mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2025-11-29 16:07:12 -05:00
Wrap text and miscellaneous cleanup
This commit is contained in:
Andrew David Wong
parent
e451f92cde
commit
07c130df00
21 changed files with 1845 additions and 1022 deletions
|
|
@ -4,341 +4,400 @@ layout: doc
|
|||
permalink: /doc/installation-guide/
|
||||
redirect_from:
|
||||
- /en/doc/installation-guide/
|
||||
- /doc/InstallationGuide/
|
||||
- /wiki/InstallationGuide/
|
||||
- /doc/InstallationGuideR1/
|
||||
- /doc/InstallationGuideR2B1/
|
||||
- /doc/InstallationGuideR2B2/
|
||||
- /doc/InstallationGuideR2B3/
|
||||
- /doc/InstallationGuideR2rc1/
|
||||
- /doc/InstallationGuideR2rc2/
|
||||
- /doc/InstallationGuideR3.0rc1/
|
||||
- /doc/InstallationGuideR3.0rc2/
|
||||
- /doc/installationguide/
|
||||
- /wiki/installationguide/
|
||||
- /doc/installationguider1/
|
||||
- /doc/installationguider2b1/
|
||||
- /doc/installationguider2b2/
|
||||
- /doc/installationguider2b3/
|
||||
- /doc/installationguider2rc1/
|
||||
- /doc/installationguider2rc2/
|
||||
- /doc/installationguider3.0rc1/
|
||||
- /doc/installationguider3.0rc2/
|
||||
- /doc/live-usb/
|
||||
ref: 153
|
||||
title: Installation Guide
|
||||
title: installation guide
|
||||
---
|
||||
|
||||
Welcome to the Qubes OS installation guide!
|
||||
This guide will walk you through the process of installing Qubes.
|
||||
Please read it carefully and thoroughly, as it contains important information for ensuring that your Qubes OS installation is functional and secure.
|
||||
welcome to the qubes os installation guide! this guide will walk you through
|
||||
the process of installing qubes. please read it carefully and thoroughly, as it
|
||||
contains important information for ensuring that your qubes os installation is
|
||||
functional and secure.
|
||||
|
||||
## Pre-installation
|
||||
## pre-installation
|
||||
|
||||
### Hardware requirements
|
||||
### hardware requirements
|
||||
|
||||
<div class="alert alert-danger" role="alert">
|
||||
<i class="fa fa-exclamation-triangle"></i>
|
||||
<b>Warning:</b> Qubes has no control over what happens on your computer before you install it.
|
||||
No software can provide security if it is installed on compromised hardware.
|
||||
Do not install Qubes on a computer you don't trust.
|
||||
See <a href="/doc/install-security/">installation security</a> for more information.
|
||||
<b>warning:</b> qubes has no control over what happens on your computer
|
||||
before you install it. no software can provide security if it is installed on
|
||||
compromised hardware. do not install qubes on a computer you don't trust. see
|
||||
<a href="/doc/install-security/">installation security</a> for more
|
||||
information.
|
||||
</div>
|
||||
|
||||
Qubes OS has very specific [system requirements](/doc/system-requirements/).
|
||||
To ensure compatibility, we strongly recommend using [Qubes-certified hardware](/doc/certified-hardware/).
|
||||
Other hardware may require you to perform significant troubleshooting.
|
||||
You may also find it helpful to consult the [Hardware Compatibility List](/hcl/).
|
||||
qubes os has very specific [system requirements](/doc/system-requirements/). to
|
||||
ensure compatibility, we strongly recommend using [qubes-certified
|
||||
hardware](/doc/certified-hardware/). other hardware may require you to perform
|
||||
significant troubleshooting. you may also find it helpful to consult the
|
||||
[hardware compatibility list](/hcl/).
|
||||
|
||||
Even on supported hardware, you must ensure that [IOMMU-based virtualization](https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit#Virtualization) is activated in the BIOS.
|
||||
Without it, Qubes OS won't be able to enforce isolation.
|
||||
For Intel-based boards, this setting is called Intel Virtualization for Directed I/O (**Intel VT-d**) and for AMD-based boards, it is called AMD I/O Virtualization Technology (or simply **AMD-Vi**).
|
||||
This parameter should be activated in your computer's BIOS, alongside the standard Virtualization (**Intel VT-x**) and AMD Virtualization (**AMD-V**) extensions.
|
||||
This [external guide](https://web.archive.org/web/20200112220913/https://www.intel.in/content/www/in/en/support/articles/000007139/server-products.html) made for Intel-based boards can help you figure out how to enter your BIOS to locate and activate those settings.
|
||||
If those settings are not nested under the Advanced tab, you might find them under the Security tab.
|
||||
even on supported hardware, you must ensure that [iommu-based
|
||||
virtualization](https://en.wikipedia.org/wiki/input%e2%80%93output_memory_management_unit#virtualization)
|
||||
is activated in the bios. without it, qubes os won't be able to enforce
|
||||
isolation. for intel-based boards, this setting is called intel virtualization
|
||||
for directed i/o (**intel vt-d**) and for amd-based boards, it is called amd
|
||||
i/o virtualization technology (or simply **amd-vi**). this parameter should be
|
||||
activated in your computer's bios, alongside the standard virtualization
|
||||
(**intel vt-x**) and amd virtualization (**amd-v**) extensions. this [external
|
||||
guide](https://web.archive.org/web/20200112220913/https://www.intel.in/content/www/in/en/support/articles/000007139/server-products.html)
|
||||
made for intel-based boards can help you figure out how to enter your bios to
|
||||
locate and activate those settings. if those settings are not nested under the
|
||||
advanced tab, you might find them under the security tab.
|
||||
|
||||
<div class="alert alert-warning" role="alert">
|
||||
<i class="fa fa-exclamation-circle"></i>
|
||||
<b>Note:</b> Qubes OS is not meant to be installed inside a virtual machine as a guest hypervisor.
|
||||
In other words, <b>nested virtualization</b> is not supported.
|
||||
In order for a strict compartmentalization to be enforced, Qubes OS needs to be able to manage the hardware directly.
|
||||
<b>note:</b> qubes os is not meant to be installed inside a virtual machine
|
||||
as a guest hypervisor. in other words, <b>nested virtualization</b> is not
|
||||
supported. in order for a strict compartmentalization to be enforced, qubes
|
||||
os needs to be able to manage the hardware directly.
|
||||
</div>
|
||||
|
||||
### Copying the ISO onto the installation medium
|
||||
### copying the iso onto the installation medium
|
||||
|
||||
Start by [downloading](/downloads/) a Qubes ISO.
|
||||
start by [downloading](/downloads/) a qubes iso.
|
||||
|
||||
<div class="alert alert-danger" role="alert">
|
||||
<i class="fa fa-exclamation-triangle"></i>
|
||||
<b>Warning:</b> Any file you download from the internet could be malicious, even if it appears to come from a trustworthy source.
|
||||
Our philosophy is to <a href="/faq/#what-does-it-mean-to-distrust-the-infrastructure">distrust the infrastructure</a>.
|
||||
Regardless of how you acquire your Qubes ISO, <a href="/security/verifying-signatures/">verify its authenticity</a> before continuing.
|
||||
<b>warning:</b> any file you download from the internet could be malicious,
|
||||
even if it appears to come from a trustworthy source. our philosophy is to <a
|
||||
href="/faq/#what-does-it-mean-to-distrust-the-infrastructure">distrust the
|
||||
infrastructure</a>. regardless of how you acquire your qubes iso, <a
|
||||
href="/security/verifying-signatures/">verify its authenticity</a> before
|
||||
continuing.
|
||||
</div>
|
||||
|
||||
Once the ISO has been verified as authentic, you should copy it onto the installation medium of your choice, such as a dual-layer DVD, a Blu-ray disc, or a USB drive.
|
||||
The size of each Qubes ISO is available on the [downloads](/downloads/) page by hovering over the download button.
|
||||
once the iso has been verified as authentic, you should copy it onto the
|
||||
installation medium of your choice, such as a dual-layer dvd, a blu-ray disc,
|
||||
or a usb drive. the size of each qubes iso is available on the
|
||||
[downloads](/downloads/) page by hovering over the download button.
|
||||
|
||||
<div class="alert alert-warning" role="alert">
|
||||
<i class="fa fa-exclamation-circle"></i>
|
||||
<b>Note:</b> There are important <a href="/doc/install-security/">security considerations</a> to keep in mind when choosing an installation medium.
|
||||
<b>note:</b> there are important <a href="/doc/install-security/">security
|
||||
considerations</a> to keep in mind when choosing an installation medium.
|
||||
</div>
|
||||
|
||||
<div class="alert alert-danger" role="alert">
|
||||
<i class="fa fa-exclamation-triangle"></i>
|
||||
<b>Warning:</b> Be careful to choose the correct device when copying the ISO, or you may lose data.
|
||||
We strongly recommended making a full backup before modifying any devices.
|
||||
<b>warning:</b> be careful to choose the correct device when copying the iso,
|
||||
or you may lose data. we strongly recommended making a full backup before
|
||||
modifying any devices.
|
||||
</div>
|
||||
|
||||
If you choose to use a USB drive, copy the ISO onto the USB device, e.g. using `dd`:
|
||||
if you choose to use a usb drive, copy the iso onto the usb device, e.g. using
|
||||
`dd`:
|
||||
|
||||
```
|
||||
$ sudo dd if=Qubes-RX-x86_64.iso of=/dev/sdY status=progress bs=1048576 && sync
|
||||
$ sudo dd if=qubes-rx-x86_64.iso of=/dev/sdy status=progress bs=1048576 && sync
|
||||
```
|
||||
|
||||
Change `Qubes-RX-x86_64.iso` to the filename of the version you're installing, and change `/dev/sdY` to the correct target device e.g., `/dev/sdc`).
|
||||
Make sure to write to the entire device (e.g., `/dev/sdc`) rather than just a single partition (e.g., `/dev/sdc1`).
|
||||
change `qubes-rx-x86_64.iso` to the filename of the version you're installing,
|
||||
and change `/dev/sdy` to the correct target device e.g., `/dev/sdc`). make sure
|
||||
to write to the entire device (e.g., `/dev/sdc`) rather than just a single
|
||||
partition (e.g., `/dev/sdc1`).
|
||||
|
||||
On Windows, you can use the [Rufus](https://rufus.akeo.ie/) tool to write the ISO to a USB key.
|
||||
MediaTest is not recommended.
|
||||
Be sure to select "DD image" mode (*after* selecting the Qubes ISO):
|
||||
on windows, you can use the [rufus](https://rufus.akeo.ie/) tool to write the
|
||||
iso to a usb key. mediatest is not recommended. be sure to select "dd image"
|
||||
mode (*after* selecting the qubes iso):
|
||||
|
||||
<div class="alert alert-warning" role="alert">
|
||||
<i class="fa fa-exclamation-circle"></i>
|
||||
<b>Note:</b> If you do this on Windows 10, you can only install Qubes without MediaTest, which is not recommended.
|
||||
<b>note:</b> if you do this on windows 10, you can only install qubes
|
||||
without mediatest, which is not recommended.
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
If you are an advanced user, and you would like to customize your installation, please see [custom installation](/doc/custom-install/).
|
||||
Otherwise, follow the instructions below.
|
||||
if you are an advanced user, and you would like to customize your installation,
|
||||
please see [custom installation](/doc/custom-install/). otherwise, follow the
|
||||
instructions below.
|
||||
|
||||
## Installation
|
||||
## installation
|
||||
|
||||
This section will demonstrate a simple installation using mostly default settings.
|
||||
this section will demonstrate a simple installation using mostly default
|
||||
settings.
|
||||
|
||||
### Getting to the boot screen
|
||||
### getting to the boot screen
|
||||
|
||||
Just after you power on your machine, make the Qubes OS medium available to the computer by inserting your DVD or USB drive.
|
||||
Shortly after the Power-on self-test (POST) is completed, you should be greeted with the Qubes OS boot screen.
|
||||
just after you power on your machine, make the qubes os medium available to the
|
||||
computer by inserting your dvd or usb drive. shortly after the power-on
|
||||
self-test (post) is completed, you should be greeted with the qubes os boot
|
||||
screen.
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="alert alert-info" role="alert">
|
||||
<i class="fa fa-info-circle"></i>
|
||||
<b>Note:</b> When installing Qubes OS 4.0 on UEFI, there is intentionally no boot menu.
|
||||
It goes straight to the installer.
|
||||
The boot menu will be back in Qubes OS 4.1.
|
||||
<b>note:</b> when installing qubes os 4.0 on uefi, there is intentionally no
|
||||
boot menu. it goes straight to the installer. the boot menu will be back in
|
||||
qubes os 4.1.
|
||||
</div>
|
||||
|
||||
From here, you can navigate the boot screen using the arrow keys on your keyboard.
|
||||
Pressing the "Tab" key will reveal options.
|
||||
You can choose one of three options:
|
||||
from here, you can navigate the boot screen using the arrow keys on your
|
||||
keyboard. pressing the "tab" key will reveal options. you can choose one of
|
||||
three options:
|
||||
|
||||
* Install Qubes OS
|
||||
* Test this media and install Qubes OS
|
||||
* Troubleshooting
|
||||
* install qubes os
|
||||
* test this media and install qubes os
|
||||
* troubleshooting
|
||||
|
||||
Select the option to test this media and install Qubes OS.
|
||||
select the option to test this media and install qubes os.
|
||||
|
||||
If the boot screen does not appear, there are several options to troubleshoot.
|
||||
First, try rebooting your computer.
|
||||
If it still loads your currently installed operating system or does not detect your installation medium, make sure the boot order is set up appropriately.
|
||||
The process to change the boot order varies depending on the currently installed system and the motherboard manufacturer.
|
||||
If **Windows 10** is installed on your machine, you may need to follow specific instructions to change the boot order.
|
||||
This may require an [advanced reboot](https://support.microsoft.com/en-us/help/4026206/windows-10-find-safe-mode-and-other-startup-settings).
|
||||
if the boot screen does not appear, there are several options to troubleshoot.
|
||||
first, try rebooting your computer. if it still loads your currently installed
|
||||
operating system or does not detect your installation medium, make sure the
|
||||
boot order is set up appropriately. the process to change the boot order varies
|
||||
depending on the currently installed system and the motherboard manufacturer.
|
||||
if **windows 10** is installed on your machine, you may need to follow specific
|
||||
instructions to change the boot order. this may require an [advanced
|
||||
reboot](https://support.microsoft.com/en-us/help/4026206/windows-10-find-safe-mode-and-other-startup-settings).
|
||||
|
||||
After the POST, you may have a chance to choose a boot device.
|
||||
You may wish to select the USB drive or DVD drive as a temporary boot option so that the next time you boot, your internal storage device will be selected first.
|
||||
after the post, you may have a chance to choose a boot device. you may wish to
|
||||
select the usb drive or dvd drive as a temporary boot option so that the next
|
||||
time you boot, your internal storage device will be selected first.
|
||||
|
||||
|
||||
|
||||
|
||||
### The installer home screen
|
||||
### the installer home screen
|
||||
|
||||
On the first screen, you are asked to select the language that will be used during the installation process.
