mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2025-01-12 15:59:37 -05:00
Many links fixed
Conflicts: BuildingArchlinuxTemplate.md BuildingNonFedoraTemplate.md ContributingHowto.md HCLR1.md InstallNvidiaDriver.md InstallationIsoBuilding.md LinuxHVMTips.md Mutt.md Qrexec.md Qrexec3.md Qrexec3Implementation.md QubesBuilder.md QubesBuilderDetails.md QubesDevelopers.md QubesFirewall.md SecurityCriticalCode.md SystemDoc/VMInterface.md UserDoc/SplitGpg.md VMSudo.md VPN.md WindowsDebugging.md
This commit is contained in:
Wojtek Porczyk
Marek Marczykowski-Górecki
parent
8a6890174d
commit
a16f01fd0f
@ -88,7 +88,7 @@ wget http://mir.archlinux.fr/iso/2013.06.01/archlinux-2013.06.01-dual.iso.sig
|
||||
The nm-applet (network manager icon) fails to start when archlinux is defined as a template-vm:
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
In fact /etc/dbus-1/system.d/org.freedesktop.[NetworkManager?](/doc/NetworkManager/).conf does not allow a standard user to run network manager clients. To allow this, one need to change inside \<policy context="default"\>:
|
||||
In fact /etc/dbus-1/system.d/org.freedesktop.NetworkManager.conf does not allow a standard user to run network manager clients. To allow this, one need to change inside \<policy context="default"\>:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
<deny send_destination="org.freedesktop.NetworkManager"/>
|
||||
|
||||
@ -5,12 +5,12 @@ permalink: /doc/BuildingNonFedoraTemplate/
|
||||
redirect_from: /wiki/BuildingNonFedoraTemplate/
|
||||
---
|
||||
|
||||
Building a TemplateVM for [ArchLinux?](/doc/ArchLinux/) (or another non fedora OS)
|
||||
==================================================================================
|
||||
Building a TemplateVM for ArchLinux (or another non fedora OS)
|
||||
==============================================================
|
||||
|
||||
If you don't like using Fedora because of specific administration or package management / building needs, you could build a VM Template for your Distribution of choice.
|
||||
|
||||
This article shows how to build a template for a different OS, taking [ArchLinux?](/doc/ArchLinux/) as an example.
|
||||
This article shows how to build a template for a different OS, taking ArchLinux as an example.
|
||||
|
||||
Qubes builder scripts
|
||||
=====================
|
||||
|
||||
@ -17,7 +17,7 @@ First you should decide what you are interested in (and good in). The Qubes proj
|
||||
- New features
|
||||
- Artwork (plymouth themes, KDM themes, installer themes, wallpapers, etc)
|
||||
|
||||
Perhaps the best starting point is to have a look at the [Open Issues on GitHub](https://github.com/QubesOS/qubes-issues/issues?q=is%3Aissue+is%3Aopen) to see what are the most urgent tasks to do.
|
||||
Perhaps the best starting point is to have a look at the [issues](https://github.com/QubesOS/qubes-issues/issues) to see what are the most urgent tasks to do.
|
||||
|
||||
Before you engage in some longer activity, e.g. implementing a new feature, it's always good to contact us first (preferably via the [qubes-devel](/doc/QubesLists/) list), to avoid a situation when two or more independent people would work on the same feature at the same time, doubling each others work. When you contact us and devote to a particular task, we will create a ticket for this task with info who is working on this feature and what is the expected date of some early code to be posted.
