+###### Onionizing Repositories -##### Qube Basic Setup +If you've opted to have updates over TOR, it is recommended that we also update our repositories on both dom0 and our templates. Changing our repositories over TOR helps increase anonymity as we'd be connecting to the onion site instead of the clearnet. + +dom0: + +In dom0, edit ``/etc/yum.repos.d/qubes-dom0.repo`` and we will comment out the ``metalink`` and then uncomment the onion ``baseurl``. After, update dom0 to ensure this is configured properly. + +The same process above will take place in the ``/etc/qubes/repo-templates/qubes-templates.repo`` file. + +Debian Templates: + +Edit ``/etc/apt/sources.list``, comment out the clearnet repos and add the following: + +``` +2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian bullseye main contrib non-free + +deb tor+http://5ajw6aqf3ep7sijnscdzw77t7xq4xjpsy335yb2wiwgouo7yfxtjlmid.onion bullseye-security main contrib non-free + +#Optional Backports +deb tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian bullseye-backports main contrib non-free +``` + +Fedora Templates: + +Edit ``/etc/yum.repos.d/qubes-r[version].repo``, comment out the clearnet ``baseurl`` and uncoment the onion ``baseurl`` + +
+ +###### Qube Basic Setup As for networking, if you have a VPN service such as ProtonVPN, you are able to utilize ``qtunnel`` and setup multiple VPNs. For each of our VPN qubes, we will need a ``sys-firewall``. If you wanted a dedicated ``sys-dns``, there are several guides on this: - [qubes-dns](https://github.com/3hhh/qubes-dns) -- [Pihole qube](https://github.com/92VV3M42d3v8/PiHole) +- [Pihole qube](https://github.com/92VV3M42d3v8/PiHole) ``sys-net`` -> ``sys-firewall`` -> ``sys-vpn`` -> ``sys-firewall-vpn`` @@ -310,16 +382,20 @@ This can be used for a wide variety of activities, not just specifically "person
+###### "Splitting" -##### Additional Setup +Let's startup by creating some basic qubes. To start, clone ``vault`` and create ``pgp-keys`` and ``ssh-keys`` to store our keys securely. Both should have __no internet access__. We will need to properly setup [split-pgp](https://qubes-os.org/doc/split-gpg) and [split-ssh](https://kushaldas/in/posts/using-split-ssh-in-qubesos-4-0.html). Using the "split" method, we are able to create an additional [split-browser](https://github.com/rustybird/qubes-split-browser) and a [split-dm-crypt](https://github.com/rustybird/qubes-split-dm-crypt). -You are never truly done configuring and setting up Qubes. There will always be more and more to configure. This section goes through some of these additional configurations. +More thoughts: + +- Split-Browser +- Split-Print
###### U2F-Proxy -Like the variety of tools offered by QubesOS, [u2f-proxy](https://qubes-os.org/doc/u2f-proxy) is no exception. This is an amazing tool that we will use for multi-factor authentication. This allows you to "compartmentalize the browser in one qube and the USB stack in another so that they are always kept separate from each other". +Using [u2f-proxy](https://qubes-os.org/doc/u2f-proxy) allows you to "compartmentalize the browser in one qube and the USB stack in another so that they are always kept separate from each other". The Qubes documentation shows the following for installation: @@ -405,6 +481,21 @@ Now, edit ``/etc/pam.d/xscreensaver`` to include: ``` auth include yubikey ``` +
+ +###### Multi-Factor Authentication + +We are able to utilize a network-isolated Qube for MFA. This allows us to have security benefits of MFA while increased security as the qube is entirely offline and isolated. We will be utilizing the ``oathtool`` for this MFA setup. Start off by creating a template preferably cloned from ``fedora-minimal`` and then ``sudo dnf install oathtool``. Afterwords, create an AppVM based on the MFA template we just created *without* network access. + +Whenever you are enabling 2FA, ensure to copy the secret key, then paste it into your MFA qube as such: + +``` +oathtool --base-32 --totp "SECRET_KEY" +``` + +Such a command will print the one-time token. + +It's best to preferably save the above command you typed, as this is how you will retrieve your one-time token. You're able to create a simple script that just executes the above command. You will do this for each 2FA account. ``account-1.sh``, ``account-2.sh``.
@@ -416,30 +507,13 @@ This is for advanced users. Read the [official documentation](https://qubes-os.o ###### Backups -Creating proper backups securely is critical for any setup, especially this one here. You must understand the different backup techniques and solutions available. For high security, it is recommended that we backup the system locally, meaning that we do not store our backups on the cloud. We should start to look at possible backup solutions. The built-in ``qvm-backup`` will work amazing for this. It provides security & authentication, which are both crucial to a proper backup solution. Ensure to read the [official documentation](https://github.com/qubes-os.org/doc/how-to-back-up-restore-and-migrate). +Creating proper backups securely is critical for any setup, especially this one here. You must understand the different backup techniques and solutions avaliable. For high security, it is recommended that we backup the system locally, meaning that we do not store our backups on the cloud. We should start to look at possible backup solutions. The built-in ``qvm-backup`` will work amazing for this. It provides security & authentication, which are both crucial to a proper backup solution. Ensure to read the [official documentation](https://github.com/qubes-os.org/doc/how-to-back-up-restore-and-migrate). -It's suggested you have a high-speed SSD or M.2 for this procedure. There are "special" options described as "rugged", which has additional layer of armor and is generally waterproof. Ensure this drive is also high-capacity. In some cases, it may make sense to have an additional drive incase of failure or other malfunction. Going into redundancy, you also have the ability to setup a local RAID on your network. This would provide increased redundancy, though it can *potentially* decrease security, as having another system on the network, proper hardening, etc. but is unlikely to cause any harm. You could setup a local NextCloud instance or another type of local network storage and utilize [wyng](https://github.com/tasket/wyng-backup). +It's suggested you have a high-speed SSD or M.2 for this procedure. There are "special" options described as "rugged", which has additional layer of armor and are generally waterproof. Ensure this drive is also high-capacity. In some cases, it may make sense to have an additional drive incase of failure or other malfunction. Going into redundancy, you also have the ability to setup a local RAID on your network. This would provide increased redundancy, though it can *potentially* decrease security, as having another system on the network, proper hardening, etc. but is unlikely to cause any harm with the proper configuration. You could setup a local NextCloud instance or another type of local network storage and utilize [wyng](https://github.com/tasket/wyng-backup).
-#### __GrapheneOS__ - -[GrapheneOS](https://grapheneos.com) is an amazing mobile operating system. This OS has been developed to provide security along with privacy. The only limitations is that it requires an OEM unlocked Google Pixel device. These devices have been known for their security, so putting them together is an amazing pair. - - - -After installing, there is plenty of things we can start to do. We will be utilizing the built-in profiles along with the "work profile". We will need to install [F-droid](https://f-droid.org). - - - - -
- -#### Creating our aliases - -
- Note: This is a continuation of the [QubeOS setup](#qubesos).
-
+##### Creating our aliases
For setting our foundation, we are going to be creating a variety of aliases and each of these aliases are going to each need an "arsenal". For step 1 we are going to need a password manager.
@@ -448,6 +522,8 @@ Upon creating our aliases we will have several different approaches:
1. Each username, email, and other will be completely random
2. Each alias will have its own email, username, etc.
+We can generate an alias by thinking of a random word / phrase but this method could eventually compromise you if you keep choosing references from Star Trek.
+
If you are using QubesOS, we are able to utilize compartmentalization heavily in this instance. We will start off by creating multiple qubes for our setup.
- ``alias-web``
@@ -466,27 +542,66 @@ Each of our aliases is going to need some sort of "story". We are not putting th
- +[PortaPow USB Data Blocker](https://www.amazon.com/PortaPow-3rd-Gen-Data-Blocker/dp/B00QRRZ2QM/) - The gold standard of USB data blocking. This is a USB-A connector with a built-in "SmartChip" designed to increase charging speeds. -#### Hardening +
-Now that we've setup a solid foundation, it is now time for hardening. Hardening will be simple securing our pre-existing setup. You can never be too careful. Let's make some general notes here before we begin. +
-- Mobile phones are extremely difficult to manage properly
-- You must think of all possible scenarios
-- Do your own research
+-Let's first start off with hardening our setup we've created above. +[PortaPow Pure USB Data Blocker (Multicolored)](https://www.amazon.com/PortaPow-Pure-USB-Data-Blocker/dp/B07W928WRR/) - This USB-A Data Blocker is made of transparent plastic, meaning that you can physically verify that the data pins have been removed along with the removal of their "SmartChip". therefore increasing security. +
+ +
+
++ +[PortaPow USB-C to C Data Blocker](https://www.amazon.com/PortaPow-USB-C-Data-Blocker-Twin/dp/B082WDHS22/) - A USB-C cable that does not transfer any data. + +
+ +
+
++ +[Malicious Cable Detector](https://hak5.org/products/malicious-cable-detector-by-o-mg) - Can be configured to detect malicious cables + +Hardware Key: A small little device that can be used for MFA and GPG. Very useful to have a physical device. Something like this is recommended to have a backup clone and stored in a safe location such as a safe. + +- Faraday Pouch - This will block all radio waves and signals, which can ensure that absolutely connectionn is traveling out of your devices. It completely air-gaps the device. + +
diff --git a/assets/Another_guide/img/USB_C_Data_Blocker.jpg b/assets/Another_guide/img/USB_C_Data_Blocker.jpg new file mode 100644 index 0000000..76398a2 Binary files /dev/null and b/assets/Another_guide/img/USB_C_Data_Blocker.jpg differ diff --git a/assets/Another_guide/img/USB_Data_Blocker.jpeg b/assets/Another_guide/img/USB_Data_Blocker.jpeg new file mode 100644 index 0000000..2c6fb2a Binary files /dev/null and b/assets/Another_guide/img/USB_Data_Blocker.jpeg differ diff --git a/assets/Another_guide/img/USB_Data_Blocker_Transparent.jpg b/assets/Another_guide/img/USB_Data_Blocker_Transparent.jpg new file mode 100644 index 0000000..4e989d1 Binary files /dev/null and b/assets/Another_guide/img/USB_Data_Blocker_Transparent.jpg differ