|
||||
When you are done, select **Continue**.
|
||||
on the first screen, you are asked to select the language that will be used
|
||||
during the installation process. when you are done, select **continue**.
|
||||
|
||||
|
||||
|
||||
Prior to the next screen, a compatibility test runs to check whether IOMMU-virtualization is active or not.
|
||||
If the test fails, a window will pop up.
|
||||
prior to the next screen, a compatibility test runs to check whether
|
||||
iommu-virtualization is active or not. if the test fails, a window will pop up.
|
||||
|
||||
|
||||
|
||||
|
||||
Do not panic.
|
||||
It may simply indicate that IOMMU-virtualization hasn't been activated in the BIOS.
|
||||
Return to the [hardware requirements](#hardware-requirements) section to learn how to activate it.
|
||||
If the setting is not configured correctly, it means that your hardware won't be able to leverage some Qubes security features, such as a strict isolation of the networking and USB hardware.
|
||||
do not panic. it may simply indicate that iommu-virtualization hasn't been
|
||||
activated in the bios. return to the [hardware
|
||||
requirements](#hardware-requirements) section to learn how to activate it. if
|
||||
the setting is not configured correctly, it means that your hardware won't be
|
||||
able to leverage some qubes security features, such as a strict isolation of
|
||||
the networking and usb hardware.
|
||||
|
||||
If the test passes, you will reach the installation summary screen.
|
||||
The installer loads Xen right at the beginning.
|
||||
If you can see the installer's graphical screen, and you pass the compatibility check that runs immediately afterward, Qubes OS is likely to work on your system!
|
||||
if the test passes, you will reach the installation summary screen. the
|
||||
installer loads xen right at the beginning. if you can see the installer's
|
||||
graphical screen, and you pass the compatibility check that runs immediately
|
||||
afterward, qubes os is likely to work on your system!
|
||||
|
||||
Like Fedora, Qubes OS uses the Anaconda installer.
|
||||
Those that are familiar with RPM-based distributions should feel at home.
|
||||
like fedora, qubes os uses the anaconda installer. those that are familiar with
|
||||
rpm-based distributions should feel at home.
|
||||
|
||||
### Installation summary
|
||||
### installation summary
|
||||
|
||||
<div class="alert alert-success" role="alert">
|
||||
<i class="fa fa-check-circle"></i>
|
||||
<b>Did you know?</b> The Qubes OS installer is completely offline.
|
||||
It doesn't even load any networking drivers, so there is no possibility of internet-based data leaks or attacks during the installation process.
|
||||
<b>did you know?</b> the qubes os installer is completely offline. it doesn't
|
||||
even load any networking drivers, so there is no possibility of
|
||||
internet-based data leaks or attacks during the installation process.
|
||||
</div>
|
||||
|
||||
The Installation summary screen allows you to change how the system will be installed and configured, including localization settings.
|
||||
At minimum, you are required to select the storage device on which Qubes OS will be installed.
|
||||
the installation summary screen allows you to change how the system will be
|
||||
installed and configured, including localization settings. at minimum, you are
|
||||
required to select the storage device on which qubes os will be installed.
|
||||
|
||||
|
||||
|
||||
|
||||
### Localization
|
||||
### localization
|
||||
|
||||
Let's assume you wish to add a German keyboard layout.
|
||||
Go to Keyboard Layout, press the "Plus" symbol, search for "German" as indicated in the screenshot and press "Add".
|
||||
If you want it be your default language, select the "German" entry in the list and press the arrow button.
|
||||
Click on "Done" in the upper left corner, and you're ready to go!
|
||||
let's assume you wish to add a german keyboard layout. go to keyboard layout,
|
||||
press the "plus" symbol, search for "german" as indicated in the screenshot and
|
||||
press "add". if you want it be your default language, select the "german" entry
|
||||
in the list and press the arrow button. click on "done" in the upper left
|
||||
corner, and you're ready to go!
|
||||
|
||||
|
||||
|
||||
|
||||
The process to select a new language is similar to the process to select a new keyboard layout.
|
||||
Follow the same process in the "Language Support" entry.
|
||||
the process to select a new language is similar to the process to select a new
|
||||
keyboard layout. follow the same process in the "language support" entry.
|
||||
|
||||
|
||||
|
||||
|
||||
You can have as many keyboard layout and languages as you want.
|
||||
Post-install, you will be able to switch between them and install others.
|
||||
you can have as many keyboard layout and languages as you want. post-install,
|
||||
you will be able to switch between them and install others.
|
||||
|
||||
Don't forget to select your time and date by clicking on the Time & Date entry.
|
||||
don't forget to select your time and date by clicking on the time & date entry.
|
||||
|
||||
|
||||
|
||||
|
||||
### Software
|
||||
### software
|
||||
|
||||
|
||||
|
||||
|
||||
On the software selection tab, you can choose which software to install in Qubes OS.
|
||||
Two options are available:
|
||||
on the software selection tab, you can choose which software to install in
|
||||
qubes os. two options are available:
|
||||
|
||||
* **Debian:** Select this option if you would like to use [Debian](/doc/templates/debian/) qubes in addition to the default Fedora qubes.
|
||||
* **Whonix:** Select this option if you would like to use [Whonix](/doc/whonix/) qubes.
|
||||
Whonix allows you to use [Tor](https://www.torproject.org/) securely within Qubes.
|
||||
* **debian:** select this option if you would like to use
|
||||
[debian](/doc/templates/debian/) qubes in addition to the default fedora
|
||||
qubes.
|
||||
* **whonix:** select this option if you would like to use
|
||||
[whonix](/doc/whonix/) qubes. whonix allows you to use
|
||||
[tor](https://www.torproject.org/) securely within qubes.
|
||||
|
||||
Whonix lets you route some or all of your network traffic through Tor for greater privacy.
|
||||
Depending on your threat model, you may need to install Whonix templates right away.
|
||||
whonix lets you route some or all of your network traffic through tor for
|
||||
greater privacy. depending on your threat model, you may need to install whonix
|
||||
templates right away.
|
||||
|
||||
Regardless of your choices on this screen, you will always be able to install these and other [templates](/doc/templates/) later.
|
||||
If you're short on disk space, you may wish to deselect these options.
|
||||
regardless of your choices on this screen, you will always be able to install
|
||||
these and other [templates](/doc/templates/) later. if you're short on disk
|
||||
space, you may wish to deselect these options.
|
||||
|
||||
By default, Qubes OS comes preinstalled with the lightweight Xfce4 desktop environment.
|
||||
Other desktop environments will be available to you after the installation is completed, though they may not be officially supported (see [Advanced Topics](/doc/#advanced-topics)).
|
||||
by default, qubes os comes preinstalled with the lightweight xfce4 desktop
|
||||
environment. other desktop environments will be available to you after the
|
||||
installation is completed, though they may not be officially supported (see
|
||||
[advanced topics](/doc/#advanced-topics)).
|
||||
|
||||
Press **Done** to go back to the installation summary screen.
|
||||
press **done** to go back to the installation summary screen.
|
||||
|
||||
### Installation destination
|
||||
### installation destination
|
||||
|
||||
Under the System section, you must choose the installation destination.
|
||||
Select the storage device on which you would like to install Qubes OS.
|
||||
under the system section, you must choose the installation destination. select
|
||||
the storage device on which you would like to install qubes os.
|
||||
|
||||
<div class="alert alert-danger" role="alert">
|
||||
<i class="fa fa-exclamation-triangle"></i>
|
||||
<b>Warning:</b> Be careful to choose the correct installation target, or you may lose data.
|
||||
We strongly recommended making a full backup before proceeding.
|
||||
<b>warning:</b> be careful to choose the correct installation target, or you
|
||||
may lose data. we strongly recommended making a full backup before
|
||||
proceeding.
|
||||
</div>
|
||||
|
||||
Your installation destination can be an internal or external storage drive, such as an SSD, HDD, or USB drive.
|
||||
The installation destination must have a least 32 GiB of free space available.
|
||||
your installation destination can be an internal or external storage drive,
|
||||
such as an ssd, hdd, or usb drive. the installation destination must have a
|
||||
least 32 gib of free space available.
|
||||
|
||||
<div class="alert alert-warning" role="alert">
|
||||
<i class="fa fa-exclamation-circle"></i>
|
||||
<b>Note:</b> The installation destination cannot be the same as the installation medium. For example, if you're installing Qubes OS <em>from</em> a USB drive <em>onto</em> a USB drive, they must be two distinct USB drives, and they must both be plugged into your computer at the same time. (Note: This may not apply to advanced users who partition their devices appropriately.)
|
||||
<b>note:</b> the installation destination cannot be the same as the
|
||||
installation medium. for example, if you're installing qubes os <em>from</em>
|
||||
a usb drive <em>onto</em> a usb drive, they must be two distinct usb drives,
|
||||
and they must both be plugged into your computer at the same time. (note:
|
||||
this may not apply to advanced users who partition their devices
|
||||
appropriately.)
|
||||
</div>
|
||||
|
||||
Installing an operating system onto a USB drive can be a convenient way to try Qubes.
|
||||
However, USB drives are typically much slower than internal SSDs.
|
||||
We recommend a very fast USB 3.0 drive for decent performance.
|
||||
Please note that a minimum storage of 32 GiB is required.
|
||||
If you want to install Qubes OS onto a USB drive, just select the USB device as the target installation device.
|
||||
Bear in mind that the installation process is likely to take longer than it would on an internal storage device.
|
||||
installing an operating system onto a usb drive can be a convenient way to try
|
||||
qubes. however, usb drives are typically much slower than internal ssds. we
|
||||
recommend a very fast usb 3.0 drive for decent performance. please note that a
|
||||
minimum storage of 32 gib is required. if you want to install qubes os onto a
|
||||
usb drive, just select the usb device as the target installation device. bear
|
||||
in mind that the installation process is likely to take longer than it would on
|
||||
an internal storage device.
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="alert alert-success" role="alert">
|
||||
<i class="fa fa-check-circle"></i>
|
||||
<b>Did you know?</b> Qubes OS uses full-disk AES encryption (FDE) via LUKS by default.
|
||||
<b>did you know?</b> qubes os uses full-disk aes encryption (fde) via luks by
|
||||
default.
|
||||
</div>
|
||||
|
||||
As soon as you press **Done**, the installer will ask you to enter a passphrase for disk encryption.
|
||||
The passphrase should be complex.
|
||||
Make sure that your keyboard layout reflects what keyboard you are actually using.
|
||||
When you're finished, press **Done**.
|
||||
as soon as you press **done**, the installer will ask you to enter a passphrase
|
||||
for disk encryption. the passphrase should be complex. make sure that your
|
||||
keyboard layout reflects what keyboard you are actually using. when you're
|
||||
finished, press **done**.
|
||||
|
||||
<div class="alert alert-danger" role="alert">
|
||||
<i class="fa fa-exclamation-triangle"></i>
|
||||
<b>Warning:</b> If you forget your encryption passphrase, there is no way to recover it.
|
||||
<b>warning:</b> if you forget your encryption passphrase, there is no way to
|
||||
recover it.
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
When you're ready, press **Begin Installation**.
|
||||
when you're ready, press **begin installation**.
|
||||
|
||||
|
||||
|
||||
|
||||
### Create your user account
|
||||
### create your user account
|
||||
|
||||
While the installation process is running, you can create your user account.
|
||||
This is what you'll use to log in after disk decryption and when unlocking the screen locker.
|
||||
This is a purely local, offline account in dom0.
|
||||
By design, Qubes OS is a single-user operating system, so this is just for you.
|
||||
while the installation process is running, you can create your user account.
|
||||
this is what you'll use to log in after disk decryption and when unlocking the
|
||||
screen locker. this is a purely local, offline account in dom0. by design,
|
||||
qubes os is a single-user operating system, so this is just for you.
|
||||
|
||||
Select **User Creation** to define a new user with administrator privileges and a password.
|
||||
Just as for the disk encryption, this password should be complex.
|
||||
The root account is deactivated and should remain as such.
|
||||
select **user creation** to define a new user with administrator privileges and
|
||||
a password. just as for the disk encryption, this password should be complex.
|
||||
the root account is deactivated and should remain as such.
|
||||
|
||||
|
||||
|
||||
|
||||
When the installation is complete, press **Reboot**.
|
||||
Don't forget to remove the installation medium, or else you may end up seeing the installer boot screen again.
|
||||
when the installation is complete, press **reboot**. don't forget to remove the
|
||||
installation medium, or else you may end up seeing the installer boot screen
|
||||
again.
|
||||
|
||||
## Post-installation
|
||||
## post-installation
|
||||
|
||||
### First boot
|
||||
### first boot
|
||||
|
||||
If the installation was successful, you should now see the GRUB menu during the boot process.
|
||||
if the installation was successful, you should now see the grub menu during the
|
||||
boot process.
|
||||
|
||||
|
||||
|
||||
|
||||
Just after this screen, you will be asked to enter your encryption passphrase.
|
||||
just after this screen, you will be asked to enter your encryption passphrase.
|
||||
|
||||
|
||||
|
||||
|
||||
### Initial Setup
|
||||
### initial setup
|
||||
|
||||
You're almost done.
|
||||
Before you can start using Qubes OS, some configuration is needed.
|
||||
you're almost done. before you can start using qubes os, some configuration is
|
||||
needed.
|
||||
|
||||
|
||||
|
||||
|
||||
By default, the installer will create a number of qubes (depending on the options you selected during the installation process).
|
||||
These are designed to give you a more ready-to-use environment from the get-go.
|
||||
by default, the installer will create a number of qubes (depending on the
|
||||
options you selected during the installation process). these are designed to
|
||||
give you a more ready-to-use environment from the get-go.
|
||||
|
||||
|
||||
|
||||
|
||||
Let's briefly go over the options:
|
||||
let's briefly go over the options:
|
||||
|
||||
* **Create default system qubes:**
|
||||
These are the core components of the system, required for things like internet access.
|
||||
* **Create default application qubes:**
|
||||
These are how you compartmentalize your digital life.
|
||||
There's nothing special about the ones the installer creates.
|
||||
They're just suggestions that apply to most people.
|
||||
If you decide you don't want them, you can always delete them later, and you can always create your own.
|
||||
* **Create Whonix Gateway and Workstation qubes:**
|
||||
If you want to use Whonix, you should select this option.
|
||||
* **Enabling system and template updates over the Tor anonymity network using Whonix:**
|
||||
If you select this option, then whenever you install or update software in dom0 or a template, the internet traffic will go through Tor.
|
||||
* **Create USB qube holding all USB controllers:**
|
||||
Just like the network qube for the network stack, the USB qube isolates the USB controllers.
|
||||
* **Use sys-net qube for both networking and USB devices:**
|
||||
You should select this option if you rely on a USB device for network access, such as a USB modem or a USB Wi-Fi adapter.
|
||||
* **create default system qubes:**
|
||||
these are the core components of the system, required for things like
|
||||
internet access.
|
||||
* **create default application qubes:**
|
||||
these are how you compartmentalize your digital life. there's nothing special
|
||||
about the ones the installer creates. they're just suggestions that apply to
|
||||
most people. if you decide you don't want them, you can always delete them
|
||||
later, and you can always create your own.