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@ Qubes audio virtualization protocol does not implement latency reporting for sec
|
||||
Implementing external audio devices
|
||||
-----------------------------------
|
||||
|
||||
First you need to identify an user VM dedicated to audio and [assign a device](https://wiki.qubes-os.org/wiki/AssigningDevices) to it. In the most common case the assigned device is the USB controller to which your USB audio card will be connected.
|
||||
First you need to identify an user VM dedicated to audio and [assign a device](/doc/AssigningDevices) to it. In the most common case the assigned device is the USB controller to which your USB audio card will be connected.
|
||||
|
||||
### Fedora VMs
|
||||
|
||||
|
||||
4
HCL.md
4
HCL.md
@ -76,7 +76,7 @@ Reported BIOS version
|
||||
|
||||
[HVM](https://en.wikipedia.org/wiki/Hardware_virtual_machine)
|
||||
|
||||
[Intel VT-x](https://en.wikipedia.org/wiki/Intel_VT-x#Intel-VT-x) or [AMD-v](https://en.wikipedia.org/wiki/AMD-V#AMD_virtualization_.28AMD-V.29) technology (required for running HVM domains, such as [Windows-based AppVMs](https://wiki.qubes-os.org/trac/wiki/WindowsAppVms))
|
||||
[Intel VT-x](https://en.wikipedia.org/wiki/Intel_VT-x#Intel-VT-x) or [AMD-v](https://en.wikipedia.org/wiki/AMD-V#AMD_virtualization_.28AMD-V.29) technology (required for running HVM domains, such as [Windows-based AppVMs](/doc/WindowsAppVms))
|
||||
|
||||
[IOMMU](https://en.wikipedia.org/wiki/IOMMU)
|
||||
|
||||
@ -84,7 +84,7 @@ Intel VT-d or AMD IOMMU technology (required for effective isolation of network
|
||||
|
||||
[TPM](https://en.wikipedia.org/wiki/Trusted_Platform_Module)
|
||||
|
||||
TPM with proper BIOS support (required for [Anti Evil Maid](https://wiki.qubes-os.org/trac/wiki/AntiEvilMaid))
|
||||
TPM with proper BIOS support (required for [Anti Evil Maid](/doc/AntiEvilMaid))
|
||||
|
||||
Qubes version
|
||||
|
||||
|
||||
@ -40,7 +40,7 @@ qvm-start win7 --cdrom=/dev/cdrom
|
||||
|
||||
Now, the VM will start booting from the attached CDROM device, which in the example above just happens to be the Windows 7 installation disk. Depending on the OS that is being installed in the VM, one might be required to start the VM several times (as is the case e.g. with Windows 7 installation), because whenever the installer wants to "reboot the system", it actually shutdowns the VM (and Qubes won't automatically start it), so several invocations of qvm-start command (as shown above) might be needed.
|
||||
|
||||
[](attachment/wiki/HvmCreate/r2b1-win7-installing.png)
|
||||
[](/attachment/wiki/HvmCreate/r2b1-win7-installing.png)
|
||||
|
||||
Using Installation ISOs located in other VMs
|
||||
--------------------------------------------
|
||||
|
||||
@ -8,8 +8,8 @@ redirect_from: /wiki/InstallNvidiaDriver/
|
||||
Nvidia proprietary driver installation
|
||||
======================================
|
||||
|
||||
[RpmFusion?](/doc/RpmFusion/) packages
|
||||
======================================
|
||||
RpmFusion packages
|
||||
==================
|
||||
|
||||
There are rpm packages with all necessary software on rpmfusion. The only package you have to compile is kernel module (but there is ready src.rpm package).
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ redirect_from: /wiki/InstallationIsoBuilding/
|
||||
How to build Qubes installation ISO
|
||||
===================================
|
||||
|
||||
Qubes uses [FedoraUnity?](/doc/FedoraUnity/) [Revisor](http://revisor.fedoraunity.org/) to build the installation ISO.
|
||||
Qubes uses [Fedora Unity Revisor](http://revisor.fedoraunity.org/) to build the installation ISO.
|
||||
|
||||
You may want to get familiar with [Revisor documentation](http://revisor.fedoraunity.org/documentation).
|
||||
|
||||
@ -47,8 +47,8 @@ All configuration files for Qubes Revisor are kept in the ```conf/``` directory:
|
||||
|
||||
- ```conf/comps-qubes.xml``` - Repository Comps file for ISO `/Packages` repository, describing packages and package groups of the installer repository. Package groups are used to select which of the packages are mandatory to install, which are optional and which are to be just available on the ISO but not installed by default (not used on Qubes).
