2014-07-28 21:14:28 +00:00
---
2015-04-10 20:17:45 +00:00
layout: doc
2015-10-14 03:31:03 +00:00
title: Debian Template
2015-10-28 22:14:40 +00:00
permalink: /doc/templates/debian/
2015-10-11 07:04:59 +00:00
redirect_from:
2016-05-21 07:49:01 -07:00
- /doc/debian/
2015-10-28 22:14:40 +00:00
- /en/doc/templates/debian/
2015-10-11 07:04:59 +00:00
- /doc/Templates/Debian/
- /wiki/Templates/Debian/
2014-07-28 21:14:28 +00:00
---
2015-04-23 05:26:43 +02:00
Debian template(s)
2014-07-28 21:14:28 +00:00
===============
2017-02-09 20:29:54 +00:00
If you would like to use Debian Linux distribution in your qubes, you can install one of the available Debian templates.
2015-04-23 16:14:55 +02:00
2017-02-09 20:29:54 +00:00
Updates for these templates are provided by ITL and are signed by this key:
2015-04-23 16:14:55 +02:00
pub 4096R/47FD92FA 2014-07-27
Key fingerprint = 2D43 E932 54EE EA7C B31B 6A77 5E58 18AB 47FD 92FA
uid Qubes OS Debian Packages Signing Key
2019-08-22 16:30:06 +00:00
The key is already installed when you install (signed) template package.
You can also obtain the key from [git repository][git] which is also integrity-protected using signed git tags.
2014-07-28 21:14:28 +00:00
2018-10-22 13:09:09 +00:00
2018-01-25 22:03:34 -06:00
Installing
----------
2014-07-28 21:14:28 +00:00
2017-02-09 20:29:54 +00:00
Templates can be installed with the following command:
2014-07-28 21:14:28 +00:00
2017-06-29 23:05:02 -05:00
Debian 7 (wheezy) - obsolete/archive:
2015-04-23 05:26:43 +02:00
2015-04-23 16:14:55 +02:00
[user@dom0 ~]$ sudo qubes-dom0-update qubes-template-debian-7
2015-04-23 05:26:43 +02:00
2019-07-10 15:43:46 +00:00
Debian 8 (jessie) - oldoldstable:
2015-04-23 05:26:43 +02:00
2015-04-23 16:14:55 +02:00
[user@dom0 ~]$ sudo qubes-dom0-update qubes-template-debian-8
2016-01-20 16:00:53 +01:00
2019-07-10 15:43:46 +00:00
Debian 9 (stretch) - oldstable:
2014-07-28 21:14:28 +00:00
2017-11-28 00:52:39 +00:00
[user@dom0 ~]$ sudo qubes-dom0-update qubes-template-debian-9
2016-05-21 20:22:30 +08:00
2019-08-22 16:30:06 +00:00
Debian-10 templates are currently available from the testing repository.
Debian 10 (buster) - minimal:
[user@dom0 ~]$ sudo qubes-dom0-update --enablerepo=qubes-templates-itl-testing qubes-template-debian-10-minimal
Because this template was built *before* buster became stable, it cannot be updated without [manually accepting the change in status][5149].
Also, to install additional Qubes packages you will have to enable the qubes-testing repository.
2019-07-10 15:43:46 +00:00
Debian 10 (buster) - stable:
[user@dom0 ~]$ sudo qubes-dom0-update --enablerepo=qubes-templates-itl-testing qubes-template-debian-10
Because this template was built *before* buster became stable, it cannot be updated without [manually accepting the change in status][5149].
2018-01-25 22:03:34 -06:00
Upgrading
---------
2019-08-22 16:30:06 +00:00
To upgrade an existing Debian TemplateVM, please consult [this guide][Upgrading]
2016-01-20 16:00:53 +01:00
2014-07-28 21:14:28 +00:00
Known issues
------------
2017-05-20 21:48:23 +00:00
### Starting services
2017-02-09 20:29:54 +00:00
The Debian way (generally) is to start daemons if they are installed.
This means that if you install (say) ssh-server in a template, *all* the qubes that use that template will run a ssh server when they start. (They will, naturally, all have the same server key.) This may not be what you want.
So be very careful when installing software in Templates - if the daemon spawns outbound connections then there is a serious security risk.
In general, a reasonable approach would be, (using ssh as example):
- Install the ssh service.
- systemctl stop ssh
- systemctl disable ssh
- systemctl mask ssh
- Close down template
Now the ssh service will **NOT** start in qubes based on this template.
Where you **DO** want the service to run, put this in /rw/config/rc.local:
systemctl unmask ssh
systemctl start ssh
Don't forget to make the file executable.
2017-05-20 21:48:23 +00:00
### Unattended Upgrades
2017-02-09 20:29:54 +00:00
Some users have noticed that on upgrading to Stretch, the unattended-upgrade package is installed.
This package is pulled in as part of a Recommend chain, and can be purged.
The lesson is that you should carefully look at what is being installed to your system, particularly if you run dist-upgrade.
2018-03-22 00:35:56 +00:00
### Package installation errors in Qubes 4.0
By default, templates in 4.0 only have a loopback interface.
2019-08-22 16:30:06 +00:00
Some packages will throw an error on installation in this situation.
For example, Samba expects to be configured using a network interface post installation.
2018-03-22 00:35:56 +00:00
One solution is to add a dummy interface to allow the package to install correctly:
2019-02-08 21:18:08 +07:00
ip link add d0 type dummy
2018-03-22 00:35:56 +00:00
ip addr add 192.168.0.1/24 dev d0
ip link set d0 up
2017-05-20 21:48:23 +00:00
Contributing
----------------
2017-02-09 20:29:54 +00:00
2019-08-22 16:30:06 +00:00
If you want to help in improving the template, feel free to [contribute]
2016-09-15 01:22:29 +02:00
2018-01-25 22:03:34 -06:00
2016-09-15 01:22:29 +02:00
More information
----------------
* [Debian wiki ](https://wiki.debian.org/Qubes )
2017-05-20 21:48:23 +00:00
2019-08-22 16:30:06 +00:00
[Upgrading]: /doc/template/debian/upgrade
2019-07-10 15:43:46 +00:00
[5149]: https://github.com/QubesOS/qubes-issues/issues/5149
2019-08-22 16:30:06 +00:00
[git]: https://github.com/QubesOS/qubes-core-agent-linux/blob/master/misc/qubes-archive-keyring.gpg
[builder]: /doc/qubes-builder/
[contribute]: /doc/contributing/
