diff --git a/user/downloading-installing-upgrading/install-security.md b/user/downloading-installing-upgrading/install-security.md index 08be594d..18560bd4 100644 --- a/user/downloading-installing-upgrading/install-security.md +++ b/user/downloading-installing-upgrading/install-security.md @@ -1,6 +1,6 @@ --- layout: doc -title: Installation Security +title: Installation security permalink: /doc/install-security/ redirect_from: - /en/doc/install-security/ @@ -8,89 +8,75 @@ redirect_from: - /wiki/InstallSecurity/ --- -# Installation Security Considerations # +# Installation security -There are several security matters to consider before and during the Qubes -installation process. +There are several security matters to consider before and during the Qubes installation process. +## Trusting your hardware -## Trusting your Hardware ## +No operating system, not even Qubes, can help you if you're installing it on hardware that is already compromised. +This includes CPUs, GPUs, SSDs, HDDs, the motherboard, BIOS/EFI/UEFI, and all relevant firmware. +Unfortunately, in today's world of undetectable supply chain attacks, there are no easy solutions. +(Tools like [Anti Evil Maid (AEM)][AEM] can help with *maintaining* the trustworthiness of your hardware, but not with establishing it in the first place.) +Some users have chosen to use tools like [Coreboot], [Heads], and [Skulls]. -No operating system, not even Qubes, can help you if you're installing it on -hardware that is already compromised. This includes CPUs, GPUs, SSDs, HDDs, and -BIOS/EFI/UEFI. Unfortunately, in today's world of undetectable supply chain -attacks, there are no easy solutions. (Tools like [Anti Evil Maid (AEM)][AEM] -can help with *maintaining* the trustworthiness of your hardware, but not with -establishing it in the first place.) +## Verifying the Qubes ISO +You should [verify] the PGP signature on your Qubes ISO before you install from it. +However, if the machine on which you attempt the verification process is already compromised, it could falsely claim that a malicious ISO has a good signature. +Therefore, in order to be certain that your Qubes ISO is trustworthy, you require a trustworthy machine. +But how can you be certain *that* machine is trustworthy? +Only by using another trusted machine, and so forth. +This is a [classic problem]. +While various [solutions] have been proposed, the point is that each user must ultimately make a choice about whether to trust that a file is non-malicious. -## Verifying the Qubes ISO ## +## Choosing an installation medium -You should [verify] the PGP signature on your Qubes ISO before you install -from it. However, if the machine on which you attempt the verification process -is already compromised, it could falsely claim that a malicious ISO has a good -signature. Therefore, in order to be certain that your Qubes ISO is trustworthy, -you require a trustworthy machine. But how can you be certain *that* machine is -trustworthy? Only by using another trusted machine, and so forth. This is a -[classic problem]. While various [solutions] have been proposed, the point is -that each user must ultimately make a choice about whether to trust that a file -is non-malicious. +So, after taking some measures to verify its integrity and authenticity, you've decided to trust your Qubes ISO. +Great! +Now you must decide what sort of medium on which to write it so that you can install from it. +From a Qubes-specific security perspective, each has certain pros and cons. - -## Choosing an Installation Medium ## - -So, after taking some measures to verify its integrity and authenticity, you've -decided to trust your Qubes ISO. Great! Now you must decide what sort of medium -on which to write it so that you can install from it. From a Qubes-specific -security perspective, each has certain pros and cons. - - -### USB Drives ### +### USB drives Pros: * Works via USB, including with a [USB qube]. - * Non-fixed capacity. (Easy to find one on which the ISO can fit.) + * Non-fixed capacity. + (Easy to find one on which the ISO can fit.) Cons: - * Rewritable. (If the drive is mounted to a compromised machine, the ISO could - be maliciously altered after it has been written to the drive.) - * Untrustworthy firmware. (Firmware can be malicious even if the drive is new. - Plugging a drive with rewritable firmware into a compromised machine can - also [compromise the drive][BadUSB]. Installing from a compromised drive - could compromise even a brand new Qubes installation.) + * Rewritable. + (If the drive is mounted to a compromised machine, the ISO could be maliciously altered after it has been written to the drive.) + * Untrustworthy firmware. + (Firmware can be malicious even if the drive is new. + Plugging a drive with rewritable firmware into a compromised machine can also [compromise the drive][BadUSB]. + Installing from a compromised drive could compromise even a brand new Qubes installation.) -### Optical Discs ### +### Optical discs Pros: - * Read-only available. (If you use read-only media, you don't have to worry - about the ISO being maliciously altered after it has been written to the - disc. You then have the option of verifying the signature on multiple - different machines.) + * Read-only available. + (If you use read-only media, you don't have to worry about the ISO being maliciously altered after it has been written to the disc. + You then have the option of verifying the signature on multiple different machines.) Cons: - * Fixed capacity. (If the size of the ISO is larger than your disc, it will be - inconvenient.) - * Passthrough recording (a.k.a., "burning") is not supported by Xen. (This - mainly applies if you're upgrading from a previous version of Qubes.) - Currently, the only options for recording optical discs (e.g., CDs, DVDs, - BRDs) in Qubes are: + * Fixed capacity. + (If the size of the ISO is larger than your disc, it will be inconvenient.) + * Passthrough recording (a.k.a., "burning") is not supported by Xen. + (This mainly applies if you're upgrading from a previous version of Qubes.) + Currently, the only options for recording optical discs (e.g., CDs, DVDs, BRDs) in Qubes are: 1. Use a USB optical drive. - 2. Attach a SATA optical drive to a secondary SATA controller, then assign - this secondary SATA controller to an AppVM. + 2. Attach a SATA optical drive to a secondary SATA controller, then assign this secondary SATA controller to an AppVM. 3. Use a SATA optical drive attached to dom0. - (Option 3 violates the Qubes security model since it entails transferring an - untrusted ISO to dom0 in order to burn it to disc, which leaves only the - other two options.) + (Option 3 violates the Qubes security model since it entails transferring an untrusted ISO to dom0 in order to burn it to disc, which leaves only the other two options.) -Considering the pros and cons of each, perhaps a USB drive with non-rewritable -(or at least cryptographically-signed) firmware and a physical write-protect -switch might be the option. +Considering the pros and cons of each, perhaps a USB drive with non-rewritable (or at least cryptographically-signed) firmware and a physical write-protect switch might be the best option. [AEM]: /doc/anti-evil-maid/ @@ -99,4 +85,7 @@ switch might be the option. [solutions]: https://www.dwheeler.com/trusting-trust/ [USB qube]: /doc/usb-qubes/#creating-and-using-a-usb-qube [BadUSB]: https://srlabs.de/badusb/ +[Coreboot]: https://www.coreboot.org/ +[Heads]: http://osresearch.net/ +[Skulls]: https://github.com/merge/skulls diff --git a/user/downloading-installing-upgrading/installation-guide.md b/user/downloading-installing-upgrading/installation-guide.md index c592715b..01d3d5c0 100644 --- a/user/downloading-installing-upgrading/installation-guide.md +++ b/user/downloading-installing-upgrading/installation-guide.md @@ -1,6 +1,6 @@ --- layout: doc -title: Installation Guide +title: Installation guide permalink: /doc/installation-guide/ redirect_from: - /en/doc/installation-guide/ @@ -16,169 +16,174 @@ redirect_from: - /doc/InstallationGuideR3.0rc2/ --- -Installation Guide -================== +# Installation guide Welcome to the Qubes OS installation guide! This guide will walk you through the process of installing Qubes. Please read it carefully and thoroughly, as it contains important information for ensuring that your Qubes OS installation is functional and secure. -Pre-installation ----------------- +## Pre-installation -### Hardware Requirements ### +### Hardware requirements + + Qubes OS has very specific [system requirements]. To ensure compatibility, we strongly recommend using [Qubes-certified hardware]. Other hardware may require you to perform significant troubleshooting. You may also find it helpful to consult the [Hardware Compatibility List]. -Even on supported hardware, you must ensure that [IOMMU-based virtualization](https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit#Virtualization) is activated in the BIOS. +Even on supported hardware, you must ensure that [IOMMU-based virtualization] is activated in the BIOS. Without it, Qubes OS won't be able to enforce isolation. For Intel-based boards, this setting is called Intel Virtualization for Directed I/O (**Intel VT-d**) and for AMD-based boards, it is called AMD I/O Virtualization Technology (or simply **AMD-Vi**). This parameter should be activated in your computer's BIOS, alongside the standard Virtualization (**Intel VT-x**) and AMD Virtualization (**AMD-V**) extensions. -This [external guide](https://web.archive.org/web/20200112220913/https://www.intel.in/content/www/in/en/support/articles/000007139/server-products.html) made for Intel-based boards can help you figure out how to enter your BIOS to locate and activate those settings. +This [external guide][intel-guide] made for Intel-based boards can help you figure out how to enter your BIOS to locate and activate those settings. If those settings are not nested under the Advanced tab, you might find them under the Security tab. -