|
||||
* **create whonix gateway and workstation qubes:**
|
||||
if you want to use whonix, you should select this option.
|
||||
* **enabling system and template updates over the tor anonymity network using whonix:**
|
||||
if you select this option, then whenever you install or update software in
|
||||
dom0 or a template, the internet traffic will go through tor.
|
||||
* **create usb qube holding all usb controllers:**
|
||||
just like the network qube for the network stack, the usb qube isolates the
|
||||
usb controllers.
|
||||
* **use sys-net qube for both networking and usb devices:**
|
||||
you should select this option if you rely on a usb device for network access,
|
||||
such as a usb modem or a usb wi-fi adapter.
|
||||
* **Do not configure anything:**
|
||||
This is for very advanced users only.
|
||||
If you select this option, you'll have to set everything up manually afterward.
|
||||
This is for very advanced users only. If you select this option, you'll have
|
||||
to set everything up manually afterward.
|
||||
|
||||
When you're satisfied with you choices, press **Done**.
|
||||
This configuration process may take a while, depending on the speed and compatibility of your system.
|
||||
When you're satisfied with you choices, press **Done**. This configuration
|
||||
process may take a while, depending on the speed and compatibility of your
|
||||
system.
|
||||
|
||||
After the configuration is done, you will be greeted by the login screen.
|
||||
Enter your password and log in.
|
||||
After the configuration is done, you will be greeted by the login screen. Enter
|
||||
your password and log in.
|
||||
|
||||
|
||||
|
||||
|
|
@ -350,46 +409,68 @@ Congratulations, you are now ready to use Qubes OS!
|
|||
|
||||
### Updating
|
||||
|
||||
Next, [update](/doc/updating-qubes-os/) your installation to ensure you have the latest security updates.
|
||||
Frequently updating is one of the best ways to remain secure against new threats.
|
||||
Next, [update](/doc/how-to-update/) your installation to ensure you have
|
||||
the latest security updates. Frequently updating is one of the best ways to
|
||||
remain secure against new threats.
|
||||
|
||||
### Security
|
||||
|
||||
The Qubes OS Project occasionally issues [Qubes Security Bulletins (QSBs)](/security/bulletins/) as part of the [Qubes Security Pack (qubes-secpack)](/security/pack/).
|
||||
It is important to make sure that you receive all QSBs in a timely manner so that you can take action to keep your system secure.
|
||||
(While [updating](#updating) will handle most security needs, there may be cases in which additional action from you is required.)
|
||||
For this reason, we strongly recommend that every Qubes user subscribe to the [qubes-announce](/support/#qubes-announce) mailing list.
|
||||
The Qubes OS Project occasionally issues [Qubes Security Bulletins
|
||||
(QSBs)](/security/bulletins/) as part of the [Qubes Security Pack
|
||||
(qubes-secpack)](/security/pack/). It is important to make sure that you
|
||||
receive all QSBs in a timely manner so that you can take action to keep your
|
||||
system secure. (While [updating](#updating) will handle most security needs,
|
||||
there may be cases in which additional action from you is required.) For this
|
||||
reason, we strongly recommend that every Qubes user subscribe to the
|
||||
[qubes-announce](/support/#qubes-announce) mailing list.
|
||||
|
||||
In addition to QSBs, the Qubes OS Project also publishes [Canaries](/security/canaries/), XSA summaries, template releases and end-of-life notices, and other items of interest to Qubes users.
|
||||
Since these are not essential for all Qubes users to read, they are not sent to [qubes-announce](/support/#qubes-announce) in order to keep the volume on that list low.
|
||||
However, we expect that most users, especially novice users, will find them helpful.
|
||||
If you are interested in these additional items, we encourage you to subscribe to the [Qubes News RSS feed](/feed.xml) or join one of our other [venues](/support/), where these news items are also announced.
|
||||
In addition to QSBs, the Qubes OS Project also publishes
|
||||
[Canaries](/security/canaries/), XSA summaries, template releases and
|
||||
end-of-life notices, and other items of interest to Qubes users. Since these
|
||||
are not essential for all Qubes users to read, they are not sent to
|
||||
[qubes-announce](/support/#qubes-announce) in order to keep the volume on that
|
||||
list low. However, we expect that most users, especially novice users, will
|
||||
find them helpful. If you are interested in these additional items, we
|
||||
encourage you to subscribe to the [Qubes News RSS feed](/feed.xml) or join one
|
||||
of our other [venues](/support/), where these news items are also announced.
|
||||
|
||||
For more information about Qubes OS Project security, please see the [security center](/security/).
|
||||
For more information about Qubes OS Project security, please see the [security
|
||||
center](/security/).
|
||||
|
||||
### Backups
|
||||
|
||||
It is extremely important to make regular backups so that you don't lose your data unexpectedly.
|
||||
The [Qubes backup system](/doc/backup-restore/) allows you to do this securely and easily.
|
||||
It is extremely important to make regular backups so that you don't lose your
|
||||
data unexpectedly. The [Qubes backup
|
||||
system](/doc/how-to-back-up-restore-and-migrate/) allows you to do this
|
||||
securely and easily.
|
||||
|
||||
### Submit your HCL report
|
||||
|
||||
Consider giving back to the Qubes community and helping other users by [generating and submitting a Hardware Compatibility List (HCL) report](/doc/hcl/#generating-and-submitting-new-reports).
|
||||
Consider giving back to the Qubes community and helping other users by
|
||||
[generating and submitting a Hardware Compatibility List (HCL)
|
||||
report](/doc/hcl/#generating-and-submitting-new-reports).
|
||||
|
||||
### Get Started
|
||||
|
||||
[Get Started](/doc/how-to-get-started/) with Qubes, check out the [How-to Guides](/doc/#how-to-guides), and learn about [Templates](/doc/#templates).
|
||||
See [How to Get Started](/doc/how-to-get-started/) with Qubes, check out the
|
||||
[How-to Guides](/doc/#how-to-guides), and learn about
|
||||
[Templates](/doc/#templates).
|
||||
|
||||
## Getting help
|
||||
|
||||
* We work very hard to make the [documentation](/doc/) accurate, comprehensive useful and user friendly.
|
||||
We urge you to read it! It may very well contain the answers to your questions.
|
||||
(Since the documentation is a community effort, we'd also greatly appreciate your help in [improving](/doc/doc-guidelines/) it!)
|
||||
* We work very hard to make the [documentation](/doc/) accurate, comprehensive
|
||||
useful and user friendly. We urge you to read it! It may very well contain
|
||||
the answers to your questions. (Since the documentation is a community
|
||||
effort, we'd also greatly appreciate your help in
|
||||
[improving](/doc/doc-guidelines/) it!)
|
||||
|
||||
* If issues arise during installation, see the [Installation Troubleshooting](/doc/installation-troubleshooting) guide.
|
||||
* If issues arise during installation, see the [Installation
|
||||
Troubleshooting](/doc/installation-troubleshooting) guide.
|
||||
|
||||
* If you don't find your answer in the documentation, please see [Help, Support, Mailing Lists, and Forum](/support/) for places to ask.
|
||||
* If you don't find your answer in the documentation, please see [Help,
|
||||
Support, Mailing Lists, and Forum](/support/) for places to ask.
|
||||
|
||||
* Please do **not** email individual members of the Qubes team with questions about installation or other problems.
|
||||
Instead, please see [Help, Support, Mailing Lists, and Forum](/support/) for appropriate places to ask questions.
|
||||
* Please do **not** email individual members of the Qubes team with questions
|
||||
about installation or other problems. Instead, please see [Help, Support,
|
||||
Mailing Lists, and Forum](/support/) for appropriate places to ask questions.
|
||||
|
||||
|
|
|
|||
|
|
@ -6,15 +6,16 @@ ref: 154
|
|||
title: Supported Versions
|
||||
---
|
||||
|
||||
|
||||
This page details the level and period of support for versions of operating systems in the Qubes ecosystem.
|
||||
This page details the level and period of support for versions of operating
|
||||
systems in the Qubes ecosystem.
|
||||
|
||||
## Qubes OS
|
||||
|
||||
Qubes OS releases are supported for **six months** after each subsequent major
|
||||
or minor release (see [Version Scheme](/doc/version-scheme/)). The current release and past major
|
||||
releases are always available on the [Downloads](/downloads/) page, while all ISOs, including
|
||||
past minor releases, are available from our [download mirrors](/downloads/#mirrors).
|
||||
or minor release (see [Version Scheme](/doc/version-scheme/)). The current
|
||||
release and past major releases are always available on the
|
||||
[Downloads](/downloads/) page, while all ISOs, including past minor releases,
|
||||
are available from our [download mirrors](/downloads/#mirrors).
|
||||
|
||||
| Qubes OS | Start Date | End Date | Status |
|
||||
| ----------- | ---------- | ---------- | --------------------- |
|
||||
|
|
@ -28,10 +29,12 @@ past minor releases, are available from our [download mirrors](/downloads/#mirro
|
|||
|
||||
### Note on point releases
|
||||
|
||||
Please note that point releases, such as 3.2.1 and 4.0.1, do not designate separate, new versions of Qubes OS.
|
||||
Rather, they designate their respective major or minor releases, such as 3.2 and 4.0, inclusive of all package updates up to a certain point.
|
||||
For example, installing Release 4.0 and fully updating it results in the same system as installing Release 4.0.1.
|
||||
Therefore, point releases are not displayed as separate rows on any of the tables on this page.
|
||||
Please note that point releases, such as 3.2.1 and 4.0.1, do not designate
|
||||
separate, new versions of Qubes OS. Rather, they designate their respective
|
||||
major or minor releases, such as 3.2 and 4.0, inclusive of all package updates
|
||||
up to a certain point. For example, installing Release 4.0 and fully updating
|
||||
it results in the same system as installing Release 4.0.1. Therefore, point
|
||||
releases are not displayed as separate rows on any of the tables on this page.
|
||||
|
||||
## Dom0
|
||||
|
||||
|
|
@ -49,51 +52,81 @@ The table below shows the OS used for dom0 in each Qubes OS release.
|
|||
|
||||
### Note on dom0 and EOL
|
||||
|
||||
Dom0 is isolated from domUs. DomUs can access only a few interfaces, such as Xen, device backends (in the dom0 kernel and in other VMs, such as the NetVM), and Qubes tools (gui-daemon, qrexec-daemon, etc.).
|
||||
These components are [security-critical](/doc/security-critical-code/), and we provide updates for all of them (when necessary), regardless of the support status of the base distribution.
|
||||
For this reason, we consider it safe to continue using a given base distribution in dom0 even after it has reached end-of-life (EOL).
|
||||
Dom0 is isolated from domUs. DomUs can access only a few interfaces, such as
|
||||
Xen, device backends (in the dom0 kernel and in other VMs, such as the NetVM),
|
||||
and Qubes tools (gui-daemon, qrexec-daemon, etc.). These components are
|
||||
[security-critical](/doc/security-critical-code/), and we provide updates for
|
||||
all of them (when necessary), regardless of the support status of the base
|
||||
distribution. For this reason, we consider it safe to continue using a given
|
||||
base distribution in dom0 even after it has reached end-of-life (EOL).
|
||||
|
||||
## Templates
|
||||
|
||||
The following table shows select [template](/doc/templates/) versions that are currently supported.
|
||||
Currently, only [Fedora](/doc/templates/fedora/) and [Debian](/doc/templates/debian/) templates are officially supported by the Qubes OS Project.
|
||||
[Whonix](/doc/whonix/) templates are supported by our partner, the [Whonix Project](https://www.whonix.org/).
|
||||
Qubes support for each template ends when that upstream release reaches end-of-life (EOL).
|
||||
Please see below for distribution-specific notes.
|
||||
The following table shows select [template](/doc/templates/) versions that are
|
||||
currently supported. Currently, only [Fedora](/doc/templates/fedora/) and
|
||||
[Debian](/doc/templates/debian/) templates are officially supported by the
|
||||
Qubes OS Project. [Whonix](/doc/whonix/) templates are supported by our
|
||||
partner, the [Whonix Project](https://www.whonix.org/). Qubes support for each
|
||||
template ends when that upstream release reaches end-of-life (EOL). Please see
|
||||
below for distribution-specific notes.
|
||||
|
||||
It is the responsibility of each distribution to clearly notify its users in advance of its own EOL dates, and it is users' responsibility to heed these notices by upgrading to supported releases.
|
||||
As a courtesy to Qubes users, we attempt to pass along any upstream EOL notices we receive for officially-supported templates, but our ability to do this reliably is dependent on the upstream distribution's practices.
|
||||
If a distribution provides a mailing list similar to [qubes-announce](/support/#qubes-announce), which allows us to receive only very important, infrequent messages, including EOL announcements, we are much more likely to be able to pass along EOL notices to Qubes users reliably.
|
||||
Qubes users can always check the EOL status of an upstream release on the upstream distribution's website (see [Fedora EOL](https://fedoraproject.org/wiki/End_of_life) and [Debian Releases](https://wiki.debian.org/DebianReleases)).
|
||||
It is the responsibility of each distribution to clearly notify its users in
|
||||
advance of its own EOL dates, and it is users' responsibility to heed these
|
||||
notices by upgrading to supported releases. As a courtesy to Qubes users, we
|
||||
attempt to pass along any upstream EOL notices we receive for
|
||||
officially-supported templates, but our ability to do this reliably is
|
||||
dependent on the upstream distribution's practices. If a distribution provides
|
||||
a mailing list similar to [qubes-announce](/support/#qubes-announce), which
|
||||
allows us to receive only very important, infrequent messages, including EOL
|
||||
announcements, we are much more likely to be able to pass along EOL notices to
|
||||
Qubes users reliably. Qubes users can always check the EOL status of an
|
||||
upstream release on the upstream distribution's website (see [Fedora
|
||||
EOL](https://fedoraproject.org/wiki/End_of_life) and [Debian
|
||||
Releases](https://wiki.debian.org/DebianReleases)).
|
||||
|
||||
| Qubes OS | Fedora | Debian | Whonix |
|
||||
| ----------- | ------ | ---------------------------------------- | ------ |
|
||||
| Release 4.0 | 33 | 9 ("stretch"),<sup>*</sup> 10 ("buster") | 15 |
|
||||
| Release 4.1 | 33 | 10 ("buster") | 15 |
|
||||
|
||||
<sup>\*</sup> Although Debian 9 has reached regular EOL and is now in [LTS](https://wiki.debian.org/LTS), we continue to support it for Qubes R4.0.
|
||||
This is a *temporary* exception to our [policy](#note-on-debian-support) of ending Qubes support at each Debian release's *regular* (not LTS) EOL date, since this policy was introduced after the release of Qubes R4.0.
|
||||
In Qubes R4.1 and beyond, Qubes support for each Debian release will end when that release reaches regular EOL and will not extend into LTS.
|
||||
<sup>\*</sup> Although Debian 9 has reached regular EOL and is now in
|
||||
[LTS](https://wiki.debian.org/LTS), we continue to support it for Qubes R4.0.
