Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

awesome-qubes-os

A curated list of awesome qubes os links
https://github.com/xn0px90/awesome-qubes-os

Last synced: 3 days ago
JSON representation

  • Templates

    • Xfce templates - If you would like to use Xfce (more lightweight compared to GNOME desktop environment) Linux distribution in your Qubes, you can install one of the available Xfce templates for Fedora, CentOS or Gentoo.
    • Qvm-Create-Windows-Qube - Qvm-Create-Windows-Qube is a tool for quickly and conveniently installing fresh new Windows qubes with Qubes Windows Tools (QWT) drivers automatically.
    • Shadow qube - The below script will create a Qube, launch the Tor browser, wait for the browser to close, then remove the qube and its RAM pool.
    • Pentesting: BlackArch - BlackArch Linux is an Arch Linux-based distribution for penetration testers and security researchers.
    • Pentesting: Kali - How to create a Kali Linux VM.
    • Template manager - A template manager application.
    • USB Qubes - A USB qube acts as a secure handler for potentially malicious USB devices, preventing them from coming into contact with dom0 (which could otherwise be fatal to the security of the whole system). I
    • Pentesting: PTF - "The PenTesters Framework (PTF) is a Python script designed for Debian/Ubuntu/ArchLinux based distributions to create a similar and familiar distribution for Penetration Testing.
    • Template: Windows - Simple Windows install
    • Windows Qubes - Like any other unmodified OSes, Windows can be installed in Qubes as an HVM domain.
    • Tails OS - Tails stands for The Amnesic Incognito Live System. It is a live operating system that aims to preserve your privacy and anonymit.
    • Templates - In Getting Started, we covered the distinction in Qubes OS between where you install your software and where you run your software.
    • Template implementation - Describes template implementation.
    • archlinux-minimal template - This is a community guide, not an official guide.
    • audio-qubes - An audio qube acts as a secure handler for potentially malicious audio devices, preventing them from coming into contact with dom0
    • Debian templates - The Debian template is an officially supported template in Qubes OS.
    • Auto Minimal Debian Template Creation - This page summarizes how to automate debian-minimal based template creation.
    • Fedora templates - The Fedora template is the default template in Qubes OS.
    • NetBSD templates - Createa NetBSD template
    • Linux HVMs - Fixing Linux distro HVMs
    • Minimal templates - The minimal templates are lightweight versions of their standard template counterparts.
    • Multimedia template - Configuring a “Multimedia” TemplateVM
    • Building a TemplateVM for a new OS - If you don’t like using one of the existing templates because of specific administration, package management or other building needs, you can build a TemplateVM for your distribution of choice.

  • VM-Hardening

    • Anonymizing your MAC Address - Although the MAC address is not the only metadata broadcast by network hardware, changing your hardware's default MAC Address could be an important step in protecting privacy.
    • Qcrypt - qcrypt is a multilayer encryption tool for Qubes OS.
    • Qubes-VM-hardening - Leverage Qubes template non-persistence to fend off malware at VM startup: Lock-down, quarantine and check contents of /rw private storage that affect the execution environment.
    • Split dm-crypt - Instead of directly attaching an encrypted LUKS1 partition from a source VM such as sys-usb to a destination VM and decrypting it there.
    • Anti Evil Maid (AEM) - A user who frequently travels with a Qubes laptop holding sensitive data may be at a much higher risk of Evil Maid attacks than a home user with a stationary Qubes desktop.
    • Data leaks - Firewalling in Qubes is not intended to be a leak-prevention mechanism.
    • Device handling security - Any additional ability a VM gains is additional attack surface.
    • Dom0 secure updates - Updating dom0
    • Firewall - Every Qube in Qubes is connected to the network via a FirewallVM, which is used to enforce network-level policies.
    • nft Firewall - This is an example for a TCP redirection, for UDP you would have to replace tcp by udp.
    • Passwordless root access in Qubes - In Qubes VMs there is no point in isolating the root account from the user account.
    • Reducing the fingerprint of the text-based web browser w3m - You can reduce the amount of information w3m gives about itself and the environment it is running in (and, by extension, you).
    • Running Tails in Qubes - Tails stands for The Amnesic Incognito Live System.
    • SaltStack (management software)
    • Signal - It uses end-to-end encryption to secure all communications.
    • Split SSH - Split SSH implements a concept similar to having a smart card with your private SSH keys, except that the role of the “smart card” is played by another Qubes AppVM.
    • U2F proxy - The Qubes U2F Proxy is a secure proxy intended to make use of U2F two-factor authentication devices with web browsers without exposing the browser to the full USB stack, not unlike the USB keyboard and mouse proxies implemented in Qubes.
    • Using Multi-Factor Authentication with Qubes - This page concerns multi-factor authentication for logging into external services, not for logging into Qubes itself.
    • Using OnlyKey with Qubes OS - The following setup instructions walk through the process of configuring dom0 and a USB qube so that OnlyKey will function as a keyboard and be able to communicate with the OnlyKey app (required for TOTP).
    • Qrexec: secure communication across domains - The qrexec framework is used by core Qubes components to implement communication between domains.
    • Qrexec: Qubes RPC internals - The qrexec framework consists of a number of processes communicating with each other using a common IPC protocol, described in detail below.
    • Qrexec: socket-based services - The qrexec allows implementing services not only as executable files, but also as Unix sockets.
    • Qubes memory manager (qmemman) - Provides automatic balancing of memory across participating PV and HVM domains, based on their memory demand
    • YubiKey - Most use cases for the YubiKey can be achieved exactly as described by the manufacturer or other instructions found online.
    • Split SSH - Split SSH implements a concept similar to having a smart card with your private SSH keys, except that the role of the “smart card” is played by another Qubes AppVM.
    • Kicksecure - The following list of actionable items can help to improve security on the Qubes platform, and by extension Kicksecure ™ for Qubes users.
    • Split GPG - Split GPG implements a concept similar to having a smart card with your private GPG keys, except that the role of the “smart card” is played by another Qubes app Qube.
    • TUFF - We can think of a software update system as “secure” if:

