mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2025-05-02 06:46:11 -04:00
Andrew David Wong
parent
f074152217
commit
3db4fe4ed5
18 changed files with 2951 additions and 0 deletions
190
basics_user/getting-started.md
Normal file
190
basics_user/getting-started.md
Normal file
|
|
@ -0,0 +1,190 @@
|
|||
---
|
||||
layout: default
|
||||
title: Get Started
|
||||
permalink: /getting-started/
|
||||
redirect_from:
|
||||
- /doc/getting-started/
|
||||
- /en/doc/getting-started/
|
||||
- /doc/GettingStarted/
|
||||
- /wiki/GettingStarted/
|
||||
---
|
||||
|
||||
<a name="already-installed"></a>Now that you've installed Qubes, let's cover some basic concepts.
|
||||
You might also like to refer to the [Glossary](/doc/glossary/).
|
||||
|
||||
AppVMs (qubes) and TemplateVMs
|
||||
--------------------------------
|
||||
|
||||
In Qubes, you run all your programs in lightweight Virtual Machines called **qubes**.
|
||||
Not every app runs in its own qube.
|
||||
(That would be a big waste of resources!)
|
||||
Instead, each qube represents a *security domain* (e.g., "work," "personal," "banking," etc.).
|
||||
By default all qubes are based on a single, common **TemplateVM** , although you can create more TemplateVMs if you wish.
|
||||
When you create a new qube, you don't copy the whole root filesystem needed for this qube to work (which would include copying all the programs).
|
||||
Instead, each qube *shares* the root filesystem with its respective TemplateVM.
|
||||
A qube has read-only access to the filesystem of the Template on which it's based, so a qube cannot modify a TemplateVM in any way.
|
||||
This is important, as it means that if a qube is ever compromised, the TemplateVM on which it's based (and any other qubes based on that TemplateVM) will still be safe.
|
||||
So creating a large number of domains is cheap: each one needs only as much disk space as is necessary to store its private files (e.g., the "home" folder).
|
||||
|
||||
If you've installed Qubes using the default options, a few qubes have already been created for you:
|
||||
|
||||
- work
|
||||
- personal
|
||||
- untrusted
|
||||
|
||||
Each qube, apart from having a distinct name, is also assigned a **label**, which is one of several pre-defined colors.
|
||||
The trusted window manager uses these colors in order to draw window decorations (color frames) around the windows of applications running in each qube.
|
||||
It's totally up to you how you'd like to interpret these colors.
|
||||
You might like to use them to quickly and easily identify the trust level of a given window at a glance.
|
||||
Personally, I find it natural to associate red with that which is untrusted and dangerous (the “red light” -- stop! danger!), green with that which is safe and trusted, and yellow and orange with things in the middle.
|
||||
I've also extended this scheme to include blue and black, which I interpret as indicating progressively more trusted domains than green, with black being ultimately trusted.
|
||||
Alternatively you might use the colors to show that qubes belong to the same domain - for example, you might use 3 or 4 qubes for work activities, and give them all the same distinct color label. It's entirely up to you.
|
||||
|
||||
|
||||
|
||||
In addition to qubes and TemplateVMs, there's one special domain called "dom0," which is where the Desktop Manager runs.
|
||||
This is where you log in to the system.
|
||||
Dom0 is more trusted than any other domain (including TemplateVMs and black-labeled qubes).
|
||||
If dom0 were ever compromised, it would be Game Over<sup>TM</sup>.
|
||||
(The entire system would effectively be compromised.)
|
||||
Due to its overarching importance, dom0 has no network connectivity and is used only for running the Window and Desktop Managers.
|
||||
Dom0 shouldn't be used for anything else.
|
||||
In particular, [you should never run user applications in dom0](/doc/security-guidelines/#dom0-precautions).
|
||||
(That's what your qubes are for!)
|
||||
|
||||
Qubes VM Manager and Command Line Tools
|
||||
---------------------------------------
|
||||
|
||||
All aspects of the Qubes system can be controlled using command line tools run under a dom0 console.
|
||||
To open a console window in dom0, either go to Start-\>System Tools-\>Konsole or press Alt-F2 and type `konsole`.