|
||||
This is a *temporary* exception to our [policy](#note-on-debian-support) of
|
||||
ending Qubes support at each Debian release's *regular* (not LTS) EOL date,
|
||||
since this policy was introduced after the release of Qubes R4.0. In Qubes R4.1
|
||||
and beyond, Qubes support for each Debian release will end when that release
|
||||
reaches regular EOL and will not extend into LTS.
|
||||
|
||||
### Note on Debian support
|
||||
|
||||
Debian releases have two EOL dates: regular and [long-term support (LTS)](https://wiki.debian.org/LTS).
|
||||
See [Debian Production Releases](https://wiki.debian.org/DebianReleases#Production_Releases) for a chart that illustrates this.
|
||||
Qubes support ends at the *regular* EOL date, *not* the LTS EOL date, unless a specific exception has been made.
|
||||
Debian releases have two EOL dates: regular and [long-term support
|
||||
(LTS)](https://wiki.debian.org/LTS). See [Debian Production
|
||||
Releases](https://wiki.debian.org/DebianReleases#Production_Releases) for a
|
||||
chart that illustrates this. Qubes support ends at the *regular* EOL date,
|
||||
*not* the LTS EOL date, unless a specific exception has been made.
|
||||
|
||||
### Note on Whonix support
|
||||
|
||||
[Whonix](/doc/whonix/) templates are supported by our partner, the [Whonix Project](https://www.whonix.org/).
|
||||
The Whonix Project has set its own support policy for Whonix templates in Qubes.
|
||||
[Whonix](/doc/whonix/) templates are supported by our partner, the [Whonix
|
||||
Project](https://www.whonix.org/). The Whonix Project has set its own support
|
||||
policy for Whonix templates in Qubes.
|
||||
|
||||
This policy requires Whonix template users to stay reasonably close to the cutting edge by upgrading to new stable versions of Qubes OS and Whonix templates within a month of their respective releases.
|
||||
To be precise:
|
||||
This policy requires Whonix template users to stay reasonably close to the
|
||||
cutting edge by upgrading to new stable versions of Qubes OS and Whonix
|
||||
templates within a month of their respective releases. To be precise:
|
||||
|
||||
* One month after a new stable version of Qubes OS is released, Whonix templates will no longer be supported on any older version of Qubes OS.
|
||||
This means that users who wish to continue using Whonix templates on Qubes must always upgrade to the latest stable Qubes OS version within one month of its release.
|
||||
* One month after a new stable version of Qubes OS is released, Whonix
|
||||
templates will no longer be supported on any older version of Qubes OS. This
|
||||
means that users who wish to continue using Whonix templates on Qubes must
|
||||
always upgrade to the latest stable Qubes OS version within one month of its
|
||||
release.
|
||||
|
||||
* One month after new stable versions of Whonix templates are released, older versions of Whonix templates will no longer be supported.
|
||||
This means that users who wish to continue using Whonix templates on Qubes must always upgrade to the latest stable Whonix template versions within one month of their release.
|
||||
* One month after new stable versions of Whonix templates are released, older
|
||||
versions of Whonix templates will no longer be supported. This means that
|
||||
users who wish to continue using Whonix templates on Qubes must always
|
||||
upgrade to the latest stable Whonix template versions within one month of
|
||||
their release.
|
||||
|
||||
We aim to announce both types of events one month in advance in order to remind users to upgrade.
|
||||
We aim to announce both types of events one month in advance in order to remind
|
||||
users to upgrade.
|
||||
|
||||
|
|
|
|||
|
|
@ -11,13 +11,16 @@ ref: 142
|
|||
title: System Requirements
|
||||
---
|
||||
|
||||
|
||||
<div class="alert alert-warning" role="alert">
|
||||
<i class="fa fa-exclamation-triangle"></i>
|
||||
<b>Notice:</b>
|
||||
The system requirements on this page are <em>necessary, but not sufficient,</em> for Qubes compatibility at a minimal or recommended level.
|
||||
In other words, just because a computer satisfies these requirements doesn't mean that Qubes will successfully install and run on it.
|
||||
We strongly recommend consulting the <a href="/hcl/">Hardware Compatibility List</a> to verify that Qubes can install and run on your specific model in the ways you need it to.
|
||||
The system requirements on this page are <em>necessary, but not
|
||||
sufficient,</em> for Qubes compatibility at a minimal or recommended level.
|
||||
In other words, just because a computer satisfies these requirements doesn't
|
||||
mean that Qubes will successfully install and run on it. We strongly
|
||||
recommend consulting the <a href="/hcl/">Hardware Compatibility List</a> to
|
||||
verify that Qubes can install and run on your specific model in the ways you
|
||||
need it to.
|
||||
</div>
|
||||
|
||||
## Minimum
|
||||
|
|
@ -37,32 +40,48 @@ title: System Requirements
|
|||
- **Storage:** 128 GB free space
|
||||
- High-speed solid-state drive strongly recommended
|
||||
- **Graphics:** Intel integrated graphics processor (IGP) strongly recommended
|
||||
- Nvidia GPUs may require significant [troubleshooting](/doc/install-nvidia-driver/)
|
||||
- AMD GPUs have not been formally tested, but Radeons (especially RX580 and earlier) generally work well
|
||||
- Nvidia GPUs may require significant
|
||||
[troubleshooting](/doc/install-nvidia-driver/)
|
||||
- AMD GPUs have not been formally tested, but Radeons (especially RX580 and
|
||||
earlier) generally work well
|
||||
- **Peripherals:** A non-USB keyboard or multiple USB controllers
|
||||
- **TPM:** Trusted Platform Module (TPM) with proper BIOS support (required for [Anti Evil Maid](/doc/anti-evil-maid/))
|
||||
- **Other:** Satisfaction of all [hardware certification requirements for Qubes 4.x](/news/2016/07/21/new-hw-certification-for-q4/)
|
||||
- **TPM:** Trusted Platform Module (TPM) with proper BIOS support (required for
|
||||
[Anti Evil Maid](/doc/anti-evil-maid/))
|
||||
- **Other:** Satisfaction of all [hardware certification requirements for Qubes
|
||||
4.x](/news/2016/07/21/new-hw-certification-for-q4/)
|
||||
|
||||
## Choosing Hardware
|
||||
|
||||
- Please see the [Hardware Compatibility List](/hcl/) for a compilation of hardware reports generated and submitted by users across various Qubes versions.
|
||||
(For more information about the HCL itself, see [here](/doc/hcl/).)
|
||||
- Please see the [Hardware Compatibility List](/hcl/) for a compilation of
|
||||
hardware reports generated and submitted by users across various Qubes
|
||||
versions. (For more information about the HCL itself, see [here](/doc/hcl/).)
|
||||
- See the [Certified Hardware](/doc/certified-hardware/) page.
|
||||
- See the [Hardware Testing](/doc/hardware-testing/) page.
|
||||
|
||||
## Important Notes
|
||||
|
||||
- **Installing Qubes in a virtual machine is not recommended, as it uses its own bare-metal hypervisor (Xen).**
|
||||
- Qubes **can** be installed on systems which do not meet the recommended requirements.
|
||||
Such systems will still offer significant security improvements over traditional operating systems, since things like GUI isolation and kernel protection do not require special hardware.
|
||||
- Qubes **can** be installed on a USB flash drive or external disk, and testing has shown that this works very well. A fast USB 3.0 flash drive is recommended for this.
|
||||
(As a reminder, its capacity must be at least 32 GiB.)
|
||||
Simply plug the flash drive into the computer before booting into the Qubes installer from a separate installation medium, choose the flash drive as the target installation disk, and proceed with the installation normally.
|
||||
After Qubes has been installed on the flash drive, it can then be plugged into other computers in order to boot into Qubes.
|
||||
In addition to the convenience of having a portable copy of Qubes, this allows users to test for hardware compatibility on multiple machines (e.g., at a brick-and-mortar computer
|
||||
store) before deciding on which computer to purchase.
|
||||
(See [hcl-report](/doc/hcl/#generating-and-submitting-new-reports) for advice on hardware compatibility testing.)
|
||||
Remember to change the devices assigned to your NetVM and USB VM if you move between different machines.
|
||||
- [Advice on finding a VT-d capable notebook](https://groups.google.com/d/msg/qubes-users/Sz0Nuhi4N0o/ZtpJdoc0OY8J).
|
||||
- You can check whether an Intel processor has VT-x and VT-d on [ark.intel.com](https://ark.intel.com/content/www/us/en/ark.html#@Processors).
|
||||
- **Installing Qubes in a virtual machine is not recommended, as it uses its
|
||||
own bare-metal hypervisor (Xen).**
|
||||
- Qubes **can** be installed on systems which do not meet the recommended
|
||||
requirements. Such systems will still offer significant security improvements
|
||||
over traditional operating systems, since things like GUI isolation and
|
||||
kernel protection do not require special hardware.
|
||||
- Qubes **can** be installed on a USB flash drive or external disk, and testing
|
||||
has shown that this works very well. A fast USB 3.0 flash drive is
|
||||
recommended for this. (As a reminder, its capacity must be at least 32 GiB.)
|
||||
Simply plug the flash drive into the computer before booting into the Qubes
|
||||
installer from a separate installation medium, choose the flash drive as the
|
||||
target installation disk, and proceed with the installation normally. After
|
||||
Qubes has been installed on the flash drive, it can then be plugged into
|
||||
other computers in order to boot into Qubes. In addition to the convenience
|
||||
of having a portable copy of Qubes, this allows users to test for hardware
|
||||
compatibility on multiple machines (e.g., at a brick-and-mortar computer
|
||||
store) before deciding on which computer to purchase. (See
|
||||
[hcl-report](/doc/hcl/#generating-and-submitting-new-reports) for advice on
|
||||
hardware compatibility testing.) Remember to change the devices assigned to
|
||||
your NetVM and USB VM if you move between different machines.
|
||||
- [Advice on finding a VT-d capable
|
||||
notebook](https://groups.google.com/d/msg/qubes-users/Sz0Nuhi4N0o/ZtpJdoc0OY8J).
|
||||
- You can check whether an Intel processor has VT-x and VT-d on
|
||||
[ark.intel.com](https://ark.intel.com/content/www/us/en/ark.html#@Processors).
|
||||
|
||||
|
|
|
|||
|
|
@ -21,21 +21,22 @@ any GNU/Linux system with the following procedure.
|
|||
Required `scrypt` Utility
|
||||
-------------------------
|
||||
|
||||
In Qubes 4.X, backups are encrypted and integrity-protected with [scrypt](https://www.tarsnap.com/scrypt.html). You
|
||||
will need a copy of this utility in order to access your data. Since `scrypt`
|
||||
is not pre-installed on every GNU/Linux system, it is strongly recommended that
|
||||
you store a copy of it with your backups. If your distribution has `scrypt`
|
||||
packaged (e.g., Debian), you can install the package in the standard way using
|
||||
your distribution's package manager. Otherwise, you'll need to obtain a
|
||||
compiled binary (instructions below) or compile the program from source
|
||||
yourself. (Don't forget to [verify signatures](/security/verifying-signatures) first!) Note that versions of
|
||||
`scrypt` up to 1.2.0 (inclusive) do not support the `-P` option for easier
|
||||
scripting, which means you'll need to enter the passphrase for each file
|
||||
In Qubes 4.X, backups are encrypted and integrity-protected with
|
||||
[scrypt](https://www.tarsnap.com/scrypt.html). You will need a copy of this
|
||||
utility in order to access your data. Since `scrypt` is not pre-installed on
|
||||
every GNU/Linux system, it is strongly recommended that you store a copy of it
|
||||
with your backups. If your distribution has `scrypt` packaged (e.g., Debian),
|
||||
you can install the package in the standard way using your distribution's
|
||||
package manager. Otherwise, you'll need to obtain a compiled binary
|
||||
(instructions below) or compile the program from source yourself. (Don't forget
|
||||
to [verify signatures](/security/verifying-signatures) first!) Note that
|
||||
versions of `scrypt` up to 1.2.0 (inclusive) do not support the `-P` option for
|
||||
easier scripting, which means you'll need to enter the passphrase for each file
|
||||
separately, instead of using `echo ... | scrypt`.
|
||||
|
||||
Here are instructions for obtaining a compiled `scrypt` binary. This example
|
||||
uses an RPM-based system (Fedora), but the same general procedure should work on
|
||||
any GNU/Linux system.
|
||||
uses an RPM-based system (Fedora), but the same general procedure should work
|
||||
on any GNU/Linux system.
|
||||
|
||||
1. If you're not on Qubes 4.X, [get and verify the Release 4 Signing Key](/security/verifying-signatures/#2-get-the-release-signing-key).
|
||||
2. If you're not on Qubes 4.X, import the Release 4 Signing Key.
|
||||
|
|
@ -143,7 +144,8 @@ Emergency Recovery Instructions
|
|||
|
||||
[user@restore ~]$ backup_id=20161020T123455-1234
|
||||
|
||||
6. Verify the integrity of your data, decrypt, decompress, and extract `private.img`:
|
||||
6. Verify the integrity of your data, decrypt, decompress, and extract
|
||||
`private.img`:
|
||||
|
||||
[user@restore ~]$ find vm1 -name 'private.img.*.enc' | sort -V | while read f_enc; do \
|
||||
f_dec=${f_enc%.enc}; \
|
||||
|
|
|
|||
|
|
@ -11,23 +11,27 @@ ref: 199
|
|||
title: How to Back Up, Restore, and Migrate
|
||||
---
|
||||
|
||||
With Qubes, it's easy and secure to back up and restore your whole system, as
|
||||
well as to migrate between two physical machines.
|
||||
|
||||
With Qubes, it's easy and secure to back up and restore your whole system, as well as to migrate between two physical machines.
|
||||
These functions are integrated into the Qube Manager. There are also two
|
||||
command-line tools available that perform the same functions: `qvm-backup` and
|
||||
`qvm-backup-restore`.
|
||||
|
||||
These functions are integrated into the Qube Manager.
|
||||
There are also two command-line tools available that perform the same functions: `qvm-backup` and `qvm-backup-restore`.
|
||||
|
||||
It's extremely important to make regular backups of all the data you care about.
|
||||
This is true of all computing, not just the use of Qubes.
|
||||
Data loss can and does occur in myriad and unexpected ways.
|
||||
A standard recommendation is to make backups at least weekly: three copies in two different formats, one off-site.
|
||||
It's extremely important to make regular backups of all the data you care
|
||||
about. This is true of all computing, not just the use of Qubes. Data loss can
|
||||
and does occur in myriad and unexpected ways. A standard recommendation is to
|
||||
make backups at least weekly: three copies in two different formats, one
|
||||
off-site.
|
||||
|
||||
Backing up changes to dom0
|
||||
--------------------------
|
||||
|
||||
When backing up dom0 using the Qubes backup tool (explained below), only the home directory is backed up.
|
||||
Therefore, if there are files outside of the home directory you wish to save, you should copy them into the home directory prior to creating a backup.