|
||||
|
||||
[Create/Update?](/doc/Create/Update/) local repository
|
||||
------------------------------------------------------
|
||||
Create/Update local repository
|
||||
------------------------------
|
||||
|
||||
Revisor fetches all RPM packages from YUM repositories. We currently use 5 repositories:
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ To achieve it (all commands run as root):
|
||||
X -configure :1 && mv ~/xorg.conf.new /etc/X11/xorg.conf
|
||||
{% endhighlight %}
|
||||
|
||||
2. Add [HorizSync?](/doc/HorizSync/) line to Monitor section, it should look something like:
|
||||
2. Add HorizSync line to Monitor section, it should look something like:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
Section "Monitor"
|
||||
|
||||
2
Mutt.md
2
Mutt.md
@ -27,7 +27,7 @@ Installation
|
||||
Configuration
|
||||
-------------
|
||||
|
||||
Mutt generally works out of the box. This configuration guide discusses only Qubes-specific setup. In this example we will have one TemplateVM and several AppVMs. It also takes advantage of [SplitGPG?](/doc/SplitGPG/), which is assumed to be already working.
|
||||
Mutt generally works out of the box. This configuration guide discusses only Qubes-specific setup. In this example we will have one TemplateVM and several AppVMs. It also takes advantage of [SplitGPG](/doc/UserDoc/SplitGpg/), which is assumed to be already working.
|
||||
|
||||
**NOTE:** this requires `qubes-gpg-split >= 2.0.9`. 2.0.8 and earlier contains bug which causes this setup to hang in specific situations and does not allow to list keys.
|
||||
|
||||
|
||||
12
Qrexec.md
12
Qrexec.md
@ -55,13 +55,13 @@ In dom0, there is a bunch of files in `/etc/qubes-rpc/policy/` directory, whose
|
||||
|
||||
- qubes.Filecopy
|
||||
- qubes.OpenInVM
|
||||
- qubes.[ReceiveUpdates?](/doc/ReceiveUpdates/)
|
||||
- qubes.[SyncAppMenus?](/doc/SyncAppMenus/)
|
||||
- qubes.ReceiveUpdates
|
||||
- qubes.SyncAppMenus
|
||||
- qubes.VMShell
|
||||
- qubes.[ClipboardPaste?](/doc/ClipboardPaste/)
|
||||
- qubes.ClipboardPaste
|
||||
- qubes.Gpg
|
||||
- qubes.[NotifyUpdates?](/doc/NotifyUpdates/)
|
||||
- qubes.[PdfConvert?](/doc/PdfConvert/)
|
||||
- qubes.NotifyUpdates
|
||||
- qubes.PdfConvert
|
||||
|
||||
These files contain lines with the following format:
|
||||
|
||||
@ -95,7 +95,7 @@ Be very careful when coding and adding a new RPC service! Any vulnerability in a
|
||||
Requesting VM-VM (and VM-Dom0) services execution (without cmdline helper)
|
||||
--------------------------------------------------------------------------
|
||||
|
||||
Connect directly to `/var/run/qubes/qrexec-agent-fdpass` socket as described [here](https://wiki.qubes-os.org/wiki/Qrexec2Implementation#Allthepiecestogetheratwork).
|
||||
Connect directly to `/var/run/qubes/qrexec-agent-fdpass` socket as described [here](/doc/Qrexec2Implementation#Allthepiecestogetheratwork).
|
||||
|
||||
### Revoking "Yes to All" authorization
|
||||
|
||||
|
||||
10
Qrexec3.md
10
Qrexec3.md
@ -47,13 +47,13 @@ In dom0, there is a bunch of files in */etc/qubes-rpc/policy* directory, whose n
|
||||
|
||||
- qubes.Filecopy
|
||||
- qubes.OpenInVM
|
||||
- qubes.[ReceiveUpdates?](/doc/ReceiveUpdates/)
|
||||
- qubes.[SyncAppMenus?](/doc/SyncAppMenus/)
|
||||
- qubes.ReceiveUpdates
|
||||
- qubes.SyncAppMenus
|
||||
- qubes.VMShell
|
||||
- qubes.[ClipboardPaste?](/doc/ClipboardPaste/)
|
||||
- qubes.ClipboardPaste
|
||||
- qubes.Gpg
|
||||
- qubes.[NotifyUpdates?](/doc/NotifyUpdates/)
|
||||
- qubes.[PdfConvert?](/doc/PdfConvert/)
|
||||
- qubes.NotifyUpdates
|
||||
- qubes.PdfConvert
|
||||
|
||||
These files contain lines with the following format:
|
||||
|
||||
|
||||
@ -124,7 +124,7 @@ Details of all possible use cases and the messages involved are described below.
|
||||
- `MSG_DATA_STDOUT` or `MSG_DATA_STDIN` with data `len` field set to 0 in `msg_header` is an EOF marker. Peer receiving such message should close the associated input/output pipe.
|
||||
- When `some_command` terminates, **domX**'s `qrexec-agent` sends `MSG_DATA_EXIT_CODE` header to `qrexec-client` followed by the exit code (**int**). `qrexec-agent` then disconnects from the data vchan.
|
||||
|
||||
### domY: invoke execution of qubes service qubes.[SomeRpc?](/doc/SomeRpc/) in domX and pass stdin/stdout
|
||||
### domY: invoke execution of qubes service qubes.SomeRpc in domX and pass stdin/stdout
|
||||
|
||||
- **domY**: `qrexec-client-vm` is invoked as follows:
|
||||
|
||||
|
||||
@ -64,7 +64,7 @@ gpg --recv-keys 0x36879494
|
||||
|
||||
# Verify its fingerprint, set as 'trusted'.
|
||||
# This is described here:
|
||||
# https://wiki.qubes-os.org/trac/wiki/VerifyingSignatures
|
||||
# https://www.qubes-os.org/doc/VerifyingSignatures
|
||||
|
||||
wget http://keys.qubes-os.org/keys/qubes-developers-keys.asc
|
||||
gpg --import qubes-developers-keys.asc
|
||||
|
||||
@ -15,7 +15,7 @@ Components Makefile.builder file
|
||||
|
||||
Variables for Linux build:
|
||||
|
||||
- `RPM_SPEC_FILES` List (space separated) of spec files for RPM package build. Path should be relative to component root directory. [QubesBuilder](/doc/QubesBuilder/) will install all [BuildRequires?](/doc/BuildRequires/) (in chroot environment) before the build. In most Qubes components all spec files are kept in *rpm\_spec* directory. This is mainly used for Fedora packages build.
|
||||
- `RPM_SPEC_FILES` List (space separated) of spec files for RPM package build. Path should be relative to component root directory. [QubesBuilder](/doc/QubesBuilder/) will install all BuildRequires (in chroot environment) before the build. In most Qubes components all spec files are kept in *rpm\_spec* directory. This is mainly used for Fedora packages build.
|
||||
- `ARCH_BUILD_DIRS` List (space separated) of directories with PKGBUILD files for Archlinux package build. Similar to RPM build, [QubesBuilder](/doc/QubesBuilder/) will install all makedepends, then build the package.
|
||||
|
||||
Most components uses *archlinux* directory for this purpose, so its good to keep this style.
|
||||
|
||||
@ -12,7 +12,7 @@ Architects & Core Developers
|
||||
----------------------------
|
||||
|
||||
- Joanna Rutkowska `joanna at invisiblethingslab dot com` - architecture & project management, original core, occasional addons
|
||||
- Marek Marczykowski `marmarek at invisiblethingslab dot com` - everything [Xen/Linux?](/doc/Xen/Linux/) related :)
|
||||
- Marek Marczykowski `marmarek at invisiblethingslab dot com` - everything Xen/Linux related :)
|
||||
- Wojciech Porczyk `woju at invisiblethingslab dot com` -- various Linux-related things
|
||||
|
||||
Contributors to the open source code
|
||||
|
||||
@ -38,7 +38,7 @@ Normally Qubes doesn't let the user to stop a NetVM if there are other AppVMs ru
|
||||
qvm-prefs <appvm> -s netvm <netvm>
|
||||
{% endhighlight %}
|
||||
|
||||
Normally AppVMs do not connect directly to the actual NetVM which has networking devices, but rather to the default FirewallVM first, and in most cases it would be the NetVM that would crash, e.g. in response to S3 sleep/restore or other issues with [WiFi?](/doc/WiFi/) drivers. In that case it is necessary to just issue the above command once, for the FirewallVM (this assumes default VM-nameing used by the default Qubes installation):
|
||||
Normally AppVMs do not connect directly to the actual NetVM which has networking devices, but rather to the default FirewallVM first, and in most cases it would be the NetVM that would crash, e.g. in response to S3 sleep/restore or other issues with WiFi drivers. In that case it is necessary to just issue the above command once, for the FirewallVM (this assumes default VM-nameing used by the default Qubes installation):
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
qvm-prefs firewallvm -s netvm netvm
|
||||
|
||||
@ -25,7 +25,7 @@ Mailing List Rules
|
||||
|
||||
- Do not apologize for your poor English. This is a waste of everyone's time, including your own. If we can't understand you, we will ask you to clarify (or ignore your message if it's a total mess ;).
|
||||
|
||||
- While we're generally open to hearing suggestions for new features, please note that we already have a pretty well defined [roadmap](/trac/roadmap), and it's rather unlikely that we will change our schedule in order to accommodate your request. If there's a particular feature you'd like to see in Qubes, a much more effective way to make it happen is to... contribute code to Qubes which implements it! We happily accept such contributions, provided they meet our standards. Please note, however, that it's always a good idea to field a discussion of your idea on the qubes-devel list before putting in a lot of hard work on something that we may not be able or willing to accept.
|
||||
- While we're generally open to hearing suggestions for new features, please note that we already have a pretty well defined [roadmap](https://github.com/QubesOS/qubes-issues/milestones), and it's rather unlikely that we will change our schedule in order to accommodate your request. If there's a particular feature you'd like to see in Qubes, a much more effective way to make it happen is to... contribute code to Qubes which implements it! We happily accept such contributions, provided they meet our standards. Please note, however, that it's always a good idea to field a discussion of your idea on the qubes-devel list before putting in a lot of hard work on something that we may not be able or willing to accept.
|
||||
|
||||
The `qubes-users` Mailing List
|
||||
------------------------------
|
||||
|
||||
@ -22,7 +22,7 @@ Below is a code produced by the Qubes project that is security-critical.
|
||||
- Dom0-side of the sound virtualization code (*pacat-simple-vchan*)
|
||||
- Dom0-side in qrexec-related code (*qrexec\_daemon*)
|
||||
- VM memory manager (*qmemman*) that runs in Dom0
|
||||
- select Qubes RPC servers that run in Dom0: qubes.[ReceiveUpdates?](/doc/ReceiveUpdates/) and qubes.[SyncAppMenus?](/doc/SyncAppMenus/)
|
||||
- select Qubes RPC servers that run in Dom0: qubes.ReceiveUpdates and qubes.SyncAppMenus
|
||||
- The qubes.Filecopy RPC server that runs in a VM -- this one is critical because it might allow one VM to compromise another one if user allows file copy operation to be performed between them
|
||||
|
||||
Security-Critical 3rd-Party Components
|
||||
|
||||
@ -108,7 +108,7 @@ joanna.
|
||||
|
||||
--
|
||||
The Qubes Security Team
|
||||
http://wiki.qubes-os.org/trac/wiki/SecurityPage
|
||||
https://www.qubes-os.org/doc/SecurityPage
|
||||
|
||||
|
||||
[1] http://en.wikipedia.org/wiki/Warrant_canary
|
||||
|
||||
@ -22,7 +22,7 @@ Keys exposed by dom0 to VM (only Qubes specific included):
|
||||
|
||||
- `qubes-vm-type` - VM type, the same as `type` field in `qvm-prefs`. One of `AppVM`, `ProxyVM`, `NetVM`, `TemplateVM`, `HVM`, `TemplateHVM`
|
||||
- `qubes-vm-updatable` - flag whether VM is updatable (whether changes in root.img will survive VM restart). One of `True`, `False`
|
||||
- `qubes-timezone - name of timezone based on dom0 timezone. For example `[Europe/Warsaw?](/wiki/SystemDoc/Europe/Warsaw)\`
|
||||
- `qubes-timezone - name of timezone based on dom0 timezone. For example `Europe/Warsaw`
|
||||
- `qubes-keyboard` - keyboard layout based on dom0 layout. Its syntax is suitable for `xkbcomp` command (after expanding escape sequences like `\n` or `\t`). This is meant only as some default value, VM can ignore this option and choose its own keyboard layout (this is what keyboard setting from Qubes Manager does). This entry is created as part of gui-daemon initialization (so not available when gui-daemon disabled, or not started yet).
|
||||
- `qubes-debug-mode` - flag whether VM have debug mode enabled (qvm-prefs setting). One of `1`, `0`
|
||||
- `qubes-service/SERVICE_NAME` - subtree for VM services controlled from dom0 (using qvm-service command or Qubes Manager). One of `1`, `0`. Note that not every service will be listed here, if entry is missing, it means "use VM default". List of currently supported services is in [qvm-service man page](/wiki/Dom0Tools/QvmService)
|
||||
@ -59,4 +59,4 @@ Services called by dom0 to provide some VM configuration:
|
||||
GUI protocol
|
||||
------------
|
||||
|
||||
GUI initialization includes passing the whole screen dimensions from dom0 to VM. This will most likely be overwritten by qubes.[SetMonitorLayout?](/wiki/SystemDoc/SetMonitorLayout) Qubes RPC call.
|
||||
GUI initialization includes passing the whole screen dimensions from dom0 to VM. This will most likely be overwritten by qubes.SetMonitorLayout Qubes RPC call.
|
||||
|
||||
@ -47,7 +47,7 @@ TemplateVM has a shared root.img across all AppVMs that are based on it. This me
|
||||
|
||||
There are two layers of the device-mapper snapshot device; the first one enables modifying root.img without stopping the AppVMs and the second one, which is contained in the AppVM, enables temporal modifications to its filesystem. These modifications will be discarded after a restart of the AppVM.
|
||||
|
||||
|
||||
|
||||
|
||||
Snapshot device in Dom0
|
||||
-----------------------
|
||||
|
||||
@ -79,7 +79,7 @@ ssb 4096R/30498E2A 2012-11-15
|
||||
|
||||
Note that running normal `gpg -K` in the demo above shows no private keys stored in this AppVM.
|
||||
|
||||
### Configuring [Thunderbird/Enigmail?](/wiki/UserDoc/Thunderbird/Enigmail) for use with Split GPG
|
||||
### Configuring Thunderbird/Enigmail for use with Split GPG
|
||||
|
||||
However, when using Thunderbird with Enigmail extension it is not enough, because Thunderbird doesn't preserve the environment variables. Instead it is recommended to use a simple script provided by `/usr/bin/qubes-gpg-client-wrapper` file by pointing Enigmail to use this script instead of the standard GnuPG binary:
|
||||
|
||||
|
||||
@ -91,7 +91,7 @@ Below is a complete list of configuration made according to the above statement,
|
||||
|
||||
- NetworkManager configuration from normal user (nm-applet)
|
||||
- updates installation (gpk-update-viewer)
|
||||
- user can use pkexec just like sudo Note: above is needed mostly because Qubes user GUI session isn't treated by [PolicyKit?](/doc/PolicyKit/)/logind as "local" session because of the way in which X server and session is started. Perhaps we will address this issue in the future, but this is really low priority. Patches welcomed anyway.