  • Qubes OS Websites

  • Downloading, Installing, Upgrading, and Building

  • How-to guides

  • Customization

    • Qubes-GUI-Rust - Rust libraries for the Qubes OS GUI Protocol
    • Suckless dwm - How to install dwm in Qubes OS.
    • QubesOS Autostart Menu - Speed up system boot process with a custom launch script
    • Qubes-Scripts - Collection of custom scripts for Qubes OS.
    • sys-VPN notification setup - Get VPN stats as a desktop notification
    • Wayland agent - This is a GUI agent for Qubes OS that supports the [Wayland] display server protocol. Compared to X11, Wayland is vastly simpler and aims to ensure every frame is perfect.
    • AwesomeWM (window manager) - This is an rpm package for awesomewm with the patches for Qubes.
    • Brightness-Ajustment - Easy brightness adjustment
    • Bash completion - How to install bash completion for Qubes OS commands.
    • Custom icons - Place the custom folder icons ~/.local/share/icons is a persistent place to place the custom folder icons and so is /usr/share/icons.
    • i3 (window manager) - i3 is part of the stable repository (as of Qubes R3.1) and can be installed by using the dom0 update mechanism.
    • KDE (desktop environment) - KDE was the default desktop environment in Qubes
    • PLayback performance - This guide will show you how to install the mpv player and use it with maximum performance.
    • QubesOS Autostart Menu - Speed up system boot process with a custom launch script
    • DPI scaling - Qubes OS passes on dom0’s screen resolution to VMs (this can be seen in the output of xrandr) but doesn’t pass on dom0’s dpi value.

  • Troubleshooting

  • Clearnet & Anonymous Networking

    • OpenVPN

    • Anonymity

      • ipfs - A peer-to-peer hypermedia protocol to make the web faster, safer, and more open.
      • i2p-Whonix - Temporary way to run i2p on Qubes-Whonix.
      • Whonix - Qubes-Whonix ™ is the seamless combination of Qubes OS and Whonix™ for advanced security and anonymity.
      • How to bypass the GFW on Qubes OS when you’re in China - The purpose of this article is to provide several feasible ways to bypass the GFW for you to choose.
      • Really disposable ram based qubes - You can use your QubesOS 𝚜𝚝𝚊𝚝𝚎𝚕𝚎𝚜𝚜 just like TailsOS, with persistent storage for VMs. That is pretty simple! It takes 6Gb of extra 𝚁𝙰𝙼 (for store root filesystem files).
      • Lokinet - Lokinet is the reference implementation of LLARP (low latency anonymous routing protocol), a layer 3 onion routing protocol.

    • Crypto

      • Awesome-DeSci - A curated list of awesome Decentralized Science (DeSci) resources, projects, articles and more.
      • Split Bitcoin Wallet - A "split" bitcoin wallet is a strategy of protecting your bitcoin by having your wallet split into an offline "cold storage" wallet and an online "watching only" wallet.
      • Split Monero Wallet - With Qubes + Whonix you can have a Monero wallet that is without networking and running on a virtually isolated system from the Monero daemon which has all of its traffic forced over Tor.

    • DNS

      • dnscrypt-proxy - Run dnscrypt-proxy inside of sys-net to encrypt and secure dns-requests.

    • Wireguard

      • Mullvad VPN (Fedora38 + WG) - Privacy-first VPN provider's guide for Qubes OS. This guide bears an optimal method for setting up a WG ProxyVM (i.e `sys-vpn`); you may substitute out Mullvad's WG configuration files in place of your own.
      • Wireguard setup - This guide assumes you are using a VPN service that has wireguard support.

  • Kernels

    • Microkernels

      • Qubes-linux-kernel - Qubes package for Linux kernel.
      • OpenXT - OpenXT is an open-source development toolkit for hardware-assisted security research and appliance integration.
      • seL4 - seL4 is a high-assurance, high-performance operating system microkernel.

    • Unikernels

      • Awesome-Unikernels - Secure, lightweight and high performance approach to application delivery.
      • Qubes-Mirage-Firewall - A unikernel that can run as a Qubes OS ProxyVM, replacing sys-firewall.
      • ClickOS - Efficient network function virtualization platform, optimized for Xen and developed by NEC.
      • Mini-OS - Reference kernel distributed with Xen.
      • Mini-OS - Reference kernel distributed with Xen.
      • HaLVM - Port of Glasgow Haskell compiler producing Xen optimized unikernels.

    • Unikernel-like

      • Graphene - Library OS optimized for Intel SGX.
      • Drawbridge - Research prototype platform from Microsoft.
      • Graphene - Library OS optimized for Intel SGX.

  • Exploitation Tools

    • Unikernel-like

      • AFL++ - AFL++ is a superior fork to Google's AFL - more speed, more and better mutations, more and better instrumentation, custom module support, etc.
      • Bonzai - It's like a modular, multicall BusyBox builder for Go with built in completion and embedded documentation support.
      • Joern - Joern is a platform for analyzing source code, bytecode, and binary executables. It generates code property graphs (CPGs), a graph representation of code for cross-language code analysis.
      • Hyperdbg - HyperDbg Debugger is an open-source, community-driven, hypervisor-assisted, user-mode, and kernel-mode Windows debugger with a focus on using modern hardware technologies. It is a debugger designed for analyzing, fuzzing, and reversing.
      • LeechCore - The LeechCore Memory Acquisition Library focuses on Physical Memory Acquisition using various hardware and software based methods.
      • LeechCore-Plugins - This repository contains various plugins for LeechCore - Physical Memory Acquisition Library.
      • Memflow - memflow is a library that enables introspection of various machines (hardware, virtual machines, memory dumps) in a generic fashion.
      • Coredump - Access Microsoft Windows Coredump files.
      • Kvm - KVM memflow connector.
      • Pcileech - Access pcileech interface.
      • Qemu_procfs - Access QEMU Physical memory.
      • MemProcFS - MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.
      • MemProcFS-Plugins - This repository contains various non-core plugins for MemProcFS - The Memory Process File System.
      • Microlibvmi - A cross-platform unified Virtual Machine Introspection API library.
      • Radare2 - Libre Reversing Framework for Unix Geeks.
      • Volatility3 - Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples.
      • Awesome-Fuzzing - A curated list of references to awesome Fuzzing for security testing. Additionally there is a collection of freely available academic papers, tools and so on.
      • CodeQL - Discover vulnerabilities across a codebase with CodeQL.
      • Libvmi - LibVMI is a C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine.
      • Lldb - LLDB is a next generation, high-performance debugger.
      • Capstone - Capstone is a lightweight multi-platform, multi-architecture disassembly framework.
      • Unicorn - Unicorn is a lightweight multi-platform, multi-architecture CPU emulator framework.
      • Qemu_procfs - Access QEMU Physical memory.

  • Optics and Extra Info

  • Qubes OS Server

  • Qubes OS Legends

  • Training and Materials

    • Web articles

  • Adventure Further

  • System Information & Requirements

    • How to make any file persistent (bind-dirs) - With bind-dirs any arbitrary files or folders can be made persistent in app qubes.
    • How to mount a Qubes partition from another OS - When a Qubes OS install is unbootable or booting it is otherwise undesirable, this process allows for the recovery of files stored within the system.
    • Installing contributed packages - This page is for users who wish to install contributed packages.
    • Managing qube kernels - By default, VMs kernels are provided by dom0.
    • Qubes service - Usage documentation is in the qvm-service man page.
    • RPC policies - This document explains the basics of RPC policies in Qubes.
    • Resize disk image - By default Qubes uses thin volumes for the disk images.
    • Standalones and HVMs - A standalone is a type of qube that is created by cloning a template. Unlike templates, however, standalones do not supply their root filesystems to other qubes.
    • Architecture - Qubes implements a security-by-compartmentalization approach.
    • Audio virtualization - VMs on Qubes OS have access to virtualized audio through the PulseAudio module.
    • Certified Hardware - We aim for these vendors to be as diverse as possible in terms of geography, cost, and availability.
    • Community-recommended hardware - Community-recommended computers.
    • Security-critical code - A list of security-critical (i.e., trusted) code components in Qubes OS.
    • Storage pools - Qubes OS implements a security-by-isolation (or security-by-compartmentalization) approach by providing the ability to easily create many security domains.
    • Secondary storage - hese steps assume you have already created a separate volume group and thin pool (not thin volume) for your HDD.
    • Networking - In Qubes, the standard Xen networking is used, based on backend driver in the driver domain and frontend drivers in VMs.
    • Config files - These files are placed in /rw, which survives a VM restart. That way, they can be used to customize a single VM instead of all VMs based on the same template. The scripts here all run as root.
    • Disposable customization - A disposable can be based on any app qube.
    • How to install software in dom0 - How to install a specific package
    • Hardware compatibility list (HCL) - The HCL is a compilation of reports generated and submitted by users across various Qubes versions about their hardware’s compatibility with Qubes.
    • Volume backup and revert - With Qubes, it is possible to revert one of a VM’s storage volumes to a previous state using the automatic snapshot that is normally saved every time a VM is shutdown.
    • System Requirements - User documentation / Choyhe attacker doesn’t have access to all the software running in the other domains.

  • GPU

  • Streamers

    • Web articles

      • Infosecstreams - An actively maintained activity-based-autosorted list of InfoSec Streamers
      • xn0px90 - First Full Time Info-Sec Qubes-OS Streamer!

  • Companies using Qubes OS

    • Web articles

      • Qubes Partners - The Qubes Project relies greatly on the generous support of the organizations, companies, and individuals who have become Qubes Partners.

  • Social media

  • Releases

  • Contributing

Programming Languages
Shell 12 C 10 Rust 7 Python 5 Makefile 3 Scala 1 Go 1 OCaml 1 JavaScript 1
Categories
VM-Hardening 28 Optics and Extra Info 25 Exploitation Tools 23 Templates 23 System Information & Requirements 22 How-to guides 21 Clearnet & Anonymous Networking 16 Customization 15 Qubes OS Legends 12 Kernels 12 Social media 11 Qubes OS Server 8 GPU 8 Training and Materials 8 Troubleshooting 6 Downloading, Installing, Upgrading, and Building 5 Qubes OS Websites 5 License 4 Releases 4 Streamers 2 Contributing 1 Adventure Further 1 Companies using Qubes OS 1 A curated list of Awesome Qubes OS links 1
Sub Categories
Web articles 55 Unikernel-like 39 Xen Exploitation 9 Anonymity 6 Unikernels 6 OpenVPN 4 Microkernels 3 Crypto 3 Wireguard 2 DNS 1
Keywords
qubes 8 security 7 qubes-os 6 awesome-list 5 awesome 5 linux 4 rust 4 introspection 4 virtualization 3 qubesos 3 reverse-engineering 2 c 2 encryption 2 unikernel 2 forensics 2 malware 2 memory 2 virtual-machines 2 physical-memory 2 dma 2 malware-analysis 2 fuzzing 2 ept 2 resources 2 hypervisor 2 fuzz-testing 2 binary-analysis 2 lists 2 url-redirection 1 webextension 1 webextensions 1 protocol 1 ipfs 1 ipfs-protocol 1 paper 1 ipfs-web 1 p2p 1 multiformats 1 js-ipfs 1 ipld 1 instrumentation 1 fuzzer-afl 1 fuzzer 1 afl-gcc 1 afl-fuzzer 1 afl-fuzz 1 afl-compiler 1 afl 1 sgx 1 libraryos 1