COMP 3000 2011 Report: Qubes beta 2 - Revision history

Dneray: /* Background */

2011-12-20T17:49:47Z

Background

← Older revision		Revision as of 17:49, 20 December 2011
Line 7:		Line 7:
	The first beta was released on Apr 11, 2011, and the 2nd beta was released on Sep 19, 2011. It is actively being developed by [http://invisiblethingslab.com/ Invisible Things Lab] and it can be downloaded from [http://wiki.qubes-os.org/trac/wiki/InstallationGuide here]. The install dvd is quite big at 1.59gb for the install DVD. In comparison, Ubuntu and most other Linux distributions will still fit on a 700mb CD.		The first beta was released on Apr 11, 2011, and the 2nd beta was released on Sep 19, 2011. It is actively being developed by [http://invisiblethingslab.com/ Invisible Things Lab] and it can be downloaded from [http://wiki.qubes-os.org/trac/wiki/InstallationGuide here]. The install dvd is quite big at 1.59gb for the install DVD. In comparison, Ubuntu and most other Linux distributions will still fit on a 700mb CD.

	This OS is designed with the primary goal of being secure. It employs a highly unique and interesting technique to achieve this; it runs some of the system components in a virtual machine and it runs user applications in separate user defined virtual machines. This theoretically isolates applications and their memory contents. This makes it such that if one application misbehaves or is maliciously exploited it is unlikely to have an effect on other applications in a separate VM or the running system. From my research it does not appear that there are any other operating systems available that have used this technique.		This OS is designed with the primary goal of being secure. It employs a highly unique and interesting technique to achieve this; it runs some of the system components in a virtual machine and it runs user applications in separate user defined virtual machines. This theoretically isolates applications and their memory contents. This makes it such that if one application misbehaves or is maliciously exploited it is unlikely to have an effect on other applications in a separate VM or the running system.

			From my research it does not appear that there are any other operating systems available that have used this technique. There are many users of the Xen software in combination with Linux, but it is always used to run multiple Operating Systems simultaneously. This approach to security is significantly more secure (between the different OSs) than the Qubes approach (between the different app VMs) but at the expense of a multitude of CPU power.

	One of the truly revolutionary parts of this platform is the way that the GUI integrates the multiple VMs in order to make it as seamless as possible for the user to manage. The other majorly revolutionary part of this platform is the fact that it sandboxes parts of the system like networking (by isolating them in a VM) for extra security.		One of the truly revolutionary parts of this platform is the way that the GUI integrates the multiple VMs in order to make it as seamless as possible for the user to manage. The other majorly revolutionary part of this platform is the fact that it sandboxes parts of the system like networking (by isolating them in a VM) for extra security.

Dneray: /* Usage Evaluation */

2011-12-20T17:44:41Z

Usage Evaluation

← Older revision		Revision as of 17:44, 20 December 2011
Line 78:		Line 78:


	Overall this is great for people who really need the security and stability that this architecture provides, but the requirements are a little bit too ridiculous (and it might be a little unnecessary for ordinary users) to become truly mainstream at the moment. In my VM with 3.2gb of ram dedicated I was only able to run the basic VMs. While 4gb and a 64bit processor is standard in computers purchased in the past year, the reality is that right now, most computers out there do not meet these requirements. ~~It could also be adapted easily to be better for "clueless" users by providing~~ a ~~set~~ of ~~preset VMs~~ that ~~users can choose from~~ to ~~fit different peoples needs (as opposed~~ to ~~making everybody create their own VMs entirely)~~.		Overall this is great for people who really need the security and stability that this architecture provides, but the requirements are a little bit too ridiculous (and it might be a little unnecessary for ordinary users) to become truly mainstream at the moment. In my VM with 3.2gb of ram dedicated I was only able to run the basic VMs. While 4gb and a 64bit processor is standard in computers purchased in the past year, the reality is that right now, most computers out there do not meet these requirements.


			As I mentioned I ran Qubes in a VM, obviously this is not a fair test since it runs VMs inside of itself and my system is not powerful enough to fully utilize the system like this. I did it that way because I had no choice when it refused to boot natively on any of my computers. I still think it has been enough experience to learn what I needed to learn in order to write this report.

	===References===		===References===
	<references/>		<references/>

Dneray: /* Basic Operation */

2011-12-20T17:39:08Z

Basic Operation

← Older revision		Revision as of 17:39, 20 December 2011
Line 57:		Line 57:
	[[File:LoginScreen.png\|200px\|thumb\|right\|login to your newly installed OS]]		[[File:LoginScreen.png\|200px\|thumb\|right\|login to your newly installed OS]]
	Qubes runs a seemingly unmodified version of KDE graphical environment but unfortunately it is stripped down and contains only a few of the nice goodies that usually come along with that. The only difference that can be noted from a standard linux desktop running KDE is that it has an extra icon in the taskbar which can be used for managing app VMs. This app gives you all the options you need to manage your different VMs, you first name the VM, then you can choose whether or not this VM has access to the network, then you can transfer over to the advanced tab and set the maximum size of the VM and how much ram and cpu resources you would like to devote to it.		Qubes runs a seemingly unmodified version of KDE graphical environment but unfortunately it is stripped down and contains only a few of the nice goodies that usually come along with that. The only difference that can be noted from a standard linux desktop running KDE is that it has an extra icon in the taskbar which can be used for managing app VMs. This app gives you all the options you need to manage your different VMs, you first name the VM, then you can choose whether or not this VM has access to the network, then you can transfer over to the advanced tab and set the maximum size of the VM and how much ram and cpu resources you would like to devote to it.

			The way the system manages interaction between the virtual machines is the key of this distribution. All applications have their files stored in the .img file of the VM which they are part of. Applications have readonly access to the image filesystem and store their files directly on the filesystem.

	[[File:addNewVMs.png\|200px\|thumb\|right\|This is how you add a custom VM]] The intended usage for this distribution is general productivity in a secure manner, so I decided to try installing some applications and putting them in different VMs in order to see how the VMs look to the user and how it deals with package management and updates inside the VMs.		[[File:addNewVMs.png\|200px\|thumb\|right\|This is how you add a custom VM]] The intended usage for this distribution is general productivity in a secure manner, so I decided to try installing some applications and putting them in different VMs in order to see how the VMs look to the user and how it deals with package management and updates inside the VMs.
	[[File:VMlist.png\|200px\|thumb\|right\|lThis is how you manage the VMs, you can pause, stop or start them from here]]		[[File:VMlist.png\|200px\|thumb\|right\|lThis is how you manage the VMs, you can pause, stop or start them from here]]
	Since this system is baed on fedora, it uses RPM packages and has the default package manager 'yum' with a kde frontend. It worked flawlessly, I installed a web browser and the open office suite and attempted to separate them into multiple VMs. Unfortunately this was too much for my system to handle running it in a VM and it politely displayed the message 'failed to start custom VM' and open office refused to open until I moved it back into the default VM. This is perfectly acceptable though given that my system just meets the requirements to run this OS natively so some hiccups are to be expected.		Since this system is baed on fedora, it uses RPM packages and has the default package manager 'yum' with a kde frontend. It worked flawlessly, I installed a web browser and the open office suite and attempted to separate them into multiple VMs. Unfortunately this was too much for my system to handle running it in a VM and it politely displayed the message 'failed to start custom VM' and open office refused to open until I moved it back into the default VM. This is perfectly acceptable though given that my system just meets the requirements to run this OS natively so some hiccups are to be expected.


			In terms of security, there are clear advantages to this approach to managing applications in this manner. It makes it theoretically very difficult for a malicious 3rd party to exploit an application and gain root access to the system. There is definitely a big performance hit that occurs when running so many VMs at the same time though.

			Everything seems very sluggish when compared to other linux distributions like Ubuntu running in the same environment. Like many modern operating systems, the scheduler in Qubes appears to prioritze the things that people notice. For example, opening a program might take 10-20 seconds from clicking on it to start actually seeing the program open, but things like highlighting, moving the cursor around, etc did not lag at all which makes the user feel better about the performance.

	===Usage Evaluation===		===Usage Evaluation===

Dneray: /* Installation/Startup */

2011-12-20T17:17:07Z

Installation/Startup

← Older revision		Revision as of 17:17, 20 December 2011
Line 40:		Line 40:
	I ran into my first issue very quickly which was that I did not read there release notes for beta 2 and I discovered that the installer does not support my macbook pro keyboard but this was quickly remedied by plugging in a USB keyboard. I decided to skip the disk check and then I was asked to partion my drive and set a time zone. I chose to encrypt my hard drive because it would feel a little hypocritical not to with such a secure OS.		I ran into my first issue very quickly which was that I did not read there release notes for beta 2 and I discovered that the installer does not support my macbook pro keyboard but this was quickly remedied by plugging in a USB keyboard. I decided to skip the disk check and then I was asked to partion my drive and set a time zone. I chose to encrypt my hard drive because it would feel a little hypocritical not to with such a secure OS.
	[[File:partitioning.jpg\|200px\|thumb\|right\|Partitioning the disk]]		[[File:partitioning.jpg\|200px\|thumb\|right\|Partitioning the disk]]

	After that the install failed, let this be a lesson to you to check your disk if you want to potentially save some time. I redownloaded the imagine and went through the installation again, now after completing the installation my mac was unable to boot from the USB hard drive, so I gave the usb hard drive a try on a PC as well as through REefIt mac software and it wouldn't boot. So I gave a native installation a try, I wiped my bootcamp partition off my macbook and I installed Qubes in its place. To my disappointment it still would not boot and REefIt could see it but it would just say "No Operating System Present, Insert Bootable Disk and Press Enter To Continue".		After that the install failed, let this be a lesson to you to check your disk if you want to potentially save some time. I redownloaded the imagine and went through the installation again, now after completing the installation my mac was unable to boot from the USB hard drive, so I gave the usb hard drive a try on a PC as well as through REefIt mac software and it wouldn't boot. So I gave a native installation a try, I wiped my bootcamp partition off my macbook and I installed Qubes in its place. To my disappointment it still would not boot and REefIt could see it but it would just say "No Operating System Present, Insert Bootable Disk and Press Enter To Continue".

	So I gave up and I installed Qubes in a VM which is incapable of showing its true power and is not recommended but I was left with no options to get this OS up and running. I used VMWare Fusion to run it.		So I gave up and I installed Qubes in a VM which is incapable of showing its true power and is not recommended but I was left with no options to get this OS up and running. I used VMWare Fusion to run it.

	[[File:FirstBoot.png\|200px\|thumb\|right\|The first screen you will see after starting up the new system (running in a VM]] Upon the first boot I was greeted with a nice welcome screen that walked me through creating a user account and asked me how I wanted to manage my VM bottles. It gives you 3 options at this point, you can have it automatically create the default app VMs (which is what most basic users want), you could manually specify the app VMs (which could be useful for ~~setting home/work bottles, etc~~) and then there's the option not to create any VMs which is not recommended.		[[File:FirstBoot.png\|200px\|thumb\|right\|The first screen you will see after starting up the new system (running in a VM]] Upon the first boot I was greeted with a nice welcome screen that walked me through creating a user account and asked me how I wanted to manage my VM bottles. It gives you 3 options at this point, you can have it automatically create the default app VMs (which is what most basic users want), you could manually specify the app VMs (which could be useful for tweaking the system for extra security at the expense of speed) and then there's the option not to create any VMs which is not recommended.

			The default option creates a dom0 VM that is used system operations that require special access, a networking VM, a separate VM for other system applications and one for user applications. By manually defining more VMs you could also create separate VMs for work apps, home apps, apps that deal with confidential information, etc. If you select to not create any VMs then the system is essentially a modified Linux distro, and it takes away the most of the advantage of this OS, it will only have the dom0 virtual machine and everything runs on that.


	[[File:CreateServiceVMs.png\|200px\|thumb\|right\|Creating the VMs]]		[[File:CreateServiceVMs.png\|200px\|thumb\|right\|Creating the VMs]]
	After these simple steps you will end up at the standard KDE login screen.		After these simple steps you will end up at the standard KDE login screen.

Dneray: /* Background */

2011-12-20T15:56:06Z

Background

← Older revision		Revision as of 15:56, 20 December 2011
Line 3:		Line 3:
	===Background===		===Background===
	[[File:droppedImage.png\|200px\|thumb\|right\|A visual representation of the security system used by Quebes]]		[[File:droppedImage.png\|200px\|thumb\|right\|A visual representation of the security system used by Quebes]]
	[http://qubes-os.org/ Quebes] is a very new Operating System based off ~~the~~ Fedora Linux OS ~~combined with~~ the Xen Hypervisor ~~and X Windows System GUI~~ aimed primarily at people dealing with confidential information but ~~also~~ anybody who is concerned about their computer security. The first beta was released on Apr 11, 2011 and the 2nd beta was released on Sep 19, 2011. It is actively being developed by [http://invisiblethingslab.com/ Invisible Things Lab] and it can be downloaded from [http://wiki.qubes-os.org/trac/wiki/InstallationGuide here] weighing in at a hefty 1.59gb for the install dvd.		[http://qubes-os.org/ Quebes] is a very new Operating System based off of Fedora Linux OS and the Xen Hypervisor. It is aimed primarily at people dealing with confidential information, but could it be used by anybody who is concerned about their computer security.

	~~This OS~~ is ~~designed with the primary goal of~~ being ~~secure~~. ~~It employs a highly unique~~ and ~~interesting technique to achieve this;~~ it ~~runs some of~~ the ~~system components in a virtual machine and it runs user applications in separate user defined virtual machines~~. ~~This theoretically isolates applications~~ and ~~their memory contents. This makes it such that if one application misbehaves or is maliciously exploited it is unlikely to have an effect~~ on ~~other applications in~~ a ~~separate VM or the running system~~.		The first beta was released on Apr 11, 2011, and the 2nd beta was released on Sep 19, 2011. It is actively being developed by [http://invisiblethingslab.com/ Invisible Things Lab] and it can be downloaded from [http://wiki.qubes-os.org/trac/wiki/InstallationGuide here]. The install dvd is quite big at 1.59gb for the install DVD. In comparison, Ubuntu and most other Linux distributions will still fit on a 700mb CD.

	One of the truly revolutionary parts of this platform is the way that the GUI integrates the multiple VMs in order to make it as seamless as possible for the user to manage. The other majorly revolutionary part of this platform is the fact that it sandboxes parts of the system like networking for extra security.		This OS is designed with the primary goal of being secure. It employs a highly unique and interesting technique to achieve this; it runs some of the system components in a virtual machine and it runs user applications in separate user defined virtual machines. This theoretically isolates applications and their memory contents. This makes it such that if one application misbehaves or is maliciously exploited it is unlikely to have an effect on other applications in a separate VM or the running system. From my research it does not appear that there are any other operating systems available that have used this technique.

			One of the truly revolutionary parts of this platform is the way that the GUI integrates the multiple VMs in order to make it as seamless as possible for the user to manage. The other majorly revolutionary part of this platform is the fact that it sandboxes parts of the system like networking (by isolating them in a VM) for extra security.

	===Hardware Requirements<ref>http://wiki.qubes-os.org/trac/wiki/InstallationGuide</ref>===		===Hardware Requirements<ref>http://wiki.qubes-os.org/trac/wiki/InstallationGuide</ref>===

Dneray: /* References */

2011-10-20T03:07:35Z

References

← Older revision		Revision as of 03:07, 20 October 2011
Line 68:		Line 68:

	===References===		===References===
			<references/>

Dneray: /* Hardware Requirements */

2011-10-20T03:06:47Z

Hardware Requirements

← Older revision		Revision as of 03:06, 20 October 2011
Line 9:		Line 9:
	One of the truly revolutionary parts of this platform is the way that the GUI integrates the multiple VMs in order to make it as seamless as possible for the user to manage. The other majorly revolutionary part of this platform is the fact that it sandboxes parts of the system like networking for extra security.		One of the truly revolutionary parts of this platform is the way that the GUI integrates the multiple VMs in order to make it as seamless as possible for the user to manage. The other majorly revolutionary part of this platform is the fact that it sandboxes parts of the system like networking for extra security.

	===Hardware Requirements===		===Hardware Requirements<ref>http://wiki.qubes-os.org/trac/wiki/InstallationGuide</ref>===

	'''Minimum:'''		'''Minimum:'''

Dneray: /* Basic Operation */

2011-10-20T02:43:51Z

Basic Operation

← Older revision		Revision as of 02:43, 20 October 2011
Line 53:		Line 53:

	[[File:addNewVMs.png\|200px\|thumb\|right\|This is how you add a custom VM]] The intended usage for this distribution is general productivity in a secure manner, so I decided to try installing some applications and putting them in different VMs in order to see how the VMs look to the user and how it deals with package management and updates inside the VMs.		[[File:addNewVMs.png\|200px\|thumb\|right\|This is how you add a custom VM]] The intended usage for this distribution is general productivity in a secure manner, so I decided to try installing some applications and putting them in different VMs in order to see how the VMs look to the user and how it deals with package management and updates inside the VMs.
	[[File:VMlist.png\|200px\|thumb\|right\|lThis is how you manage the VMs, you can pause, stop or start them from here]		[[File:VMlist.png\|200px\|thumb\|right\|lThis is how you manage the VMs, you can pause, stop or start them from here]]
	Since this system is baed on fedora, it uses RPM packages and has the default package manager 'yum' with a kde frontend. It worked flawlessly, I installed a web browser and the open office suite and attempted to separate them into multiple VMs. Unfortunately this was too much for my system to handle running it in a VM and it politely displayed the message 'failed to start custom VM' and open office refused to open until I moved it back into the default VM. This is perfectly acceptable though given that my system just meets the requirements to run this OS natively so some hiccups are to be expected.		Since this system is baed on fedora, it uses RPM packages and has the default package manager 'yum' with a kde frontend. It worked flawlessly, I installed a web browser and the open office suite and attempted to separate them into multiple VMs. Unfortunately this was too much for my system to handle running it in a VM and it politely displayed the message 'failed to start custom VM' and open office refused to open until I moved it back into the default VM. This is perfectly acceptable though given that my system just meets the requirements to run this OS natively so some hiccups are to be expected.

Dneray: /* Basic Operation */

2011-10-20T02:43:28Z

Basic Operation

← Older revision		Revision as of 02:43, 20 October 2011
Line 52:		Line 52:
	Qubes runs a seemingly unmodified version of KDE graphical environment but unfortunately it is stripped down and contains only a few of the nice goodies that usually come along with that. The only difference that can be noted from a standard linux desktop running KDE is that it has an extra icon in the taskbar which can be used for managing app VMs. This app gives you all the options you need to manage your different VMs, you first name the VM, then you can choose whether or not this VM has access to the network, then you can transfer over to the advanced tab and set the maximum size of the VM and how much ram and cpu resources you would like to devote to it.		Qubes runs a seemingly unmodified version of KDE graphical environment but unfortunately it is stripped down and contains only a few of the nice goodies that usually come along with that. The only difference that can be noted from a standard linux desktop running KDE is that it has an extra icon in the taskbar which can be used for managing app VMs. This app gives you all the options you need to manage your different VMs, you first name the VM, then you can choose whether or not this VM has access to the network, then you can transfer over to the advanced tab and set the maximum size of the VM and how much ram and cpu resources you would like to devote to it.

			[[File:addNewVMs.png\|200px\|thumb\|right\|This is how you add a custom VM]] The intended usage for this distribution is general productivity in a secure manner, so I decided to try installing some applications and putting them in different VMs in order to see how the VMs look to the user and how it deals with package management and updates inside the VMs.
	[File:addNewVMs.png\|200px\|thumb\|right\|This is how you add a custom VM]] The intended usage for this distribution is general productivity in a secure manner, so I decided to try installing some applications and putting them in different VMs in order to see how the VMs look to the user and how it deals with package management and updates inside the VMs.		[[File:VMlist.png\|200px\|thumb\|right\|lThis is how you manage the VMs, you can pause, stop or start them from here]
	[File:VMlist.png\|200px\|thumb\|right\|lThis is how you manage the VMs, you can pause, stop or start them from here]
	Since this system is baed on fedora, it uses RPM packages and has the default package manager 'yum' with a kde frontend. It worked flawlessly, I installed a web browser and the open office suite and attempted to separate them into multiple VMs. Unfortunately this was too much for my system to handle running it in a VM and it politely displayed the message 'failed to start custom VM' and open office refused to open until I moved it back into the default VM. This is perfectly acceptable though given that my system just meets the requirements to run this OS natively so some hiccups are to be expected.		Since this system is baed on fedora, it uses RPM packages and has the default package manager 'yum' with a kde frontend. It worked flawlessly, I installed a web browser and the open office suite and attempted to separate them into multiple VMs. Unfortunately this was too much for my system to handle running it in a VM and it politely displayed the message 'failed to start custom VM' and open office refused to open until I moved it back into the default VM. This is perfectly acceptable though given that my system just meets the requirements to run this OS natively so some hiccups are to be expected.

Dneray: /* Basic Operation */

2011-10-20T02:42:20Z

Basic Operation

← Older revision		Revision as of 02:42, 20 October 2011
Line 52:		Line 52:
	Qubes runs a seemingly unmodified version of KDE graphical environment but unfortunately it is stripped down and contains only a few of the nice goodies that usually come along with that. The only difference that can be noted from a standard linux desktop running KDE is that it has an extra icon in the taskbar which can be used for managing app VMs. This app gives you all the options you need to manage your different VMs, you first name the VM, then you can choose whether or not this VM has access to the network, then you can transfer over to the advanced tab and set the maximum size of the VM and how much ram and cpu resources you would like to devote to it.		Qubes runs a seemingly unmodified version of KDE graphical environment but unfortunately it is stripped down and contains only a few of the nice goodies that usually come along with that. The only difference that can be noted from a standard linux desktop running KDE is that it has an extra icon in the taskbar which can be used for managing app VMs. This app gives you all the options you need to manage your different VMs, you first name the VM, then you can choose whether or not this VM has access to the network, then you can transfer over to the advanced tab and set the maximum size of the VM and how much ram and cpu resources you would like to devote to it.

	~~[[File:LoginScree1n.png\|200px\|thumb\|right\|login to your newly installed OS]]~~

	[File:addNewVMs.png\|200px\|thumb\|right\|This is how you add a custom VM]] The intended usage for this distribution is general productivity in a secure manner, so I decided to try installing some applications and putting them in different VMs in order to see how the VMs look to the user and how it deals with package management and updates inside the VMs.		[File:addNewVMs.png\|200px\|thumb\|right\|This is how you add a custom VM]] The intended usage for this distribution is general productivity in a secure manner, so I decided to try installing some applications and putting them in different VMs in order to see how the VMs look to the user and how it deals with package management and updates inside the VMs.