Advanced Plus Security Victor M main PC (Linux) config

[Victor M]

Qubes OS PC config.

Qubes doesn't really need 24 Gb ram, pc store miscommunication. I asked for 16 Gb total and he thought I wanted to add 16 Gb.

Qubes can optionally use a disposable vm for it's inet facing sys-net qube. Needs 3 mins setup time for each reboot to re-setup vpn. But then I don't reboot often.

 

[Victor M]

5 months and still going strong.

Added firejail, Xephyr and openbox (migrated ubuntu hardening over to Fedora)

Added Win 10 qube for fooling around.

 

[Victor M]

Here's what I do for security. It's most;y administrative/procedure things.

- I calendar update my LoL Bin blocks after every Patch Tuesday
- I always unplug ethernet when I use admin account
- I ponder over new software installs, and preserve steady state
- I cell alarm time to go over SIEM Alerts every day
- I copy paste online random password generators whenever I need a new password
- I calendar penetration tests every year
- I upload my downloads to VT before use
- I calendar PCI-DSS audits
- I calendar EICAR tests
- I create SIEM alerts whenever I discover some
- I calendar DSA Stig update golden image every 3 months & do drift detection
- I calendar 'Administrator' password changes
- I restore from then do offline golden image updates whenever security is improved, preserving the clean offline state
- I update the secure config procedures whenever golden image is updated
- I cell alarm the time to do backups
- I hunt for offline installers for any software because my admin acc stays offline
- I always setup 2FA when they have it
- Create more administrative controls whenever
- OSINT

I welcome comments

 

[Victor M]

 

[Victor M]

Qubes is perfect if you want to set up a RBAC (role based access control) system. Each qube has its own color frame. And each qube is separate from each other. What that means is that you can use one qube to surf to wherever, and it will never affect the other qube containing your private and confidential documents and xls. Because Qubes uses Zen virtualization and is a type 1 hypervisor. Virtualization security is what malware testers use when testing malware, and it is nearly impossible to break - provided that you separate your roles carefully among the different qubes. You can further prevent cross contamination by setting a qube to have no networking. Of course you can open many qubes at the same time, such that when a question arises during work, you can click on the surfing qube and search the net.

One thing you ought to be aware of is there is no effective sudo in Qubes. Don't ask me why, but the founder firmly believes it is pointless to have sudo, and relies on her deep understanding of virtualization security when she was designing Qubes. She is an expert when it comes to virtualization and even created POC exploits to help nudge virtualization to perfection.

There are several system related qubes which are created along with the defaults 'private', 'work', 'untrusted'. Those are used by the system like sys-usb, which directs inserted usb drives to your chosen qube. And sys-net, which is for networking and redirects traffic to whichever qube is using lets say a browser. There is a tor based qube which I don't use, so I can't tell you more about it. It is meant to be a one-time browser connection to a super-untrusted site. You can create as many qubes as you need, each with a different colored frame. I just used the default ones when I had 8 gigs of ram. You can transfer files between qubes using the system menu, and you can also cut and paste between qubes. It's all done via a protected method thru Qubes.

Underneath the hypervisor, it uses 3 distro's: Fedora, Debian, and Whonix. You can install other distro's if you want but it is not offiially supported. Just remember to point your distro to the ip address of sys-net so that networking works. When you are setting up 'normal' qubes you don't have to bother with networking; it's all taken care of. A qube can also be specified as disposable, which means it keeps no data. As I said in my first post, I made sys-net disposable just to annoy potential attackers, as none of their malware will stick.

You can add more security to Qubes for instance by adding firejail. But on the whole, it offers enough security without needing much tinkering. My very simple threat model is to protect my work documents and xls, and Qubes fits the bill.

 

[simmerskool]

in a discussion with chatGPT 5.2 it suggested I replace my host with Proxmox VE. have you looked into that? just curious. sidenote: LibreWolf has been running great on my fedora 43 VM. added hagezi pro multi to ubo, nice experience. So Qubes comes with fedora as one of 3 VM preinstalled or you install fedora and it is a supported OS

 

[Victor M]

So Qubes comes with fedora as one of 3 VM preinstalled or

It comes preinistalled.

 

[Victor M]

Proxmox VE. have you looked into that?

Nope. Haven't heard about it before, not that I venture far and wide.

 

[simmerskool]

Nope. Haven't heard about it before, not that I venture far and wide.

I know you tend to look deeply, ChatGPT 5.2 seems to like Proxmox VE, I asked about replacing my host with Qubes and it said for me Proxmox VE was better choice, basic reason Qubes is too tight as a daily driver, it's more for malware research level isolation.

 

[Victor M]

@simmerskool Here's what I asked Chat and what she said. But note ChatGPT cusrtomizes answers knowing what I do professionally, by the questions I've asked before. So she could be tailoring the answer to my known demands of an OS. Roughly speaking speaking, she knows I prefers to be secure.
--------------------------------------------------------------------------------------------------

Using ProvMox as the hypervisor and running Fedora as a 'guest' os. Does that suite as a daily driver more than Qubes ?




Using Proxmox as the hypervisor and running Fedora as a guest can work as a daily driver, but it usually doesn’t beat Qubes as a daily driver if your goal is “security through compartmentalization.” It’s closer to “a DIY VDI workstation” than “Qubes-but-better.”

The core difference​

Qubes daily-driver model (what it’s optimized for)​

Qubes is built to make it easy to run many separate security domains (work/personal/banking/random-PDF, etc.) with strong isolation, plus safe inter-VM workflows (copy/paste, file move, app menus) via qrexec. Qubes OS+2Qubes OS+2
It also has a device-handling security model (e.g., isolating risky USB) that’s part of the design, not an afterthought. Qubes OS
And it supports Disposable VMs for “open this risky thing and throw it away.” Qubes OS

Proxmox + Fedora guest model (what it’s optimized for)​

Proxmox VE is a Debian-based virtualization platform meant to run and manage VMs/containers using KVM/QEMU with a web-based management stack. Proxmox VE+1
Yes, Proxmox even documents “developer workstations with X11,” but that’s essentially: “turn the hypervisor host into a workstation and run desktop VMs.” Proxmox VE

Why Proxmox+Fedora usually isn’t “more suitable than Qubes” as a daily driver​

1. If you run just one Fedora VM, you’re not getting Qubes’ main benefit
   You’ve basically got “a Linux desktop, but inside a VM.” Qubes’ advantage is the many-VM workflow with low friction. Qubes OS+1
2. Your Proxmox host becomes part of your daily-risk surface
   Proxmox’s host is a full system running management services (web UI/API, etc.). That’s fine for a server, but it’s the opposite of the Qubes idea of keeping the most-trusted layer minimal and not used for daily browsing. Proxmox VE+1
3. Desktop ergonomics are “possible,” but not the point
   To feel like a normal workstation you’ll end up doing GPU passthrough, SPICE/remote console tuning, USB passthrough decisions, audio/display integration, etc. Proxmox can do this, but Qubes is designed around that end-user workflow. Proxmox VE+1

When Proxmox+Fedora​

Choose Proxmox+Fedora if:

• You mainly want performance + a normal Fedora desktop, and your goal is “run Fedora” (not “run 8 isolated compartments all day”).
• You want easy snapshots/rollback of the whole workstation VM (a strong practical benefit of the Proxmox model). Proxmox VE+1
• You’re okay with “security = Fedora hardening + VM boundary,” rather than Qubes’ compartment-by-default approach.

Bottom line​

• For “security daily driver” (lots of isolation compartments, disposable tasks, safer device handling): Qubes wins. Qubes OS+2Qubes OS+2
• For “I want Fedora as my main desktop, but I also want hypervisor features (snapshots, lab VMs, central management): Proxmox+Fedora can be great. Proxmox VE+1

 

[simmerskool]

@simmerskool Here's what I asked Chat and what she said. But note ChatGPT cusrtomizes answers knowing what I do professionally, by the questions I've asked before. So she could be tailoring the answer to my known demands of an OS. Roughly speaking speaking, she knows I prefers to be secure.
--------------------------------------------------------------------------------------------------

I think ditto, chatGPT 5.2 tailored its answer for my interactions with it, plus you are already running Qubes and I'm considering a replacement for win10 on my hardware...

 

[Victor M]

@simmerskool One thing you could do should you choose to run Fedora to approximate the benefit of Qubes virtualization is to use Mozilla Firefox Multi-Account Container extension. It create a separate sandbox for a particular tab. So lets say you surf to MT all day and suddenly feel to shop for a gift at amazon. You click on the extension to open a separate sandbox and type amazon. Your interaction with amazon is now isolated among all the other tabs you have open. A little better than using a separate firefox profile I think or else Mozilla wouldn't have made this.

Straight from it's documentation:


Under the hood, it separates website storage into tab-specific Containers. Cookies downloaded by one Container are not available to other Containers. You can even integrate individual Containers with Mozilla VPN to protect your browsing and location. With the Firefox Multi-Account Containers extension, you can...

Sign in to two different accounts on the same site (for example, you could sign in to work email and home email in two different Container tabs.
Keep different kinds of browsing far away from each other (for example, you might use one Container tab for managing your Checking Account and a different Container tab for searching for new songs by your favorite band)
Avoid leaving social-network footprints all over the web (for example, you could use a Container tab for signing in to a social network, and use a different tab for visiting online news sites, keeping your social identity separate from tracking scripts on news sites)
Protect your browsing activity in individual Containers using Mozilla VPN, so you can shop while travelling abroad but check your bank account from a server in your home country.

 

[simmerskool]

@simmerskool One thing you could do should you choose to run Fedora to approximate the benefit of Qubes virtualization is to use Mozilla Firefox Multi-Account Container extension.

yes I have been using multi account container ext for a few months. I'm using my MalwareTips MAC in fedora_VM librewolf even as I type this reply

 

[Victor M]

Linux security joke:

How do you protect your computer from a virus? Don’t open the Windows