|
||||
|
||||
Various command line tools are described as part of this guide, and the whole reference can be found [here](/doc/dom0-tools/).
|
||||
|
||||
|
||||
|
||||
Alternatively, you can use a rather intuitive GUI tool called **Qubes VM Manager**.
|
||||
It supports most of the functionality that command line tools provide.
|
||||
The Qubes VM Manager starts and opens automatically when Qubes starts up, but you can also start it by going to Start-\>System Tools-\>Qubes Manager.
|
||||
Once the Qubes VM Manager is running, you can open the window at any time by clicking on the Qubes tray icon, which typically resides in the bottom-right corner of the screen.
|
||||
|
||||
|
||||
|
||||
Starting Apps in qubes
|
||||
------------------------
|
||||
|
||||
Apps can be started either by using the shortcuts in the Desktop Manager's menu or by using the command line (i.e., a console running in dom0).
|
||||
|
||||
You can start apps directly from the start menu.
|
||||
Each qube has its own menu directory under the scheme **Domain: \<name\>**.
|
||||
After navigating into one of these directories, simply click on the application you'd like to start:
|
||||
|
||||
 
|
||||
|
||||
By default, each qube's menu contains only a few shortcuts.
|
||||
If you'd like to add more, simply click **Add more shortcuts...**, select the desired applications, and click **OK**.
|
||||
You can also add shortcuts manually.
|
||||
(This is sometimes necessary if the desired application doesn't show up in the Qubes VM Manager window.)
|
||||
To do this in KDE, right-click on the **Start** button and click **Menu Editor**.
|
||||
Click the qube directory in which you'd like the menu to appear, click **New Item**, enter its name as **\<qube name\>: \<app name\>**, and provide the command for starting the app (see below).
|
||||
Then click **Save** and wait approximately 15 seconds for the changes to propagate to the KDE menu.
|
||||
|
||||
To start apps from the console in dom0, type:
|
||||
|
||||
qvm-run -a <qube> "<app name> [arguments]"
|
||||
|
||||
e.g.:
|
||||
|
||||
qvm-run -a untrusted firefox
|
||||
|
||||
The -a parameter will start the qube if it is not already running.
|
||||
|
||||
Adding, Removing, and Listing qubes
|
||||
-------------------------------------
|
||||
|
||||
A qube can easily be added and removed by clicking on the **Add** and **Remove** buttons in the Qubes VM Manager.
|
||||
|
||||
A qube can also be added, removed, and qubes may be listed from the command line (i.e., a console running in dom0) using the following tools:
|
||||
|
||||
- `qvm-create`
|
||||
- `qvm-remove`
|
||||
- `qvm-ls`
|
||||
|
||||
How Many Qubes Do I Need?
|
||||
---------------------------
|
||||
|
||||
That's a great question, but there's no one-size-fits-all answer.
|
||||
It depends on the structure of your digital life, and this is at least a little different for everyone.
|
||||
If you plan on using your system for work, then it also depends on what kind of job you do.
|
||||
|
||||
It's a good idea to start out with the three qubes created automatically by the installer: work, personal, and untrusted.
|
||||
Then, if and when you start to feel that some activity just doesn't fit into any of your existing qubes, or you want to partition some part of your life, you can easily create a new qube for it.
|
||||
You'll also be able to easily copy any files you need to the newly created qube, as explained [here](/doc/copying-files/).
|
||||
|
||||
More paranoid people might find it worthwhile to read [this article](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html), which describes how one of the Qubes authors partitions her digital life into security domains.
|
||||
|
||||
Running an application Full Screen
|
||||
----------------------------------
|
||||
|
||||
By default, Qubes doesn't allow any application window to occupy the entire screen such that its window name (which includes the name of the qube to which it belongs) and colored window border are no longer visible.
|
||||
This is a security precaution designed to prevent a situation in which an application which has been allowed to enter full screen mode begins to emulate the entire Qubes system.
|
||||
The user should always be able to identify which qube is displaying any given window.