|
||||
- user can use pkexec just like sudo Note: above is needed mostly because Qubes user GUI session isn't treated by PolicyKit/logind as "local" session because of the way in which X server and session is started. Perhaps we will address this issue in the future, but this is really low priority. Patches welcomed anyway.
|
||||
|
||||
3. Empty root password
|
||||
- used for access to 'root' account from text console (xl console) - the only way to access the VM when GUI isn't working
|
||||
@ -124,7 +124,7 @@ While ITL still supports the statement above, some Qubes users may want to enabl
|
||||
user ALL=(ALL) ALL
|
||||
{% endhighlight %}
|
||||
|
||||
- Disable [PolKit?](/doc/PolKit/)'s default-allow behavior:
|
||||
- Disable PolKit's default-allow behavior:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
[root@fedora-20-x64]# rm /etc/polkit-1/rules.d/00-qubes-allow-all.rules
|
||||
|
||||
4
VPN.md
4
VPN.md
@ -14,7 +14,7 @@ The Qubes specific part is choose the right VM for the VPN client:
|
||||
|
||||
### NetVM
|
||||
|
||||
The simplest case if you set up a VPN connection using the Network Manager inside your NetVM. Because the [NetworkManager?](/doc/NetworkManager/) already started you are ready to set up your VPN connection. However this has some disadvantages:
|
||||
The simplest case if you set up a VPN connection using the Network Manager inside your NetVM. Because the NetworkManager already started you are ready to set up your VPN connection. However this has some disadvantages:
|
||||
|
||||
- You have to place (and probably save) Your VPN credentials inside the NetVM wich is directly connected to the outside world
|
||||
- All your AppVMs wich are connected to the NetVM will be connected to the VPN (by default)
|
||||
@ -25,7 +25,7 @@ While the Network Manager is not started here (for a good reason) You can config
|
||||
|
||||
### ProxyVM
|
||||
|
||||
**WARNING:** *Currently the [NetworkManager?](/doc/NetworkManager/) is not working in ProxyVMs as expected. Actually it will mess up the routing table and because of that your packets may not be routed to the VPN tunnel. - This surely occurs if your VPN wants to be the default gateway.*
|
||||
**WARNING:** *Currently the NetworkManager is not working in ProxyVMs as expected. Actually it will mess up the routing table and because of that your packets may not be routed to the VPN tunnel. - This surely occurs if your VPN wants to be the default gateway.*
|
||||
|
||||
One of the best thing in Qubes that you can use a special type of VMs called ProxyVM (or FirewallVM). The special thing is that your AppVMs see this as a NetVM, and the NetVMs see it as an AppVM. Because of that You can place a ProxyVM between your AppVMs and Your NetVM. This is how the default firewall VM is working.
|
||||
|
||||
|
||||
@ -44,7 +44,7 @@ Things get complicated if you need to perform kernel debugging or troubleshoot p
|
||||
- On the *host* system, install [WinDbg](http://msdn.microsoft.com/en-us/library/windows/hardware/ff551063(v=vs.85).aspx) and start the kernel debug (Ctrl-K), choose **com1** as the debug port.
|
||||
- Reboot the *target* VM.
|
||||
- Run the above shell script in dom0.
|
||||
- If everything is fine you should see the proper kernel debugging output in [WinDbg?](/doc/WinDbg/). However, if you see something like that:
|
||||
- If everything is fine you should see the proper kernel debugging output in WinDbg. However, if you see something like that:
|
||||
|
||||
{% highlight trac-wiki %}
|
||||
Opened \\.\com1
|
||||
|
||||
Loading…
Reference in New Issue
Block a user