|
||||
Here is an example of how to back up Qubes config files and RPC policies:
|
||||
When backing up dom0 using the Qubes backup tool (explained below), only the
|
||||
home directory is backed up. Therefore, if there are files outside of the home
|
||||
directory you wish to save, you should copy them into the home directory prior
|
||||
to creating a backup. Here is an example of how to back up Qubes config files
|
||||
and RPC policies:
|
||||
|
||||
```
|
||||
$ mkdir -p ~/backup/etc/qubes/
|
||||
|
|
@ -36,106 +40,149 @@ $ mkdir ~/backup/etc/qubes-rpc/
|
|||
$ cp -a /etc/qubes-rpc/* ~/systemfiles/etc/qubes-rpc/
|
||||
```
|
||||
|
||||
To restore these files, move them from the restored directory in dom0's home back to their appropriate locations in `/etc/`.
|
||||
Please note that any packages installed via the package manager in dom0 will not be backed up.
|
||||
Such packages will have to be reinstalled through the package manager when restoring on a fresh installation.
|
||||
To restore these files, move them from the restored directory in dom0's home
|
||||
back to their appropriate locations in `/etc/`. Please note that any packages
|
||||
installed via the package manager in dom0 will not be backed up. Such packages
|
||||
will have to be reinstalled through the package manager when restoring on a
|
||||
fresh installation.
|
||||
|
||||
Creating a backup
|
||||
-----------------
|
||||
|
||||
1. Go to **Applications menu -> System Tools -> Backup Qubes**.
|
||||
This brings up the **Qubes Backup VMs** window.
|
||||
1. Go to **Applications menu -> System Tools -> Backup Qubes**. This brings up
|
||||
the **Qubes Backup VMs** window.
|
||||
|
||||
2. Move the VMs that you want to back up to the right-hand **Selected** column.
|
||||
VMs in the left-hand **Available** column will not be backed up.
|
||||
|
||||
You may choose whether to compress backups by checking or unchecking the **Compress the backup** box.
|
||||
Normally this should be left on unless you have a specific reason otherwise.
|
||||
You may choose whether to compress backups by checking or unchecking the
|
||||
**Compress the backup** box. Normally this should be left on unless you have
|
||||
a specific reason otherwise.
|
||||
|
||||
Once you have selected all desired VMs, click **Next**.
|
||||
|
||||
3. Select the destination for the backup:
|
||||
|
||||
If you wish to send your backup to a (currently running) VM, select the VM in the drop-down box next to **Target app qube**.
|
||||
If you wish to send your backup to a [USB mass storage device](/doc/usb/), you can use the directory selection widget to mount a connected device (under "Other locations" item on the left); or first mount the device in a VM, then select the mount point inside that VM as the backup destination.
|
||||
If you wish to send your backup to a (currently running) VM, select the VM
|
||||
in the drop-down box next to **Target app qube**. If you wish to send your
|
||||
backup to a [USB mass storage device](/doc/usb/), you can use the directory
|
||||
selection widget to mount a connected device (under "Other locations" item
|
||||
on the left); or first mount the device in a VM, then select the mount point
|
||||
inside that VM as the backup destination.
|
||||
|
||||
You must also specify a directory on the device or in the VM, or a command to be executed in the VM as a destination for your backup.
|
||||
For example, if you wish to send your backup to the `~/backups` folder in the target VM, you would simply browse to it using the convenient directory selection dialog (`...`) at the right.
|
||||
This destination directory must already exist.
|
||||
If it does not exist, you must create it manually prior to backing up.
|
||||
You must also specify a directory on the device or in the VM, or a command
|
||||
to be executed in the VM as a destination for your backup. For example, if
|
||||
you wish to send your backup to the `~/backups` folder in the target VM, you
|
||||
would simply browse to it using the convenient directory selection dialog
|
||||
(`...`) at the right. This destination directory must already exist. If it
|
||||
does not exist, you must create it manually prior to backing up.
|
||||
|
||||
By specifying the appropriate directory as the destination in a VM, it is possible to send the backup directly to, e.g., a USB mass storage device attached to the VM.
|
||||
Likewise, it is possible to enter any command as a backup target by specifying the command as the destination in the VM.
|
||||
This can be used to send your backup directly to, e.g., a remote server using SSH.
|
||||
By specifying the appropriate directory as the destination in a VM, it is
|
||||
possible to send the backup directly to, e.g., a USB mass storage device
|
||||
attached to the VM. Likewise, it is possible to enter any command as a
|
||||
backup target by specifying the command as the destination in the VM. This
|
||||
can be used to send your backup directly to, e.g., a remote server using
|
||||
SSH.
|
||||
|
||||
**Note:** The supplied passphrase is used for **both** encryption/decryption and integrity verification.
|
||||
**Note:** The supplied passphrase is used for **both** encryption/decryption
|
||||
and integrity verification.
|
||||
|
||||
At this point, you may also choose whether to save your settings by checking or unchecking the **Save settings as default backup profile** box.
|
||||
At this point, you may also choose whether to save your settings by checking
|
||||
or unchecking the **Save settings as default backup profile** box.
|
||||
|
||||
**Warning: Saving the settings will result in your backup passphrase being saved in plaintext in dom0, so consider your threat model before checking this box.**
|
||||
**Warning: Saving the settings will result in your backup passphrase being
|
||||
saved in plaintext in dom0, so consider your threat model before checking
|
||||
this box.**
|
||||
|
||||
4. You will now see the summary of VMs to be backed up.
|
||||
If there are any issues preventing the backup, they will be listed here and the **Next** button grayed out.
|
||||
4. You will now see the summary of VMs to be backed up. If there are any issues
|
||||
preventing the backup, they will be listed here and the **Next** button
|
||||
grayed out.
|
||||
|
||||
5. When you are ready, click **Next**.
|
||||
Qubes will proceed to create your backup.
|
||||
Once the progress bar has completed, you may click **Finish**.
|
||||
5. When you are ready, click **Next**. Qubes will proceed to create your
|
||||
backup. Once the progress bar has completed, you may click **Finish**.
|
||||
|
||||
6. Test restore your backup.
|
||||
Follow the [restore procedure](#restoring-from-a-backup), selecting **Verify backup integrity, do not restore the data**.
|
||||
This step is optional but strongly recommended.
|
||||
A backup is useless if you can't restore your data from it, and you can't be sure that your backup is good until you try to restore.
|
||||
6. Test restore your backup. Follow the [restore
|
||||
procedure](#restoring-from-a-backup), selecting **Verify backup integrity,
|
||||
do not restore the data**. This step is optional but strongly recommended. A
|
||||
backup is useless if you can't restore your data from it, and you can't be
|
||||
sure that your backup is good until you try to restore.
|
||||
|
||||
Restoring from a backup
|
||||
-----------------------
|
||||
|
||||
1. Go to **Applications menu -> System Tools -> Restore Backup**.
|
||||
This brings up the **Qubes Restore VMs** window.
|
||||
1. Go to **Applications menu -> System Tools -> Restore Backup**. This brings
|
||||
up the **Qubes Restore VMs** window.
|
||||
|
||||
2. Select the source location of the backup to be restored:
|
||||
|
||||
- If your backup is located on a [USB mass storage device](/doc/usb/), attach it first to another VM or select `sys-usb` in the next item.
|
||||
- If your backup is located in a (currently running) VM, select the VM in the drop-down box next to **app qube**.
|
||||
- If your backup is located on a [USB mass storage device](/doc/usb/),
|
||||
attach it first to another VM or select `sys-usb` in the next item.
|
||||
- If your backup is located in a (currently running) VM, select the VM in
|
||||
the drop-down box next to **app qube**.
|
||||
|
||||
You must also specify the directory and filename of the backup (or a command to be executed in a VM) in the **Backup file** field.
|
||||
If you followed the instructions in the previous section, "Creating a Backup," then your backup is most likely in the location you chose as the destination in step 3.
|
||||
For example, if you had chosen the `~/backups` directory of a VM as your destination in step 3, you would now select the same VM and again browse to (using `...`) the `backups` folder.
|
||||
Once you've located the backup file, double-click it or select it and hit **OK**.
|
||||
You must also specify the directory and filename of the backup (or a command
|
||||
to be executed in a VM) in the **Backup file** field. If you followed the
|
||||
instructions in the previous section, "Creating a Backup," then your backup
|
||||
is most likely in the location you chose as the destination in step 3. For
|
||||
example, if you had chosen the `~/backups` directory of a VM as your
|
||||
destination in step 3, you would now select the same VM and again browse to
|
||||
(using `...`) the `backups` folder. Once you've located the backup file,
|
||||
double-click it or select it and hit **OK**.
|
||||
|
||||
3. There are three options you may select when restoring from a backup:
|
||||
1. **ignore missing templates and net VMs**: If any of the VMs in your backup depended upon a NetVM or template that is not present in (i.e., "missing from") the current system, checking this box will ignore the fact that they are missing and restore the VMs anyway and set them to use the default NetVM and system default template.
|
||||
2. **ignore username mismatch**: This option applies only to the restoration of dom0's home directory.
|
||||
If your backup was created on a Qubes system which had a different dom0 username than the dom0 username of the current system, then checking this box will ignore the mismatch between the two usernames and proceed to restore the home directory anyway.
|
||||
3. **Verify backup integrity, do not restore the data**: This will scan the backup file for corrupted data.
|
||||
However, it does not currently detect if it is missing data as long as it is a correctly structured, non-corrupted backup file.
|
||||
See [issue #3498](https://github.com/QubesOS/qubes-issues/issues/3498) for more details.
|
||||
1. **ignore missing templates and net VMs**: If any of the VMs in your
|
||||
backup depended upon a NetVM or template that is not present in (i.e.,
|
||||
"missing from") the current system, checking this box will ignore the fact
|
||||
that they are missing and restore the VMs anyway and set them to use the
|
||||
default NetVM and system default template.
|
||||
2. **ignore username mismatch**: This option applies only to the restoration
|
||||
of dom0's home directory. If your backup was created on a Qubes system which
|
||||
had a different dom0 username than the dom0 username of the current system,
|
||||
then checking this box will ignore the mismatch between the two usernames
|
||||
and proceed to restore the home directory anyway.
|
||||
3. **Verify backup integrity, do not restore the data**: This will scan the
|
||||
backup file for corrupted data. However, it does not currently detect if it
|
||||
is missing data as long as it is a correctly structured, non-corrupted
|
||||
backup file. See [issue
|
||||
#3498](https://github.com/QubesOS/qubes-issues/issues/3498) for more
|
||||
details.
|
||||
|
||||
4. If your backup is encrypted, you must check the **Encrypted backup** box.
|
||||
If a passphrase was supplied during the creation of your backup (regardless of whether it is encrypted), then you must supply it here.
|
||||
4. If your backup is encrypted, you must check the **Encrypted backup** box. If
|
||||
a passphrase was supplied during the creation of your backup (regardless of
|
||||
whether it is encrypted), then you must supply it here.
|
||||
|
||||
**Note:** The passphrase which was supplied when the backup was created is used for **both** encryption/decryption and integrity verification.
|
||||
If the backup was not encrypted, the supplied passphrase is used only for integrity verification.
|
||||
All backups made from a Qubes R4.0 system will be encrypted.
|
||||
**Note:** The passphrase which was supplied when the backup was created is
|
||||
used for **both** encryption/decryption and integrity verification. If the
|
||||
backup was not encrypted, the supplied passphrase is used only for integrity
|
||||
verification. All backups made from a Qubes R4.0 system will be encrypted.
|
||||
|
||||
5. You will now see the summary of VMs to be restored.
|
||||
If there are any issues preventing the restore, they will be listed here and the **Next** button grayed out.
|
||||
5. You will now see the summary of VMs to be restored. If there are any issues
|
||||
preventing the restore, they will be listed here and the **Next** button grayed
|
||||
out.
|
||||
|
||||
6. When you are ready, click **Next**.
|
||||
Qubes will proceed to restore from your backup.
|
||||
Once the progress bar has completed, you may click **Finish**.
|
||||
6. When you are ready, click **Next**. Qubes will proceed to restore from your
|
||||
backup. Once the progress bar has completed, you may click **Finish**.
|
||||
|
||||
**Note:** When restoring from a dom0 backup, a new directory will be created in the current dom0 home directory, and the contents from the backup will be placed inside this new directory.
|
||||
This is intentional, as it allows users to have explicit control over which files and settings get applied in dom0.
|
||||
If the contents from the dom0 backup were instead to overwrite the existing files in dom0's home directory, unexpected and undesired configuration changes could occur.
|
||||
However, if you do wish to move all files from the dom0 backup out of the subdirectory into your current dom0 home directory (overwriting any existing files in the process), you may do so by following the instructions [here](https://stackoverflow.com/questions/20192070/how-to-move-all-files-including-hidden-files-into-parent-directory-via).
|
||||
Just remember that this can cause unexpected and desired configuration changes in dom0, depending on exactly which files you're adding and replacing.
|
||||
**Note:** When restoring from a dom0 backup, a new directory will be created in
|
||||
the current dom0 home directory, and the contents from the backup will be
|
||||
placed inside this new directory. This is intentional, as it allows users to
|
||||
have explicit control over which files and settings get applied in dom0. If the
|
||||
contents from the dom0 backup were instead to overwrite the existing files in
|
||||
dom0's home directory, unexpected and undesired configuration changes could
|
||||
occur. However, if you do wish to move all files from the dom0 backup out of
|
||||
the subdirectory into your current dom0 home directory (overwriting any
|
||||
existing files in the process), you may do so by following the instructions
|
||||
[here](https://stackoverflow.com/questions/20192070/how-to-move-all-files-including-hidden-files-into-parent-directory-via).
|
||||
Just remember that this can cause unexpected and desired configuration changes
|
||||
in dom0, depending on exactly which files you're adding and replacing.
|
||||
|
||||
Emergency backup recovery without qubes
|
||||
---------------------------------------
|
||||
|
||||
The Qubes backup system has been designed with emergency disaster recovery in mind.
|
||||
No special Qubes-specific tools are required to access data backed up by Qubes.
|
||||
In the event a Qubes system is unavailable, you can access your data on any GNU/Linux system with the following procedure.
|
||||
The Qubes backup system has been designed with emergency disaster recovery in
|
||||
mind. No special Qubes-specific tools are required to access data backed up by
|
||||
Qubes. In the event a Qubes system is unavailable, you can access your data on
|
||||
any GNU/Linux system with the following procedure.
|
||||
|
||||
Refer to the following for emergency restore of a backup created on:
|
||||
|
||||
|
|
@ -146,25 +193,37 @@ Refer to the following for emergency restore of a backup created on:
|
|||
Migrating between two physical machines
|
||||
---------------------------------------
|
||||
|
||||
In order to migrate your Qubes system from one physical machine to another, simply follow the backup procedure on the old machine, [install Qubes](/downloads/) on the new machine, and follow the restoration procedure on the new machine.
|
||||
All of your settings and data will be preserved!
|
||||
In order to migrate your Qubes system from one physical machine to another,
|
||||
simply follow the backup procedure on the old machine, [install
|
||||
Qubes](/downloads/) on the new machine, and follow the restoration procedure on
|
||||
the new machine. All of your settings and data will be preserved!
|
||||
|
||||
Choosing a backup passphrase
|
||||
----------------------------
|
||||
|
||||
Here are some things to consider when selecting a passphrase for your backups:
|
||||
|
||||
- If you plan to store the backup for a long time or on third-party servers, you should make sure to use a very long, high-entropy passphrase.
