mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2024-12-20 05:04:36 -05:00
159 lines
4.5 KiB
ReStructuredText
159 lines
4.5 KiB
ReStructuredText
================
|
||
Debian templates
|
||
================
|
||
|
||
|
||
The Debian :doc:`template </user/templates/templates>` is an officially
|
||
:ref:`supported <user/downloading-installing-upgrading/supported-releases:templates>` template in Qubes OS.
|
||
This page is about the standard (or “full”) Debian template. For the
|
||
minimal version, please see the :doc:`Minimal templates </user/templates/minimal-templates>` page. There is also a `Qubes page on the Debian Wiki <https://wiki.debian.org/Qubes>`__.
|
||
|
||
Installing
|
||
----------
|
||
|
||
|
||
To :ref:`install <user/templates/templates:installing>` a specific Debian template
|
||
that is not currently installed in your system, use the following
|
||
command in dom0:
|
||
|
||
.. code:: bash
|
||
|
||
$ sudo qubes-dom0-update qubes-template-debian-XX
|
||
|
||
|
||
|
||
(Replace ``XX`` with the Debian version number of the template you wish
|
||
to install.)
|
||
|
||
To reinstall a Debian template that is already installed in your system,
|
||
see :doc:`How to Reinstall a template </user/how-to-guides/how-to-reinstall-a-template>`.
|
||
|
||
After Installing
|
||
----------------
|
||
|
||
|
||
After installing a fresh Debian template, we recommend performing the
|
||
following steps:
|
||
|
||
1. :doc:`Update the template </user/how-to-guides/how-to-install-software>`.
|
||
|
||
2. :ref:`Switch any app qubes that are based on the old template to the new one <user/templates/templates:switching>`.
|
||
|
||
3. If desired, :ref:`uninstall the old template <user/templates/templates:uninstalling>`.
|
||
|
||
|
||
|
||
Installing software
|
||
-------------------
|
||
|
||
|
||
See :doc:`How to Install Software </user/how-to-guides/how-to-install-software>`.
|
||
|
||
Updating
|
||
--------
|
||
|
||
|
||
For routine daily updates within a given release, see :doc:`How to Update </user/how-to-guides/how-to-update>`.
|
||
|
||
Upgrading
|
||
---------
|
||
|
||
|
||
There are two ways to upgrade your template to a new Debian release:
|
||
|
||
- **Recommended:** `Install a fresh template to replace the existing one. <#installing>`__ **This option may be simpler for less experienced users.** After you install the new template, redo all
|
||
desired template modifications and :ref:`switch everything that was set to the old template to the new template <user/templates/templates:switching>`.
|
||
You may want to write down the modifications you make to your
|
||
templates so that you remember what to redo on each fresh install. In
|
||
the old Debian template, see ``/var/log/dpkg.log`` and
|
||
``/var/log/apt/history.log`` for logs of package manager actions.
|
||
|
||
- **Advanced:** :doc:`Perform an in-place upgrade of an existing Debian template. </user/templates/debian/debian-upgrade>` This option
|
||
will preserve any modifications you’ve made to the template, **but it may be more complicated for less experienced users.**
|
||
|
||
|
||
|
||
Release-specific notes
|
||
----------------------
|
||
|
||
|
||
This section contains notes about specific Debian releases.
|
||
|
||
Debian 10
|
||
^^^^^^^^^
|
||
|
||
|
||
Debian 10 (buster) - minimal:
|
||
|
||
.. code:: bash
|
||
|
||
[user@dom0 ~]$ sudo qubes-dom0-update --enablerepo=qubes-templates-itl qubes-template-debian-10-minimal
|
||
|
||
|
||
Debian 10 (buster) - stable:
|
||
|
||
.. code:: bash
|
||
|
||
[user@dom0 ~]$ sudo qubes-dom0-update --enablerepo=qubes-templates-itl qubes-template-debian-10
|
||
|
||
|
||
Starting services
|
||
^^^^^^^^^^^^^^^^^
|
||
|
||
|
||
The Debian way (generally) is to start daemons if they are installed.
|
||
This means that if you install (say) ssh-server in a template, *all* the
|
||
qubes that use that template will run a ssh server when they start.
|
||
(They will, naturally, all have the same server key.) This may not be
|
||
what you want.
|
||
|
||
So be very careful when installing software in Templates - if the daemon
|
||
spawns outbound connections then there is a serious security risk.
|
||
|
||
In general, a reasonable approach would be, (using ssh as example):
|
||
|
||
- Install the ssh service.
|
||
|
||
- ``systemctl stop ssh``
|
||
|
||
- ``systemctl disable ssh``
|
||
|
||
- ``systemctl mask ssh``
|
||
|
||
- Close down template
|
||
|
||
|
||
|
||
Now the ssh service will **NOT** start in qubes based on this template.
|
||
|
||
Where you **DO** want the service to run, put this in
|
||
``/rw/config/rc.local``:
|
||
|
||
.. code:: bash
|
||
|
||
systemctl unmask ssh
|
||
systemctl start ssh
|
||
|
||
|
||
|
||
Don’t forget to make the file executable.
|
||
|
||
Unattended Upgrades
|
||
^^^^^^^^^^^^^^^^^^^
|
||
|
||
|
||
Some users have noticed that on upgrading to Stretch, the
|
||
``unattended-upgrade`` package is installed.
|
||
|
||
This package is pulled in as part of a Recommend chain, and can be
|
||
purged.
|
||
|
||
The lesson is that you should carefully look at what is being installed
|
||
to your system, particularly if you run ``dist-upgrade``.
|
||
|
||
Package installation errors in Qubes 4.0
|
||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||
|
||
|
||
If some packages throw installation errors, see :ref:`this guide. <user/troubleshooting/vm-troubleshooting:fixing package installation errors>`
|