|
||||
Otherwise, a compromised qube which is able to occupy the entire screen could trick the user into thinking that she is interacting with a variety of different qubes (including dom0), when in fact she is interacting with only a single, compromised qube pretending to be the whole system.
|
||||
|
||||
**Note:** A similar attack is possible even *without* fullscreen mode.
|
||||
Since a compromised qube can draw pixels within its own windows however it likes, it could draw a fake password prompt, for example, which appears to have a different colored border so that it looks like it belongs to a different qube.
|
||||
This is why you should always drag such prompts away from other windows (or use some other means of manipulating the windows) to ensure that they belong to the qube to which they appear to belong.
|
||||
|
||||
However, if the user makes use of an "expose-like" desktop switcher, such as the "Desktop Grid" effect that is enabled by default under KDE (default activation command: Ctrl-F8), then we can safely allow qubes to enter full screen mode, as we have assurance that we can always "preempt" them by hitting the magic key combination (e.g., Ctrl-F8), which will be consumed by the trusted window manager and not passed down to the fullscreen qube.
|
||||
This means that the qube has no way of effectively "faking" the fullscreen view of the system, as the user can easily identify it as "just another qube."
|
||||
Theoretically, this could be achieved even with primitive Alt-Tab like switching, which should be available on simpler Window Managers (such as Xfce4, which we also support as an alternative dom0 Desktop Environment), but this might be less obvious to the user.
|
||||
|
||||
To allow a qube to enter full screen mode, one should edit the `/etc/qubes/guid.conf` file in dom0.
|
||||
|
||||
To allow all qubes to enter full screen mode, set `allow_fullscreen` flag to `true` in the `global` section:
|
||||
|
||||
global: {
|
||||
# default values
|
||||
allow_fullscreen = false;
|
||||
#allow_utf8_titles = false;
|
||||
#secure_copy_sequence = "Ctrl-Shift-c";
|
||||
#secure_paste_sequence = "Ctrl-Shift-v";
|
||||
#windows_count_limit = 500;
|
||||
};
|
||||
|
||||
To allow only select qubes to enter full screen mode, create a per-VM section, and set `allow_fullscreen` flag there to `true`:
|
||||
|
||||
VM: {
|
||||
work: {
|
||||
allow_fullscreen = true;
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
In order for the changes to take effect, restart the qube(s).
|
||||
|
||||
More details can be found [here](/doc/full-screen-mode/).
|
||||
|
||||
<div class="row">
|
||||
<div class="col-lg-4 col-md-4">
|
||||
<h2>Compatible Hardware</h2>
|
||||
<p>Ready to install Qubes? Make sure your hardware is compatible, as Qubes cannot run on every type of computer. Also, check out <a href="/doc/certified-laptops/">Qubes-certified Laptops</a>.</p>
|
||||
<a href="/hcl/" class="btn btn-primary">
|
||||
<i class="fa fa-laptop"></i> Hardware Compatibility List
|
||||
</a>
|
||||
</div>
|
||||
<div class="col-lg-4 col-md-4">
|
||||
<h2>Downloads</h2>
|
||||
<p>Download an ISO, learn how to verify its authenticity and integrity, and follow our guides to install Qubes. Looking for the source code? You'll find it on <a href="https://github.com/QubesOS">GitHub</a>.</p>
|
||||
<a href="/downloads/" class="btn btn-primary">
|
||||
<i class="fa fa-download"></i> Downloads
|
||||
</a>
|
||||
</div>
|
||||
<div class="col-lg-4 col-md-4">
|
||||
<h2>Documentation</h2>
|
||||
<p>Peruse our extensive library of documentation for users and developers of Qubes. You can even help us <a href="/doc/doc-guidelines/">improve</a> it!</p>
|
||||
<a href="/doc/" class="btn btn-primary">
|
||||
<i class="fa fa-book"></i> Documentation
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
<hr class="more-top more-bottom">
|
||||
236
basics_user/intro.md
Normal file
236
basics_user/intro.md
Normal file
|
|
@ -0,0 +1,236 @@
|
|||
---
|
||||
layout: intro
|
||||
title: An Introduction to Qubes OS
|
||||
permalink: /intro/
|
||||
redirect_from:
|
||||
- /tour/
|
||||
- /en/tour/
|
||||
- /tour/#what-is-qubes-os
|
||||
- /about/
|
||||
- /en/about/
|
||||
---
|
||||
|
||||
What is Qubes OS?
|
||||
-----------------
|
||||
|
||||
Qubes OS is a security-oriented operating system (OS). The OS is the software
|
||||
that runs all the other programs on a computer. Some examples of popular
|
||||
OSes are Microsoft Windows, Mac OS X, Android, and iOS. Qubes is free and
|
||||
open-source software (FOSS). This means that everyone is free to use, copy,
|
||||
and change the software in any way. It also means that the source code is
|
||||
openly available so others can contribute to and audit it.
|
||||
|
||||
Why is OS security important?
|
||||
-----------------------------
|
||||
|
||||
Most people use an operating system like Windows or OS X on their desktop
|
||||
and laptop computers. These OSes are popular because they tend to be easy
|
||||
to use and usually come pre-installed on the computers people buy. However,
|
||||
they present problems when it comes to security. For example, you might
|
||||
open an innocent-looking email attachment or website, not realizing that
|
||||
you're actually allowing malware (malicious software) to run on your
|
||||
computer. Depending on what kind of malware it is, it might do anything
|
||||
from showing you unwanted advertisements to logging your keystrokes to
|
||||
taking over your entire computer. This could jeopardize all the information
|
||||
stored on or accessed by this computer, such as health records, confidential
|
||||
communications, or thoughts written in a private journal. Malware can also
|
||||
interfere with the activities you perform with your computer. For example,
|
||||
if you use your computer to conduct financial transactions, the malware
|
||||
might allow its creator to make fraudulent transactions in your name.
|
||||
|
||||
Aren't antivirus programs and firewalls enough?
|
||||
-----------------------------------------------
|
||||
|
||||
Unfortunately, conventional security approaches like antivirus programs
|
||||
and (software and/or hardware) firewalls are no longer enough to keep out
|
||||
sophisticated attackers. For example, nowadays it's common for malware
|
||||
creators to check to see if their malware is recognized by any signature-based
|
||||
antivirus programs. If it's recognized, they scramble their code until it's
|
||||
no longer recognizable by the antivirus programs, then send it out. The
|
||||
best of these programs will subsequently get updated once the antivirus
|
||||
programmers discover the new threat, but this usually occurs at least a
|
||||
few days after the new attacks start to appear in the wild. By then, it's
|
||||
too late for those who have already been compromised. More advanced antivirus
|
||||
software may perform better in this regard, but it's still limited to a
|
||||
detection-based approach. New zero-day vulnerabilities are constantly being
|
||||
discovered in the common software we all use, such as our web browsers, and no
|
||||
antivirus program or firewall can prevent all of these vulnerabilities from
|
||||
being exploited.
|
||||
|
||||
|
||||
How does Qubes OS provide security?
|
||||
-----------------------------------
|
||||
|
||||
Qubes takes an approach called **security by compartmentalization**, which
|
||||
allows you to compartmentalize the various parts of your digital life into
|
||||
securely isolated compartments called *qubes*.
|
||||
|
||||
This approach allows you to keep the different things you do on your computer
|
||||
securely separated from each other in isolated qubes so that one qube getting
|
||||
compromised won't affect the others. For example, you might have one qube for
|
||||
visiting untrusted websites and a different qube for doing online banking. This
|
||||
way, if your untrusted browsing qube gets compromised by a malware-laden
|
||||
website, your online banking activities won't be at risk. Similarly, if
|
||||
you're concerned about malicious email attachments, Qubes can make it so
|
||||
that every attachment gets opened in its own single-use [disposable
|
||||
qube]. In this way, Qubes allows you to do everything on the same physical
|
||||
computer without having to worry about a single successful cyberattack taking
|
||||
down your entire digital life in one fell swoop.