|
||||
(Depending on the decryption passphrase you use for your system drive, this may necessitate selecting a stronger passphrase.
|
||||
If your system drive decryption passphrase is already sufficiently strong, it may not.)
|
||||
- An adversary who has access to your backups may try to substitute one backup for another.
|
||||
For example, when you attempt to retrieve a recent backup, the adversary may instead give you a very old backup containing a compromised VM.
|
||||
If you're concerned about this type of attack, you may wish to use a different passphrase for each backup, e.g., by appending a number or date to the passphrase.
|
||||
- If you're forced to enter your system drive decryption passphrase in plain view of others (where it can be shoulder-surfed), then you may want to use a different passphrase for your backups (even if your system drive decryption passphrase is already maximally strong).
|
||||
On the other hand, if you're careful to avoid shoulder-surfing and/or have a passphrase that's difficult to detect via shoulder-surfing, then this may not be a problem for you.
|
||||
- If you plan to store the backup for a long time or on third-party servers,
|
||||
you should make sure to use a very long, high-entropy passphrase. (Depending
|
||||
on the decryption passphrase you use for your system drive, this may
|
||||
necessitate selecting a stronger passphrase. If your system drive decryption
|
||||
passphrase is already sufficiently strong, it may not.)
|
||||
- An adversary who has access to your backups may try to substitute one backup
|
||||
for another. For example, when you attempt to retrieve a recent backup, the
|
||||
adversary may instead give you a very old backup containing a compromised VM.
|
||||
If you're concerned about this type of attack, you may wish to use a
|
||||
different passphrase for each backup, e.g., by appending a number or date to
|
||||
the passphrase.
|
||||
- If you're forced to enter your system drive decryption passphrase in plain
|
||||
view of others (where it can be shoulder-surfed), then you may want to use a
|
||||
different passphrase for your backups (even if your system drive decryption
|
||||
passphrase is already maximally strong). On the other hand, if you're careful
|
||||
to avoid shoulder-surfing and/or have a passphrase that's difficult to detect
|
||||
via shoulder-surfing, then this may not be a problem for you.
|
||||
|
||||
Notes
|
||||
-----
|
||||
Notes -----
|
||||
|
||||
- For the technical details of the backup system, please refer to [this thread](https://groups.google.com/d/topic/qubes-devel/TQr_QcXIVww/discussion).
|
||||
- If working with symlinks, note the issues described in [this thread](https://groups.google.com/d/topic/qubes-users/EITd1kBHD30/discussion).
|
||||
- For the technical details of the backup system, please refer to [this
|
||||
thread](https://groups.google.com/d/topic/qubes-devel/TQr_QcXIVww/discussion).
|
||||
- If working with symlinks, note the issues described in [this
|
||||
thread](https://groups.google.com/d/topic/qubes-users/EITd1kBHD30/discussion).
|
||||
|
|
|
|||
|
|
@ -12,68 +12,140 @@ ref: 190
|
|||
title: How to Get Started
|
||||
---
|
||||
|
||||
After [downloading](/downloads/) and [installing](/doc/installation-guide/) Qubes OS, it's time to dive in and get to work!
|
||||
After [downloading](/downloads/) and [installing](/doc/installation-guide/)
|
||||
Qubes OS, it's time to dive in and get to work!
|
||||
|
||||
## The Basics
|
||||
|
||||
Qubes OS is an operating system built out of securely-isolated compartments called **qubes**. For example, you might have a work qube, a personal qube, a banking qube, a web browsing qube, and so on. You can have as many qubes as you want!
|
||||
Most of the time, you'll be using an **app qube**, which is a qube intended for running software programs like web browsers, email clients, and word processors. Each app qube is based on a **template qube**. More than one qube can be based on the same template. Importantly, a qube cannot modify its template in any way. This means that, if a qube is ever compromised, its template and any other qubes based on that template will remain safe. This is what makes Qubes OS so secure. Even if an attack is successful, the damage is limited to a single qube.
|
||||
Qubes OS is an operating system built out of securely-isolated compartments
|
||||
called **qubes**. For example, you might have a work qube, a personal qube, a
|
||||
banking qube, a web browsing qube, and so on. You can have as many qubes as you
|
||||
want! Most of the time, you'll be using an **app qube**, which is a qube
|
||||
intended for running software programs like web browsers, email clients, and
|
||||
word processors. Each app qube is based on a **template qube**. More than one
|
||||
qube can be based on the same template. Importantly, a qube cannot modify its
|
||||
template in any way. This means that, if a qube is ever compromised, its
|
||||
template and any other qubes based on that template will remain safe. This is
|
||||
what makes Qubes OS so secure. Even if an attack is successful, the damage is
|
||||
limited to a single qube.
|
||||
|
||||
Suppose you want to use your favorite web browser in several different qubes. You'd install the web browser in a template, then every qube based on that template would be able to run the web browser software (while still being forbidden from modifying the template and any other qubes). This way, you only have to install the web browser a single time, and updating the template serves to update all the qubes based on it. This elegant design saves time and space while enhancing security.
|
||||
Suppose you want to use your favorite web browser in several different qubes.
|
||||
You'd install the web browser in a template, then every qube based on that
|
||||
template would be able to run the web browser software (while still being
|
||||
forbidden from modifying the template and any other qubes). This way, you only
|
||||
have to install the web browser a single time, and updating the template serves
|
||||
to update all the qubes based on it. This elegant design saves time and space
|
||||
while enhancing security.
|
||||
|
||||
There are also some "helper" qubes in your system. Each qube that connects to the Internet does so through a network-providing **service qube**. If you need to access USB devices, another service qube will do that. There's also a **management qube** that automatically handles a lot of background housekeeping. For the most part, you won't have to worry about it, but it's nice to know that it's there.
|
||||
As with app qubes, service qubes and management qubes are also based on templates. Templates are usually named after their operating system (often a [Linux distribution](https://en.wikipedia.org/wiki/Linux_distribution)) and corresponding version number. There are many ready-to-use [templates](/doc/templates) to choose from, and you can download and have as many as you like.
|
||||
There are also some "helper" qubes in your system. Each qube that connects to
|
||||
the Internet does so through a network-providing **service qube**. If you need
|
||||
to access USB devices, another service qube will do that. There's also a
|
||||
**management qube** that automatically handles a lot of background
|
||||
housekeeping. For the most part, you won't have to worry about it, but it's
|
||||
nice to know that it's there. As with app qubes, service qubes and management
|
||||
qubes are also based on templates. Templates are usually named after their
|
||||
operating system (often a [Linux
|
||||
distribution](https://en.wikipedia.org/wiki/Linux_distribution)) and
|
||||
corresponding version number. There are many ready-to-use
|
||||
[templates](/doc/templates) to choose from, and you can download and have as
|
||||
many as you like.
|
||||
|
||||
Last but not least, there's a very special **admin qube** which, as the name suggests, is used to administer your entire system. There's only one admin qube, and it's called **dom0**. You can think of it as the master qube, holding ultimate power over everything that happens in Qubes OS. Dom0 is more trusted than any other qube. If dom0 were ever compromised, it would be "game over." The entire system would effectively be compromised. That's why everything in Qubes OS is specifically designed to protect dom0 and ensure that doesn't happen.
|
||||
Due to its overarching importance, dom0 has no network connectivity and is used only for running the [desktop environment](https://en.wikipedia.org/wiki/Desktop_environment) and [window manager](https://en.wikipedia.org/wiki/Window_manager). Dom0 should never be used for anything else. In particular, you should never run user applications in dom0. (That's what your app qubes are for!)
|
||||
Last but not least, there's a very special **admin qube** which, as the name
|
||||
suggests, is used to administer your entire system. There's only one admin
|
||||
qube, and it's called **dom0**. You can think of it as the master qube, holding
|
||||
ultimate power over everything that happens in Qubes OS. Dom0 is more trusted
|
||||
than any other qube. If dom0 were ever compromised, it would be "game over."
|
||||
The entire system would effectively be compromised. That's why everything in
|
||||
Qubes OS is specifically designed to protect dom0 and ensure that doesn't
|
||||
happen. Due to its overarching importance, dom0 has no network connectivity and
|
||||
is used only for running the [desktop
|
||||
environment](https://en.wikipedia.org/wiki/Desktop_environment) and [window
|
||||
manager](https://en.wikipedia.org/wiki/Window_manager). Dom0 should never be
|
||||
used for anything else. In particular, you should never run user applications
|
||||
in dom0. (That's what your app qubes are for!)
|
||||
|
||||
### Color & Security
|
||||
|
||||
You'll choose a **color** for each of your qubes out of a predefined set of colors. Each window on your desktop will have its frame colored according to the color of that qube. These colored frames help you keep track of which qube each window belongs to and how trustworthy it is. This is especially helpful when you have the same app running in multiple qubes at the same time. For example, if you're logged in to your bank account in one qube while doing some random web surfing in a different qube, you wouldn't want to accidentally enter your banking password in the latter! The colored frames help to avoid such mistakes.
|
||||
You'll choose a **color** for each of your qubes out of a predefined set of
|
||||
colors. Each window on your desktop will have its frame colored according to
|
||||
the color of that qube. These colored frames help you keep track of which qube
|
||||
each window belongs to and how trustworthy it is. This is especially helpful
|
||||
when you have the same app running in multiple qubes at the same time. For
|
||||
example, if you're logged in to your bank account in one qube while doing some
|
||||
random web surfing in a different qube, you wouldn't want to accidentally enter
|
||||
your banking password in the latter! The colored frames help to avoid such
|
||||
mistakes.
|
||||
|
||||
[](/attachment/doc/r4.0-snapshot_40.png)
|
||||
|
||||
Most Qubes users associate red with what's untrusted and dangerous (like a red light: stop! danger!), green with what's safe and trusted, and yellow and orange with things in the middle. This color scheme also extends to include blue and black, which are usually interpreted as indicating progressively more trusted domains than green, with black being ultimately trusted.
|
||||
Color and associated meanings are ultimately up to you, however. The system itself does not treat the colors differently. If you create two identical qubes --- black and red, say --- they'll be the same until you start using them differently. Feel free to use the colors in whatever way is most useful to you. For example, you might decide to use three or four qubes for work activities and give them all the same color --- or all different colors. It's entirely up to you.
|
||||
Most Qubes users associate red with what's untrusted and dangerous (like a red
|
||||
light: stop! danger!), green with what's safe and trusted, and yellow and
|
||||
orange with things in the middle. This color scheme also extends to include
|
||||
blue and black, which are usually interpreted as indicating progressively more
|
||||
trusted domains than green, with black being ultimately trusted. Color and
|
||||
associated meanings are ultimately up to you, however. The system itself does
|
||||
not treat the colors differently. If you create two identical qubes --- black
|
||||
and red, say --- they'll be the same until you start using them differently.
|
||||
Feel free to use the colors in whatever way is most useful to you. For example,
|
||||
you might decide to use three or four qubes for work activities and give them
|
||||
all the same color --- or all different colors. It's entirely up to you.
|
||||
|
||||
### User Interface
|
||||
|
||||
On operating systems like Windows and macOS, the desktop environment is unchangeable and part of that operating system. With Linux, any of a number of desktop environments are an option. Qubes OS is installed with XFCE as its default desktop environment, but it also supports KDE, as well as the i3 and awesome window managers.
|
||||
On operating systems like Windows and macOS, the desktop environment is
|
||||
unchangeable and part of that operating system. With Linux, any of a number of
|
||||
desktop environments are an option. Qubes OS is installed with XFCE as its
|
||||
default desktop environment, but it also supports KDE, as well as the i3 and
|
||||
awesome window managers.
|
||||
|
||||
[](/attachment/doc/r4.0-taskbar.png)
|
||||
|
||||
The bar at the top of your screen in Qubes 4.0 includes the following XFCE component areas:
|
||||
The bar at the top of your screen in Qubes 4.0 includes the following XFCE
|
||||
component areas:
|
||||
|
||||
- The **Tray**, where many functional widgets live.
|
||||
- **Spaces**, an interface for [virtual desktops](https://en.wikipedia.org/wiki/Virtual_desktop). Virtual desktops do not have any inherent security isolation properties, but some users find them useful for organizing things.
|
||||
- **Spaces**, an interface for [virtual
|
||||
desktops](https://en.wikipedia.org/wiki/Virtual_desktop). Virtual desktops
|
||||
do not have any inherent security isolation properties, but some users find
|
||||
them useful for organizing things.
|
||||
- The **Task Bar** where buttons for open and hidden windows live.
|
||||
- The **App Menu**, where you go to open an application within a qube, to open a dom0 terminal, to access administrative UI tools such as the Qube Manager, or to access settings panels for your desktop environment.
|
||||
- The **App Menu**, where you go to open an application within a qube, to open
|
||||
a dom0 terminal, to access administrative UI tools such as the Qube Manager,
|
||||
or to access settings panels for your desktop environment.
|
||||
|
||||
To learn more about how to customize your desktop environment, we recommend you spend some time going through [XFCE's documentation](https://docs.xfce.org/).
|
||||
To learn more about how to customize your desktop environment, we recommend you
|
||||
spend some time going through [XFCE's documentation](https://docs.xfce.org/).
|
||||
|
||||
There are several Tray widgets that are custom to Qubes OS:
|
||||
|
||||
- The **Qubes Domains** widget allows you to manage running qubes, turn them on and off, and monitor memory usage.
|
||||
- The **Qubes Devices** widget allows you to attach and detach devices --- such as USB drives and cameras --- to qubes.
|
||||
- The **Qubes Disk Space Monitor** will notify you if you're ever running out of disk space.
|
||||
- The **Qubes Domains** widget allows you to manage running qubes, turn them
|
||||
on and off, and monitor memory usage.
|
||||
- The **Qubes Devices** widget allows you to attach and detach devices ---
|
||||
such as USB drives and cameras --- to qubes.
|
||||
- The **Qubes Disk Space Monitor** will notify you if you're ever running out
|
||||
of disk space.
|
||||
- The **Qubes Update** tool will inform you when updates are available.
|
||||
|
||||
[](/attachment/doc/r4.0-q40_widgets.png)
|
||||
|
||||
To see all of your qubes at the same time, you can use the **Qube Manager** (go to the App Menu → System Tools → Qube Manager), which displays the states of all the qubes in your system, even the ones that aren't running.
|
||||
To see all of your qubes at the same time, you can use the **Qube Manager** (go
|
||||
to the App Menu → System Tools → Qube Manager), which displays the states of
|
||||
all the qubes in your system, even the ones that aren't running.
|
||||
|
||||
[](/attachment/doc/r4.0-qubes-manager.png)
|
||||
|
||||
#### Command-line interface
|
||||
|
||||
All aspects of Qubes OS can be controlled using command-line tools. Opening a terminal emulator in dom0 can be done in several ways:
|
||||
All aspects of Qubes OS can be controlled using command-line tools. Opening a
|
||||
terminal emulator in dom0 can be done in several ways:
|
||||
|
||||
- Go to the App Menu and select **Terminal Emulator** at the top.
|
||||
- Press <kbd>Alt</kbd>+<kbd>F3</kbd> and search for `xfce terminal`.
|
||||
- Right-click on the desktop and select **Open Terminal Here**.
|
||||
|
||||
Terminal emulators can also be run in other qubes as normal programs.
|
||||
Various command-line tools are described as part of this guide, and the whole reference can be found [here](/doc/tools/).
|
||||
Terminal emulators can also be run in other qubes as normal programs. Various
|
||||
command-line tools are described as part of this guide, and the whole reference
|
||||
can be found [here](/doc/tools/).
|
||||
|
||||
## First boot
|
||||
|
||||
|
|
@ -82,13 +154,23 @@ When you install Qubes OS, a number of qubes are pre-configured for you:
|
|||
- **Templates:** `fedora-XX` (`XX` being the version number)
|
||||
- **Admin qube:** `dom0`
|
||||
- **Service qubes:** `sys-usb`, `sys-net`, `sys-firewall`, and `sys-whonix`
|
||||
- **App qubes** configured to prioritize security by compartmentalizing tasks and types of data: `work`, `personal`, `untrusted`, and `vault`. (There is nothing special about these qubes. If you were to create a black qube and name it `vault`, it would be the same as the pre-configured `vault` qube. They're just suggestions to get you started. )
|
||||
- **App qubes** configured to prioritize security by compartmentalizing tasks
|
||||
and types of data: `work`, `personal`, `untrusted`, and `vault`. (There is
|
||||
nothing special about these qubes. If you were to create a black qube and
|
||||
name it `vault`, it would be the same as the pre-configured `vault` qube.
|
||||
They're just suggestions to get you started. )
|
||||
|
||||
A variety of open-source applications such as file managers, command-line terminals, printer managers, text editors, and "applets" used to configure different things like audio or parts of the user interface are also installed by default—most within the templates. Most are bundled with each template.
|
||||
A variety of open-source applications such as file managers, command-line
|
||||
terminals, printer managers, text editors, and "applets" used to configure
|
||||
different things like audio or parts of the user interface are also installed
|
||||
by default—most within the templates. Most are bundled with each template.
|
||||
|
||||
### Adding, removing, and listing qubes
|
||||
|
||||
You can easily create a new qube with the **Create Qubes VM** option in the App Menu. If you need to add or remove qubes, simply use the Qube Manager's **Add** and **Remove** buttons. You can also add, remove, and list qubes from the command line using the following tools:
|
||||
You can easily create a new qube with the **Create Qubes VM** option in the App
|
||||
Menu. If you need to add or remove qubes, simply use the Qube Manager's **Add**
|
||||
and **Remove** buttons. You can also add, remove, and list qubes from the
|
||||
command line using the following tools:
|
||||
|
||||
- `qvm-create`
|
||||
- `qvm-remove`
|
||||
|
|
@ -96,21 +178,39 @@ You can easily create a new qube with the **Create Qubes VM** option in the App
|
|||
|
||||
### How many qubes do I need?
|
||||
|
||||
That's a great question, but there's no one-size-fits-all answer. It depends on the structure of your digital life, and this is at least a little different for everyone. If you plan on using your system for work, then it also depends on what kind of job you do.
|
||||
That's a great question, but there's no one-size-fits-all answer. It depends on
|
||||
the structure of your digital life, and this is at least a little different for
|
||||
everyone. If you plan on using your system for work, then it also depends on
|
||||
what kind of job you do.
|
||||
|
||||
It's a good idea to start out with the qubes created automatically by the installer: `work`, `personal`, `untrusted`, and `vault`. If and when you start to feel that some activity just doesn't fit into any of your existing qubes, or you want to partition some part of your life, you can easily create a new qube for it. You'll also be able to easily [copy any files](/doc/how-to-copy-and-move-files) you need to the newly-created qube.
|
||||
It's a good idea to start out with the qubes created automatically by the
|
||||
installer: `work`, `personal`, `untrusted`, and `vault`. If and when you start
|
||||
to feel that some activity just doesn't fit into any of your existing qubes, or
|
||||
you want to partition some part of your life, you can easily create a new qube
|
||||
for it. You'll also be able to easily [copy any
|
||||
files](/doc/how-to-copy-and-move-files) you need to the newly-created qube.
|
||||
|
||||
Still not sure? You might find it helpful to read [this article](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html), which describes how one of the Qubes OS architects partitioned her digital life into security domains.
|
||||
Still not sure? You might find it helpful to read [this
|
||||
article](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html),
|
||||
which describes how one of the Qubes OS architects partitioned her digital life
|
||||
into security domains.
|
||||
|
||||
## Secure Habits
|
||||
|
||||
It is *very important* to [keep Qubes updated](/doc/how-to-update/) to ensure you have the latest security updates. Frequently updating is one of the best ways to remain secure against new threats.
|
||||
It is *very important* to [keep Qubes updated](/doc/how-to-update/) to ensure
|
||||
you have the latest security updates. Frequently updating is one of the best
|
||||
ways to remain secure against new threats.
|
||||
|
||||
It's also *very important* to make regular backups so that you don't lose your data unexpectedly. The [Qubes backup system](/doc/how-to-back-up-restore-and-migrate/) allows you to do this securely and easily.
|
||||
It's also *very important* to make regular backups so that you don't lose your
|
||||
data unexpectedly. The [Qubes backup
|
||||
system](/doc/how-to-back-up-restore-and-migrate/) allows you to do this
|
||||
securely and easily.
|
||||
|
||||
## How-to Guides
|
||||
|
||||
Here are some basic tasks you're likely to want to perform often that are unique to Qubes as a multi-environment system. A full list is available in the [How-to Guides](/doc/#how-to-guides) section in the docs.
|
||||
Here are some basic tasks you're likely to want to perform often that are
|
||||
unique to Qubes as a multi-environment system. A full list is available in the
|
||||
[How-to Guides](/doc/#how-to-guides) section in the docs.
|
||||
|
||||
- [How to Update](/doc/how-to-update/)
|
||||
- [How to Back Up, Restore, and Migrate](/doc/how-to-back-up-restore-and-migrate/)
|
||||
|
|
@ -120,16 +220,26 @@ Here are some basic tasks you're likely to want to perform often that are unique
|
|||
- [How to Install Software](/doc/how-to-install-software/)
|
||||
- [How to Use Devices (block storage, USB, and PCI devices)](/doc/how-to-use-devices/)
|
||||
|
||||
If you encounter any problems, please visit the [Help, Support, Mailing Lists, and Forum](/support/) page.
|
||||
If you encounter any problems, please visit the [Help, Support, Mailing Lists,
|
||||
and Forum](/support/) page.
|
||||
|
||||
## Compatible Hardware
|
||||
|
||||
Make sure your hardware satisfies the [system requirements](/doc/system-requirements/), as Qubes OS cannot run on every type of computer. You may also want to check out [Qubes-certified Hardware](/doc/certified-hardware/) and take a look at the [Hardware Compatibility List (HCL)](/hcl/).
|
||||
Make sure your hardware satisfies the [system
|
||||
requirements](/doc/system-requirements/), as Qubes OS cannot run on every type
|
||||
of computer. You may also want to check out [Qubes-certified
|
||||
Hardware](/doc/certified-hardware/) and take a look at the [Hardware
|
||||
Compatibility List (HCL)](/hcl/).
|
||||
|
||||
## Downloads
|
||||
|
||||
[Download an ISO](/downloads/), learn how to [verify its authenticity](/doc/verifying-signatures/), and follow our [guide to install Qubes OS](/doc/installation-guide/). Looking for the [source code](/doc/source-code/)? You'll find it [on GitHub](https://github.com/QubesOS).
|
||||
[Download an ISO](/downloads/), learn how to [verify its
|
||||
authenticity](/doc/verifying-signatures/), and follow our [guide to install
|
||||
Qubes OS](/doc/installation-guide/). Looking for the [source
|
||||
code](/doc/source-code/)? You'll find it [on
|
||||
GitHub](https://github.com/QubesOS).
|
||||
|
||||
## Documentation
|
||||
|
||||
Peruse our extensive library of [documentation](/doc/) for users and developers of Qubes OS. You can even [help us improve it](/doc/doc-guidelines/)!
|
||||
Peruse our extensive library of [documentation](/doc/) for users and developers
|
||||
of Qubes OS. You can even [help us improve it](/doc/doc-guidelines/)!
|
||||
|
|
|
|||
|
|
@ -8,27 +8,38 @@ ref: 200
|
|||
title: How to Update
|
||||
---
|
||||
|
||||
*This page is about updating your system while staying on the same [supported version of Qubes OS](/doc/supported-versions/#qubes-os).
|
||||
If you're instead looking to upgrade from your current version of Qubes OS to a newer version, see the [Upgrade Guides](/doc/upgrade/).*
|
||||
*This page is about updating your system while staying on the same [supported
|
||||
version of Qubes OS](/doc/supported-versions/#qubes-os). If you're instead
|
||||
looking to upgrade from your current version of Qubes OS to a newer version,
|
||||
see the [Upgrade Guides](/doc/upgrade/).*
|
||||
|
||||
<div class="alert alert-danger" role="alert">
|
||||
<i class="fa fa-exclamation-triangle"></i>
|
||||
<b>Warning:</b> Updating with direct commands such as <code>qubes-dom0-update</code>, <code>dnf update</code>, and <code>apt update</code> is <b>not</b> recommended, since these bypass built-in Qubes OS update security measures.
|
||||
Instead, we strongly recommend using the <b>Qubes Update</b> tool or its command-line equivalents, as described below.
|
||||
(By contrast, <a href="/doc/how-to-install-software/">installing</a> packages using direct package manager commands is fine.)
|
||||
<b>Warning:</b> Updating with direct commands such as
|
||||
<code>qubes-dom0-update</code>, <code>dnf update</code>, and <code>apt
|
||||
update</code> is <b>not</b> recommended, since these bypass built-in Qubes OS
|
||||
update security measures. Instead, we strongly recommend using the <b>Qubes
|
||||
Update</b> tool or its command-line equivalents, as described below. (By
|
||||
contrast, <a href="/doc/how-to-install-software/">installing</a> packages
|
||||
using direct package manager commands is fine.)
|
||||
</div>
|
||||
|
||||
## Security updates
|
||||
|
||||
Security updates are an extremely important part of keeping your Qubes installation secure.
|
||||
When there is an important security issue, we will issue a [Qubes Security Bulletin (QSB)](/security/bulletins/) via the [Qubes Security Pack (`qubes-secpack`)](/security/pack/).
|
||||
It is very important to read each new QSB and follow any user instructions it contains.
|
||||
Most of the time, simply [updating your system normally](#routine-updates) will be sufficient to obtain security updates.
|
||||
However, in some cases, special action may be required on your part, which will be explained in the QSB.
|
||||
Security updates are an extremely important part of keeping your Qubes
|
||||
installation secure. When there is an important security issue, we will issue a
|
||||
[Qubes Security Bulletin (QSB)](/security/bulletins/) via the [Qubes Security
|
||||
Pack (`qubes-secpack`)](/security/pack/). It is very important to read each new
|
||||
QSB and follow any user instructions it contains. Most of the time, simply
|
||||
[updating your system normally](#routine-updates) will be sufficient to obtain
|
||||
security updates. However, in some cases, special action may be required on
|
||||
your part, which will be explained in the QSB.
|
||||
|
||||
## Routine updates
|
||||
|
||||
It is important to keep your Qubes OS system up-to-date to ensure you have the latest [security updates](#security-updates), as well as the latest non-security enhancements and bug fixes.
|
||||
It is important to keep your Qubes OS system up-to-date to ensure you have the
|
||||
latest [security updates](#security-updates), as well as the latest
|
||||
non-security enhancements and bug fixes.
|
||||
|
||||
Fully updating your Qubes OS system means updating:
|
||||
|
||||
|
|
@ -40,35 +51,62 @@ You can accomplish this using the **Qubes Update** tool.
|
|||
|
||||
[](/attachment/doc/r4.0-software-update.png)
|
||||
|
||||
By default, the Qubes Update tool will appear as an icon in the Notification Area when updates are available.
|
||||
By default, the Qubes Update tool will appear as an icon in the Notification
|
||||
Area when updates are available.
|
||||
|
||||
[](/attachment/doc/r4.0-qube-updates-available.png)
|
||||
|
||||
However, you can also start the tool manually by selecting it in the Applications Menu under "System Tools."
|
||||
Even if no updates have been detected, you can use this tool to check for updates manually at any time by selecting "Enable updates for qubes without known available updates," then selecting all desired items from the list and clicking "Next."
|
||||
However, you can also start the tool manually by selecting it in the
|
||||
Applications Menu under "System Tools." Even if no updates have been detected,
|
||||
you can use this tool to check for updates manually at any time by selecting
|
||||
"Enable updates for qubes without known available updates," then selecting all
|
||||
desired items from the list and clicking "Next."
|
||||
|
||||
<div class="alert alert-info" role="alert">
|
||||
<i class="fa fa-info-circle"></i>
|
||||
<b>Advanced users and developers:</b> For the command-line equivalents of using the <b>Qubes Update</b> tool, see the Salt formulae <a href="/doc/salt/#updatequbes-dom0"><code>update.qubes-dom0</code></a> and <a href="/doc/salt/#updatequbes-vm"><code>update.qubes-vm</code></a>. For enabling testing repos, see <a href="/doc/testing/">Testing new releases and updates</a>.
|
||||
<b>Advanced users and developers:</b> For the command-line equivalents of
|
||||
using the <b>Qubes Update</b> tool, see the Salt formulae <a
|
||||
href="/doc/salt/#updatequbes-dom0"><code>update.qubes-dom0</code></a> and <a
|
||||
href="/doc/salt/#updatequbes-vm"><code>update.qubes-vm</code></a>. For
|
||||
enabling testing repos, see <a href="/doc/testing/">Testing new releases and
|
||||
updates</a>.
|
||||
</div>
|
||||
|
||||
## Upgrading to stay on a supported release
|
||||
|
||||
The above covers updating *within* a given operating system release.
|
||||
Eventually, however, most operating system releases will reach [end-of-life (EOL)](https://fedoraproject.org/wiki/End_of_life), after which point they will no longer be supported.
|
||||
This applies to [Qubes OS itself](/doc/supported-versions/#qubes-os) as well as operating systems used for templates and standalones, such as [Fedora](/doc/templates/fedora/) and [Debian](/doc/templates/debian/).
|
||||
It is very important to use only supported releases, since generally only supported releases receive security updates.
|
||||
This means that you must periodically upgrade to a newer release before your current release reaches EOL.
|
||||
Eventually, however, most operating system releases will reach [end-of-life
|
||||
(EOL)](https://fedoraproject.org/wiki/End_of_life), after which point they will
|
||||
no longer be supported. This applies to [Qubes OS
|
||||
itself](/doc/supported-versions/#qubes-os) as well as operating systems used
|
||||
for templates and standalones, such as [Fedora](/doc/templates/fedora/) and
|
||||
[Debian](/doc/templates/debian/). It is very important to use only supported
|
||||
releases, since generally only supported releases receive security updates.
|
||||
This means that you must periodically upgrade to a newer release before your
|
||||
current release reaches EOL.
|
||||
|
||||
In the case of Qubes OS itself, we will always [announce](/news/categories/#releases) when a given Qubes OS release is approaching and has reached EOL, and we will provide [instructions for upgrading to the next stable supported Qubes OS release](/doc/upgrade/).
|
||||
Again, you can always see the current support status for all Qubes OS releases [here](/doc/supported-versions/#qubes-os).
|
||||
In the case of Qubes OS itself, we will always
|
||||
[announce](/news/categories/#releases) when a given Qubes OS release is
|
||||
approaching and has reached EOL, and we will provide [instructions for
|
||||
upgrading to the next stable supported Qubes OS release](/doc/upgrade/). Again,
|
||||
you can always see the current support status for all Qubes OS releases
|
||||
[here](/doc/supported-versions/#qubes-os).
|
||||
|
||||
Periodic upgrades are also important for templates and standalones.
|
||||
For example, you might be using a [Fedora Template](/doc/templates/fedora/).
|
||||
The [Fedora Project](https://getfedora.org/) is independent of the Qubes OS Project.
|
||||
They set their own [schedule](https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle#Maintenance_Schedule) for when each Fedora release reaches EOL.
|
||||
You can always find out when an operating system reaches EOL from the upstream project that maintains it, but we also make EOL [announcements](/news/categories/#announcements) and publish guides for official template operating systems as a convenience to Qubes users.
|
||||
When this happens, you should make sure to follow the guide to upgrade to a supported version of that operating system (see the [Fedora upgrade guides](/doc/templates/fedora/#upgrading) and the [Debian upgrade guides](/doc/templates/debian/#upgrading)).
|
||||
Periodic upgrades are also important for templates and standalones. For
|
||||
example, you might be using a [Fedora Template](/doc/templates/fedora/). The
|
||||
[Fedora Project](https://getfedora.org/) is independent of the Qubes OS
|
||||
Project. They set their own
|
||||
[schedule](https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle#Maintenance_Schedule)
|
||||
for when each Fedora release reaches EOL. You can always find out when an
|
||||
operating system reaches EOL from the upstream project that maintains it, but
|
||||
we also make EOL [announcements](/news/categories/#announcements) and publish
|
||||
guides for official template operating systems as a convenience to Qubes users.
|
||||
When this happens, you should make sure to follow the guide to upgrade to a
|
||||
supported version of that operating system (see the [Fedora upgrade
|
||||
guides](/doc/templates/fedora/#upgrading) and the [Debian upgrade
|
||||
guides](/doc/templates/debian/#upgrading)).
|
||||
|
||||
The one exception to all this is the specific release used for dom0 (not to be confused with Qubes OS as a whole), which [doesn't have to be upgraded](/doc/supported-versions/#note-on-dom0-and-eol).
|
||||
The one exception to all this is the specific release used for dom0 (not to be
|
||||
confused with Qubes OS as a whole), which [doesn't have to be
|
||||
upgraded](/doc/supported-versions/#note-on-dom0-and-eol).
|
||||
|
||||
|
|
|
|||
|
|
@ -10,127 +10,140 @@ ref: 140
|
|||
title: Glossary
|
||||
---
|
||||
|
||||
app qube
|
||||
--------
|
||||
## app qube
|
||||
|
||||
Any [qube](#qube) that depends on a [template](#template) for its root filesystem.
|
||||
Any [qube](#qube) that depends on a [template](#template) for its root
|
||||
filesystem.
|
||||
|
||||
* Historical note: This term originally meant "a qube intended for running user software applications" (hence the name "app").
|
||||
* Historical note: This term originally meant "a qube intended for running user
|
||||
software applications" (hence the name "app").
|
||||
|
||||
* Historical note: This is the preferred term replacing the deprecated term "app qube."
|
||||
* Historical note: This is the preferred term replacing the deprecated term
|
||||
"app qube."
|
||||
|
||||
disposable
|
||||
----------
|
||||
## disposable
|
||||
|
||||
See [Dispoables](/doc/how-to-use-disposables/).
|
||||
A temporary [app qube](#app-qube) based on a [disposable template](#disposable-template) that can quickly be created, used, and destroyed.
|
||||
See [Dispoables](/doc/how-to-use-disposables/). A temporary [app
|
||||
qube](#app-qube) based on a [disposable template](#disposable-template) that
|
||||
can quickly be created, used, and destroyed.
|
||||
|
||||
|
||||
disposable template
|
||||
-------------------
|
||||
## disposable template
|
||||
|
||||
A type of [app qube](#app-qube) on which [disposables](#disposable) are based.
|
||||
(Not to be confused with the concept of a [template](#template) that is itself disposable, which does not exist in Qubes OS.)
|
||||
(Not to be confused with the concept of a [template](#template) that is itself
|
||||
disposable, which does not exist in Qubes OS.)
|
||||
|
||||
Disposable templates are not [templates](#template), since (being app qubes) they do not have root filesystems of their own to provide to other qubes.
|
||||
Rather, disposable templates are complementary to templates insofar as disposable templates provide their own user filesystems to the disposables based on them.
|
||||
Disposable templates are not [templates](#template), since (being app qubes)
|
||||
they do not have root filesystems of their own to provide to other qubes.
|
||||
Rather, disposable templates are complementary to templates insofar as
|
||||
disposable templates provide their own user filesystems to the disposables
|
||||
based on them.
|
||||
|
||||
dom0
|
||||
----
|
||||
## dom0
|
||||
|
||||
[Domain](#domain) Zero.
|
||||
Also known as the **host** domain, dom0 is the initial qube started by the Xen hypervisor on boot.
|
||||
Dom0 runs the Xen management toolstack and has special privileges relative to other domains, such as direct access to most hardware.
|
||||
[Domain](#domain) Zero. Also known as the **host** domain, dom0 is the initial
|
||||
qube started by the Xen hypervisor on boot. Dom0 runs the Xen management
|
||||
toolstack and has special privileges relative to other domains, such as direct
|
||||
access to most hardware.
|
||||
|
||||
* The term "dom0" is not a proper noun and should not be capitalized (unless it's the first word in a sentence, for example).
|
||||
* The term "dom0" is not a proper noun and should not be capitalized (unless
|
||||
it's the first word in a sentence, for example).
|
||||
|
||||
* The use of [domain](#domain) as a synonym for [VM](#vm) is specific to Xen. Qubes diverges from this practice. See: [domain](#domain).
|
||||
* The use of [domain](#domain) as a synonym for [VM](#vm) is specific to Xen.
|
||||
Qubes diverges from this practice. See: [domain](#domain).
|
||||
|
||||
domain
|
||||
------
|
||||
## domain
|
||||
|
||||
_This term is deprecated in the context of Qubes OS._
|
||||
|
||||
In Xen, a synonym for [VM](#vm). See ["domain" on the Xen Wiki](https://wiki.xenproject.org/wiki/Domain).
|
||||
In Xen, a synonym for [VM](#vm). See ["domain" on the Xen
|
||||
Wiki](https://wiki.xenproject.org/wiki/Domain).
|
||||
|
||||
domU
|
||||
----
|
||||
## domU
|
||||
|
||||
Unprivileged [domain](#domain).
|
||||
Also known as **guest** domains, domUs are the counterparts to dom0.
|
||||
In Xen, all VMs except dom0 are domUs.
|
||||
By default, most domUs lack direct hardware access.
|
||||
Unprivileged [domain](#domain). Also known as **guest** domains, domUs are the
|
||||
counterparts to dom0. In Xen, all VMs except dom0 are domUs. By default, most
|
||||
domUs lack direct hardware access.
|
||||
|
||||
* The term "domU" is not a proper noun and should not be capitalized unless it is the first word in a sentence.
|
||||
* The term "domU" is not a proper noun and should not be capitalized unless it
|
||||
is the first word in a sentence.
|
||||
|
||||
* The use of [domain](#domain) as a synonym for [VM](#vm) is specific to Xen. Qubes diverges from this practice. See: [domain](#domain).
|
||||
* The use of [domain](#domain) as a synonym for [VM](#vm) is specific to Xen.
|
||||
Qubes diverges from this practice. See: [domain](#domain).
|
||||
|
||||
HVM
|
||||
---
|
||||
## HVM
|
||||
|
||||
[Hardware-assisted Virtual Machine](/doc/standalones-and-HVM/).
|
||||
Any fully virtualized, or hardware-assisted, [VM](#vm) utilizing the virtualization extensions of the host CPU.
|
||||
Although HVMs are typically slower than paravirtualized qubes due to the required emulation, HVMs allow the user to create domains based on any operating system.
|
||||
[Hardware-assisted Virtual Machine](/doc/standalones-and-HVM/). Any fully
|
||||
virtualized, or hardware-assisted, [VM](#vm) utilizing the virtualization
|
||||
extensions of the host CPU. Although HVMs are typically slower than
|
||||
paravirtualized qubes due to the required emulation, HVMs allow the user to
|
||||
create domains based on any operating system.
|
||||
|
||||
qube
|
||||
----
|
||||
## qube
|
||||
|
||||
A secure compartment in Qubes OS.
|
||||
Currently, qubes are implemented as Xen [VMs](#vm), but Qubes OS is independent of its underlying compartmentalization technology.
|
||||
VMs could be replaced with a different technology, and qubes would still be called "qubes."
|
||||
A secure compartment in Qubes OS. Currently, qubes are implemented as Xen
|
||||
[VMs](#vm), but Qubes OS is independent of its underlying compartmentalization
|
||||
technology. VMs could be replaced with a different technology, and qubes would
|
||||
still be called "qubes."
|
||||
|
||||
* **Important:** The term "qube" should be lowercase unless it is the first word in a sentence. Note that starting a sentence with the plural of "qube" (i.e., "Qubes...") can be ambiguous, since it may not be clear whether the referent is a collection of qubes or [Qubes OS](#qubes-os).
|
||||
* **Important:** The term "qube" should be lowercase unless it is the first
|
||||
word in a sentence. Note that starting a sentence with the plural of "qube"
|
||||
(i.e., "Qubes...") can be ambiguous, since it may not be clear whether the
|
||||
referent is a collection of qubes or [Qubes OS](#qubes-os).
|
||||
|
||||
* Example usage: "In Qubes OS, you do your banking in your 'banking' qube and your web surfing in your 'untrusted' qube. That way, if your 'untrusted' qube is compromised, your banking activities will remain secure."
|
||||
* Example usage: "In Qubes OS, you do your banking in your 'banking' qube and
|
||||
your web surfing in your 'untrusted' qube. That way, if your 'untrusted' qube
|
||||
is compromised, your banking activities will remain secure."
|
||||
|
||||
* Historical note: The term "qube" was originally invented as an alternative to "VM" intended to make it easier for less technical users to understand Qubes OS and learn how to use it.
|
||||
* Historical note: The term "qube" was originally invented as an alternative to
|
||||
"VM" intended to make it easier for less technical users to understand Qubes
|
||||
OS and learn how to use it.
|
||||
|
||||
Qubes OS
|
||||
--------
|
||||
## Qubes OS
|
||||
|
||||
A security-oriented operating system (OS).
|
||||
The main principle of Qubes OS is security by compartmentalization (or isolation), in which activities are compartmentalized (or isolated) in separate [qubes](#qube).
|
||||
A security-oriented operating system (OS). The main principle of Qubes OS is
|
||||
security by compartmentalization (or isolation), in which activities are
|
||||
compartmentalized (or isolated) in separate [qubes](#qube).
|
||||
|
||||
* **Important:** The official name is "Qubes OS" (note the capitalization and the space between "Qubes" and "OS").
|
||||
However, in casual conversation this is often shortened to "Qubes."
|
||||
Only in technical contexts where spaces are not permitted (e.g., usernames) may the space be omitted, as in `@QubesOS`.
|
||||
* **Important:** The official name is "Qubes OS" (note the capitalization and
|
||||
the space between "Qubes" and "OS"). However, in casual conversation this is
|
||||
often shortened to "Qubes." Only in technical contexts where spaces are not
|
||||
permitted (e.g., usernames) may the space be omitted, as in `@QubesOS`.
|
||||
|
||||
Qubes Windows Tools
|
||||
-------------------
|
||||
## Qubes Windows Tools
|
||||
|
||||
[Qubes Windows Tools (QWT)](/doc/windows-tools/) are a set of programs and drivers that provide integration of Windows qubes with the rest of the Qubes OS system.
|
||||
Also see [Windows](/doc/windows/).
|
||||
[Qubes Windows Tools (QWT)](/doc/windows-tools/) are a set of programs and
|
||||
drivers that provide integration of Windows qubes with the rest of the Qubes OS
|
||||
system. Also see [Windows](/doc/windows/).
|
||||
|
||||
service qube
|
||||
------------
|
||||
## service qube
|
||||
|
||||
A [qube](#qube) the primary purpose of which is to provide a service or services to other qubes.
|
||||
`sys-net` and `sys-firewall` are examples of service qubes.
|
||||
A [qube](#qube) the primary purpose of which is to provide a service or
|
||||
services to other qubes. `sys-net` and `sys-firewall` are examples of service
|
||||
qubes.
|
||||
|
||||
standalone
|
||||
----------
|
||||
## standalone
|
||||
|
||||
See [Standalones and HVMs](/doc/standalone-and-hvm/).
|
||||
A type of [qube](#qube) that does not depend on any other qube for its root filesystem.
|
||||
The opposite of an app qube.
|
||||
A standalone is created by cloning a template.
|
||||
Unlike templates, however, standalones do not supply their root filesystems to other qubes.
|
||||
See [Standalones and HVMs](/doc/standalone-and-hvm/). A type of [qube](#qube)
|
||||
that does not depend on any other qube for its root filesystem. The opposite of
|
||||
an app qube. A standalone is created by cloning a template. Unlike templates,
|
||||
however, standalones do not supply their root filesystems to other qubes.
|
||||
|
||||
template
|
||||
--------
|
||||
## template
|
||||
|
||||
See [Templates](/doc/templates/).
|
||||
Any [qube](#qube) that supplies its root filesystem to another qube.
|
||||
Templates are intended for installing and updating software applications, but not for running them.
|
||||
See [Templates](/doc/templates/). Any [qube](#qube) that supplies its root
|
||||
filesystem to another qube. Templates are intended for installing and updating
|
||||
software applications, but not for running them.
|
||||
|
||||
* Since every template supplies its *own* root filesystem to at least one other qube, no template can be based on another template.
|
||||
In other words, no template is an [app qube](#app-qube).
|
||||
* Since every template supplies its *own* root filesystem to at least one other
|
||||
qube, no template can be based on another template. In other words, no
|
||||
template is an [app qube](#app-qube).
|
||||
|
||||
* Since every template supplies its *root* filesystem to at least one other qube, no [disposable template](#disposable-template) is a template.
|
||||
* Since every template supplies its *root* filesystem to at least one other
|
||||
qube, no [disposable template](#disposable-template) is a template.
|
||||
|
||||
VM
|
||||
--
|
||||
## VM
|
||||
|
||||
An abbreviation for "virtual machine."
|
||||
A software implementation of a machine (for example, a computer) that executes programs like a physical machine.
|
||||
An abbreviation for "virtual machine." A software implementation of a machine
|
||||
(for example, a computer) that executes programs like a physical machine.
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue