Here's a weird, perhaps overly paranoid habit of mine: each year I arrive to Zabbix Summit -- or any similar conference -- with my Linux laptop reinstalled from scratch, running with the fortress that is Qubes OS.
Thanks to that, no matter what would happen to my laptop either physically or through super skilled black hats, there's absolutely no risk that anything important or sensitive would be lost. It gives me the peace of mind and is a fun little period of time when I play around with something Completely Else.
This year I did the installation about one month ahead of time, so I'll get real-world exposure to Qubes OS for a bit longer than few days.
Qubes OS?
Qubes OS certainly is not your usual Linux distribution. It's a crash course to virtualization. According to its own words, it's reasonably secure and it does that by allowing you to create different qubes for separate purposes. Your banking and other very personal stuff can run in one qube, work stuff in another qube, hobby stuff in yet another qube...
Each qube is actually its own Xen powered virtual machine, each of which can run any OS you like. By default Qubes comes with templates that are based on Fedora, Debian and Whonix, but more are available through Qubes Template Manager.
The contents on these qubes can surprise you at first. Depending on the setup, if you install some software to your VM through package manager and then shutdown your VM, you might be surprised to find out that the packages you installed are not there anymore when you next time start up that VM.
This is because for the changes to stick, you need to modify the underlying TemplateVM (shown in Qube Manager screenshot a bit above), for example fedora-40-xfce, or make your AppVM config to stick 100% --- when you create a new qube for any purpose, you get to choose if the OS packages and/or home directory contents are saved when you shutdown the VM, or will it always start from fresh.
FInally, there's also disposable VM, which completely disappears when you shutdown its instance.
Configuring the VMs
There's a nice GUi for managing your qubes. Here are few screenshots for the configuration of my zabbixsummit AppVM I just created for this blog post.
Running the apps
How do you then start the programs you use to run on different qubes? Easy, it's in the menu like this.
In the screenshot above, I would be starting Firefox to run on my separate zabbixsummit AppVM.
Now, if I want to start something that I don't trust, I can pick untrusted and launch Firefox from there, too. This spawns another Firefox running on its own VM. Even if on the screenshot below you see two Firefox windows, they don't know anything about each other. You can spot the qube where Firefox is running on from window border & title color, and from the name that's present on window title bar.
Any other app you then start to run on under some already running AppVM will then be running on that same VM. For example, if I would start a terminal window to run on my zabbixsummit qube, that would be running on that zabbixsummit VM. After all, this is just some Xen magic. If I start terminal on dom0 which is the management VM (not connected to network at all), you can see this.
What does this have to do with Zabbix?
Well, nothing, at least not yet. Of course I could throw in Zabbix agents to my TemplateVMs and start monitoring all these, but that would be just standard Linux monitoring.
This time I only told how I make sure my data & laptop is secure in any conference. The world is such strange place nowadays that better to be safe than sorry. Also, instead of wondering if I should use Arch, Fedora, Debian, something else, now I can run them all in perfect cooperation. Yeah, I could use just the usual virtualization software available on any distro and play around with virt-manager, virsh, others, or I could setup Proxmox, but Qubes OS is a really different approach.
I hope that this short intro to Qubes OS gives you some new ideas, too.
Add new comment