|
||||
|
||||
Moreover, all of these isolated qubes are integrated into a single, usable
|
||||
system. Programs are isolated in their own separate qubes, but all windows are
|
||||
displayed in a single, unified desktop environment with [unforgeable colored
|
||||
window borders][getting started] so that you can easily identify windows from
|
||||
different security levels. Common attack vectors like network cards and USB
|
||||
controllers are isolated in their own hardware qubes while their functionality
|
||||
is preserved through secure [networking], [firewalls], and [USB device
|
||||
management][USB]. Integrated [file] and [clipboard] copy and paste operations
|
||||
make it easy to work across various qubes without compromising security. The
|
||||
innovative [Template] system separates software installation from software use,
|
||||
allowing qubes to share a root filesystem without sacrificing security (and
|
||||
saving disk space, to boot). Qubes even allows you to sanitize PDFs and images
|
||||
in a few clicks. Users concerned about privacy will appreciate the
|
||||
[integration][Qubes-Whonix] of [Whonix] with Qubes, which makes it easy to use
|
||||
[Tor] securely, while those concerned about physical hardware attacks will
|
||||
benefit from [Anti Evil Maid].
|
||||
|
||||
|
||||
How does Qubes OS compare to using a "live CD" OS?
|
||||
--------------------------------------------------
|
||||
|
||||
Booting your computer from a live CD (or DVD) when you need to perform
|
||||
sensitive activities can certainly be more secure than simply using your main
|
||||
OS, but this method still preserves many of the risks of conventional OSes. For
|
||||
example, popular live OSes (such as [Tails] and other Linux distributions)
|
||||
are still **monolithic** in the sense that all software is still running in
|
||||
the same OS. This means, once again, that if your session is compromised,
|
||||
then all the data and activities performed within that same session are also
|
||||
potentially compromised.
|
||||
|
||||
|
||||
How does Qubes OS compare to running VMs in a conventional OS?
|
||||
--------------------------------------------------------------
|
||||
|
||||
Not all virtual machine software is equal when it comes to security. You may
|
||||
have used or heard of VMs in relation to software like VirtualBox or VMware
|
||||
Workstation. These are known as "Type 2" or "hosted" hypervisors. (The
|
||||
**hypervisor** is the software, firmware, or hardware that creates and
|
||||
runs virtual machines.) These programs are popular because they're designed
|
||||
primarily to be easy to use and run under popular OSes like Windows (which
|
||||
is called the **host** OS, since it "hosts" the VMs). However, the fact
|
||||
that Type 2 hypervisors run under the host OS means that they're really
|
||||
only as secure as the host OS itself. If the host OS is ever compromised,
|
||||
then any VMs it hosts are also effectively compromised.
|
||||
|
||||
By contrast, Qubes uses a "Type 1" or "bare metal" hypervisor called
|
||||
[Xen]. Instead of running inside an OS, Type 1 hypervisors run directly on the
|
||||
"bare metal" of the hardware. This means that an attacker must be capable of
|
||||
subverting the hypervisor itself in order to compromise the entire system,
|
||||
which is vastly more difficult.
|
||||
|
||||
Qubes makes it so that multiple VMs running under a Type 1 hypervisor can be
|
||||
securely used as an integrated OS. For example, it puts all of your application
|
||||
windows on the same desktop with special colored borders indicating the
|
||||
trust levels of their respective VMs. It also allows for things like secure
|
||||
copy/paste operations between VMs, securely copying and transferring files
|
||||
between VMs, and secure networking between VMs and the Internet.
|
||||
|
||||
|
||||
How does Qubes OS compare to using a separate physical machine?
|
||||
---------------------------------------------------------------
|
||||
|
||||
Using a separate physical computer for sensitive activities can certainly be
|
||||
more secure than using one computer with a conventional OS for everything,
|
||||
but there are still risks to consider. Briefly, here are some of the main
|
||||
pros and cons of this approach relative to Qubes:
|
||||
|
||||
<div class="focus">
|
||||
<i class="fa fa-check"></i> <strong>Pros</strong>
|
||||
</div>
|
||||
|
||||
* Physical separation doesn't rely on a hypervisor. (It's very unlikely
|
||||
that an attacker will break out of Qubes' hypervisor, but if one were to
|
||||
manage to do so, one could potentially gain control over the entire system.)
