually enable the DHCP Client Windows service, or set IP settings yourself to restore network access.
|
||||
|
||||
Configuration
|
||||
-------------
|
||||
|
||||
Starting from version 2.2.\* various aspects of Qubes Windows Tools can be configured through registry. Main configuration key is located in `HKEY_LOCAL_MACHINE\SOFTWARE\Invisible Things Lab\Qubes Tools`. Configuration values set on this level are global to all QWT components. It's possible to override global values with component-specific keys, this is useful mainly for setting log verbosity for troubleshooting. Possible configuration values are:
|
||||
|
||||
|**Name**|**Type**|**Description**|**Default value**|
|
||||
|:-------|:-------|:--------------|:----------------|
|
||||
|LogDir|String|Directory where logs are created|c:\\Program Files\\Invisible Things Lab\\Qubes Tools\\log|
|
||||
|LogLevel|DWORD|Log verbosity (see below)|2 (INFO)|
|
||||
|LogRetention|DWORD|Maximum age of log files (in seconds), older logs are automatically deleted|604800 (7 days)|
|
||||
|
||||
Possible log levels:
|
||||
|
||||
||
|
||||
|1|Error|Serious errors that most likely cause irrecoverable failures|
|
||||
|2|Warning|Unexpected but non-fatal events|
|
||||
|3|Info|Useful information (default)|
|
||||
|4|Debug|Internal state dumps for troubleshooting|
|
||||
|5|Verbose|Trace most function calls|
|
||||
|
||||
Debug and Verbose levels can generate large volume of logs and are intended for development/troubleshooting only.
|
||||
|
||||
To override global settings for a specific component, create a new key under the root key mentioned above and name it as the executable name, without `.exe` extension. For example, to change qrexec-agent's log level to Debug, set it like this:
|
||||
|
||||
|
||||
|
||||
Component-specific settings currently available:
|
||||
|
||||
|**Component**|**Setting**|**Type**|**Description**|**Default value**|
|
||||
|:------------|:----------|:-------|:--------------|:----------------|
|
||||
|qga|DisableCursor|DWORD|Disable cursor in the VM. Useful for integration with Qubes desktop so you don't see two cursors. Can be disabled if you plan to use the VM through a remote desktop connection of some sort. Needs gui agent restart to apply change (locking OS/logoff should be enough since qga is restarted on desktop change).|1|
|
||||
|
||||
Troubleshooting
|
||||
---------------
|
||||
|
||||
If the VM is inaccessible (doesn't respond to qrexec commands, gui is not functioning), try to boot it in safe mode:
|
||||
|
||||
- `qvm-start --debug vmname`
|
||||
- mash F8 on the boot screen to enable boot options and select Safe Mode (optionally with networking)
|
||||
|
||||
Safe Mode should at least give you access to logs (see above).
|
||||
|
||||
**Please include appropriate logs when reporting bugs/problems.** Starting from version 2.4.2 logs contain QWT version, but if you're using an earlier version be sure to mention which one. If the OS crashes (BSOD) please include the BSOD code and parameters in your bug report. The BSOD screen should be visible if you run the VM in debug mode (`qvm-start --debug vmname`). If it's not visible or the VM reboots automatically, try to start Windows in safe mode (see above) and 1) disable automatic restart on BSOD (Control Panel - System - Advanced system settings - Advanced - Startup and recovery), 2) check the system event log for BSOD events. If you can, send the `memory.dmp` dump file from c:\Windows.
|
||||
Xen logs (/var/log/xen/console/guest-*) are also useful as they contain pvdrivers diagnostic output.
|
||||
|
||||
If a specific component is malfunctioning, you can increase its log verbosity as explained above to get more troubleshooting information. Below is a list of components:
|
||||
|
||||
||
|
||||
|qrexec-agent|Responsible for most communication with Qubes (dom0 and other domains), secure clipboard, file copying, qrexec services.|
|
||||
|qrexec-wrapper|Helper executable that's responsible for launching qrexec services, handling their I/O and vchan communication.|
|
||||
|qrexec-client-vm|Used for communications by the qrexec protocol.|
|
||||
|qga|Gui agent.|
|
||||
|QgaWatchdog|Service that monitors session/desktop changes (logon/logoff/locking/UAC...) and simulates SAS sequence (ctrl-alt-del).|
|
||||
|qubesdb-daemon|Service for accessing Qubes configuration database.|
|
||||
|network-setup|Service that sets up network parameters according to VM's configuration.|
|
||||
|prepare-volume|Utility that initializes and formats the disk backed by `private.img` file. It's registered to run on next system boot during QWT setup, if that feature is selected (it can't run *during* the setup because Xen block device drivers are not yet active). It in turn registers move-profiles (see below) to run at early boot.|
|
||||
|relocate-dir|Utility that moves user profiles directory to the private disk. It's registered as an early boot native executable (similar to chkdsk) so it can run before any profile files are opened by some other process. Its log is in a fixed location: `c:\move-profiles.log` (it can't use our common logger library so none of the log settings apply).|
|
||||
|
||||
Updates
|
||||
-------
|
||||
|
||||
When we publish new QWT version (which is announced on `qubes-users` Google Group) it's usually pushed to the `current-testing` or `unstable` repository first. To use versions from current-testing, run this in dom0:
|
||||
|
||||
`qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-windows-tools`
|
||||
|
||||
That command will download a new QWT .iso from the testing repository. It goes without saying that you should **backup your VMs** before installing anything from testing repos.
|
||||
|
||||
|
||||
@ -82,6 +82,13 @@ Note however that you are better off creating a new Windows VM to benefit from t
|
||||
Windows VM installation
|
||||
-----------------------
|
||||
|
||||
### qvm-create-windows-qube ###
|
||||
|
||||
An unofficial, third-party tool for automating this process is available [here](https://github.com/crazyqube/qvm-create-windows-qube).
|
||||
(Please note that this tool has not been reviewed by the Qubes OS Project.
|
||||
Use it at your own risk.)
|
||||
However, if you are an expert or want to do it manually you may continue below.
|
||||
|
||||
### Summary ###
|
||||
|
||||
~~~
|
||||
@ -162,7 +169,7 @@ To avoid that error we temporarily have to switch the video adapter to 'cirrus':
|
||||
qvm-features win7new video-model cirrus
|
||||
~~~
|
||||
|
||||
The VM is now ready to be started; the best practice is to use an installation ISO [located in a VM](/doc/hvm/#installing-an-os-in-an-hvm-qube):
|
||||
The VM is now ready to be started; the best practice is to use an installation ISO [located in a VM](/doc/standalone-and-hvm/#installing-an-os-in-an-hvm):
|
||||
|
||||
~~~
|
||||
qvm-start --cdrom=untrusted:/home/user/windows_install.iso win7new
|
||||
@ -189,7 +196,7 @@ qvm-prefs win7new memory 2048
|
||||
qvm-prefs win7new maxmem 2048
|
||||
~~~
|
||||
|
||||
Revert to the standard VGA adapter :
|
||||
Revert to the standard VGA adapter: the 'cirrus' adapter will limit the maximum screen resolution to 1024x768 pixels, while the default VGA adapter allows for much higher resolutions (up to 2560x1600 pixels).
|
||||
|
||||
~~~
|
||||
qvm-features --unset win7new video-model
|
||||
|
||||
@ -67,26 +67,29 @@ Optional Preparation Steps
|
||||
[minimal Fedora template][FedoraMinimal]. Get it if you haven't already done
|
||||
so:
|
||||
|
||||
[user@dom0 ~]$ sudo qubes-dom0-update qubes-template-fedora-26-minimal
|
||||
[user@dom0 ~]$ sudo qubes-dom0-update qubes-template-fedora-30-minimal
|
||||
|
||||
2. Since we'll be making some modifications, you may want to clone the minimal
|
||||
template:
|
||||
|
||||
[user@dom0 ~]$ qvm-clone fedora-26-minimal fedora-26-min-mfa
|
||||
[user@dom0 ~]$ qvm-clone fedora-30-minimal fedora-30-min-mfa
|
||||
|
||||
3. To open a root shell on the minimal template (for details, see [Passwordless Root]), run the following command:
|
||||
|
||||
3. Since this is going to be a minimal environment in which we run `oathtool`
|
||||
[user@dom0 ~]$ qvm-run -u root fedora-30-min-mfa xterm
|
||||
|
||||
4. Since this is going to be a minimal environment in which we run `oathtool`
|
||||
from the command line, we'll install only a couple of packages:
|
||||
|
||||
[user@fedora-26-min-mfa ~]$ su -
|
||||
[user@fedora-26-min-mfa ~]# dnf install oathtool vim-minimal
|
||||
[user@fedora-26-min-mfa ~]$ poweroff
|
||||
[root@fedora-30-min-mfa ~]# dnf install oathtool vim-minimal
|
||||
[root@fedora-30-min-mfa ~]$ poweroff
|
||||
|
||||
4. Create an AppVM and set it to use the TemplateVM we just created:
|
||||
5. Create an AppVM and set it to use the TemplateVM we just created:
|
||||
|
||||
[user@dom0 ~]$ qvm-create -l black mfa
|
||||
[user@dom0 ~]$ qvm-prefs -s mfa template fedora-26-min-mfa
|
||||
[user@dom0 ~]$ qvm-prefs -s mfa template fedora-30-min-mfa
|
||||
|
||||
5. Isolate the new AppVM from the network:
|
||||
6. Isolate the new AppVM from the network:
|
||||
|
||||
[user@dom0 ~]$ qvm-prefs -s mfa netvm none
|
||||
|
||||
@ -135,7 +138,7 @@ is largely the same.
|
||||
[user@mfa ~]$ > google
|
||||
[user@mfa ~]$ vi google
|
||||
|
||||
#!/bin/bash
|
||||
#!/usr/bin/env bash
|
||||
##My Google Account
|
||||
##me@gmail.com
|
||||
oathtool --base32 --totp "xd2n mx5t ekg6 h6bi u74d 745k n4m7 zy3x"
|
||||
@ -184,3 +187,4 @@ is largely the same.
|
||||
[Google Authenticator]: https://en.wikipedia.org/wiki/Google_Authenticator
|
||||
[FedoraMinimal]: /doc/Templates/FedoraMinimal/
|
||||
[usage]: https://en.wikipedia.org/wiki/Google_Authenticator#Usage
|
||||
[Passwordless Root]: /doc/templates/minimal/#passwordless-root
|
||||
|
||||
@ -32,5 +32,5 @@ When a template is marked as 'installed by package manager', but cannot be unins
|
||||
- If `installed_by_rpm` remains `True`, reboot your computer to bring qubes.xml in sync with qubesd, and try again to remove the template.
|
||||
|
||||
|
||||
[normal method]: /doc/templates/#how-to-install-uninstall-reinstall-and-switch
|
||||
[normal method]: /doc/templates/#uninstalling
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user