qusal/salt/sys-ssh
Ben Grande 44ea4c5db2
feat: add manual page reader
Ability to read the program's manual from the terminal is much better
than to ask the user to search the manual page on the internet, we
already trust the installed program and documentation, but we should not
trust every manual page on the internet.
2024-05-28 11:00:04 +02:00
..
files refactor: move appended states to drop-in rc.local 2023-12-19 22:50:59 +01:00
clone.sls refactor: initial commit 2023-11-13 14:33:28 +00:00
clone.top refactor: initial commit 2023-11-13 14:33:28 +00:00
configure.sls refactor: move appended states to drop-in rc.local 2023-12-19 22:50:59 +01:00
configure.top refactor: initial commit 2023-11-13 14:33:28 +00:00
create.sls chore: copyright update 2024-01-29 16:49:54 +01:00
create.top refactor: initial commit 2023-11-13 14:33:28 +00:00
init.top refactor: initial commit 2023-11-13 14:33:28 +00:00
install-client.sls fix: remove extraneous package repository updates 2024-03-18 17:51:36 +01:00
install-client.top refactor: initial commit 2023-11-13 14:33:28 +00:00
install.sls feat: add manual page reader 2024-05-28 11:00:04 +02:00
install.top refactor: initial commit 2023-11-13 14:33:28 +00:00
README.md doc: prefix qubesctl with sudo 2024-02-23 16:55:11 +01:00

sys-ssh

SSH over Qrexec in Qubes OS.

Table of Contents

Description

Creates a SSH server qube named "sys-ssh" to be a central document store to which other qubes have access with SSH File Transfer Protocol, using the tool sshfs. This is a simple tool that allows individual qubes to mount a another qube's filesystem rather than using qvm-copy or qvm-move.

The greatest problem with the Rsync solution is that it makes copies of the files or directories. This may be fine with a small amount of data, but with large files, or large numbers of files, there's a significant overhead. SSH File Transfer Protocol provides a way for clients to access files on the server qube directly.

Installation

  • Top:
sudo qubesctl top.enable sys-ssh
sudo qubesctl --targets=tpl-sys-ssh,sys-ssh state.apply
sudo qubesctl top.disable sys-ssh
  • State:
sudo qubesctl state.apply sys-ssh.create
sudo qubesctl --skip-dom0 --targets=tpl-sys-ssh state.apply sys-ssh.install
sudo qubesctl --skip-dom0 --targets=sys-ssh state.apply sys-ssh.configure

Install on the client template:

sudo qubesctl --skip-dom0 --targets=TEMPLATE state.apply sys-ssh.install-client

The client qube requires the SSH forwarder service to be enabled:

qvm-features QUBE service.ssh-setup 1

Access Control

A qusal.Ssh service is created to allow use of SSH over Qrexec. The default policy asks if you want to connect with the sys-ssh qube.

If you want to allow SSH between qubes, insert in you user policy file /etc/qubes/policy.d/30-user.policy to allow the service using the following format:

qusal.Ssh   * SOURCE @default allow target=TARGET

When the client can change the data on the server, it can also possibly compromise the server or at least make it hold malicious files and propagate the malicious data with clients it is connected to.

Usage

Server

It is possible to constrain access to files on the server, using (e.g) SSH chroots and access control mechanisms. This is left for the user to configure.

Passwordless login through empty passwords are allowed when the host matches 127.0.0.1, it makes no sense to restrict the access if the Qrexec call was already permitted.

Client

The SSH connection is available with the socket localhost:1840.

From the client, mount the server /home/user directory as a SSH File System in the client /home/user/sshfs directory:

mkdir ~/sshfs
sshfs -p 1840 localhost:/home/user /home/user/sshfs

Credits