|
||||
* Physical separation can be a natural complement to physical security. (For
|
||||
example, you might find it natural to lock your secure laptop in a safe
|
||||
when you take your unsecure laptop out with you.)
|
||||
|
||||
<div class="focus">
|
||||
<i class="fa fa-times"></i> <strong>Cons</strong>
|
||||
</div>
|
||||
|
||||
* Physical separation can be cumbersome and expensive, since we may have to
|
||||
obtain and set up a separate physical machine for each security level we
|
||||
need.
|
||||
* There's generally no secure way to transfer data between physically
|
||||
separate computers running conventional OSes. (Qubes has a secure inter-VM
|
||||
file transfer system to handle this.)
|
||||
* Physically separate computers running conventional OSes are still
|
||||
independently vulnerable to most conventional attacks due to their monolithic
|
||||
nature.
|
||||
* Malware which can bridge air gaps has existed for several years now and
|
||||
is becoming increasingly common.
|
||||
|
||||
(For more on this topic, please see the paper
|
||||
[Software compartmentalization vs. physical separation][paper-compart].)
|
||||
|
||||
<hr class="add-top more-bottom">
|
||||
<div class="row">
|
||||
<div class="col-lg-4 col-md-4 col-xs-12">
|
||||
<h2>Video Tours</h2>
|
||||
<p>Want to see Qubes OS in action? Sit back and watch a guided tour!</p>
|
||||
<a href="/video-tours/" class="btn btn-primary">
|
||||
<i class="fa fa-play-circle"></i> Video Tours
|
||||
</a>
|
||||
</div>
|
||||
<div class="col-lg-4 col-md-4 col-xs-12">
|
||||
<h2>Screenshots</h2>
|
||||
<p>See what using Qubes actually looks like with these screenshots of various applications running in Qubes.</p>
|
||||
<a href="/screenshots/" class="btn btn-primary">
|
||||
<i class="fa fa-picture-o"></i> Screenshots
|
||||
</a>
|
||||
</div>
|
||||
<div class="col-lg-4 col-md-4 col-xs-12">
|
||||
<h2>Getting Started</h2>
|
||||
<p>Ready to get started with Qubes? Here's what you need to know after installing.</p>
|
||||
<a href="/getting-started/" class="btn btn-primary">
|
||||
<i class="fa fa-cubes"></i> Getting Started
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
<hr class="more-top more-bottom">
|
||||
|
||||
More information
|
||||
----------------
|
||||
|
||||
This page is just a brief sketch of what Qubes is all about, and many
|
||||
technical details have been omitted here for the sake of presentation.
|
||||
|
||||
* If you're a current or potential Qubes user, you may want to check out the
|
||||
[documentation][doc] and the [FAQ][user-faq].
|
||||
* If you're a developer, there's dedicated [documentation][system-doc]
|
||||
and an [FAQ][devel-faq] just for you.
|
||||
* Ready to give Qubes a try? Head on over to the [downloads] page.
|
||||
|
||||
|
||||
[disposable qube]: /doc/dispvm/
|
||||
[networking]: /doc/networking/
|
||||
[firewalls]: /doc/firewall/
|
||||
[USB]: /doc/usb/
|
||||
[file]: /doc/copying-files/
|
||||
[clipboard]: /doc/copy-paste/
|
||||
[Template]: /doc/templates/
|
||||
[Qubes-Whonix]: /doc/whonix/
|
||||
[Whonix]: https://www.whonix.org/
|
||||
[Tor]: https://www.torproject.org/
|
||||
[Anti Evil Maid]: /doc/anti-evil-maid/
|
||||
[Tails]: https://tails.boum.org/
|
||||
[Xen]: https://www.xenproject.org
|
||||
[paper-compart]: https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf
|
||||
[doc]: /doc/
|
||||
[user-faq]: /doc/user-faq/
|
||||
[system-doc]: /doc/system-doc/
|
||||
[devel-faq]: /doc/devel-faq/
|
||||
[downloads]: /downloads/
|
||||
[getting started]: /getting-started/
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue