From 6d43fccf60ab14674449a61804c3b7c813ac6e79 Mon Sep 17 00:00:00 2001 From: "Manuel Amador (Rudd-O)" Date: Tue, 1 Dec 2020 16:32:44 +0000 Subject: [PATCH 1/8] Fix README formatting. --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 18899af..37b6925 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,8 @@ please see `release-3.2` branch. For Qubes OS release 4.1 support, please see ` ## Why? -Qubes OS is a magnificent operating system, but there are so many use cases that its networking model cannot crack: +Qubes OS is a magnificent operating system, but there are so many use cases that its networking +model cannot crack: * As an automated integration testing system. Qubes OS would be phenomenal for this, and its automation tools would make it From 1e4ed5dda9b1ece8b2d0a182081fb594b2255f36 Mon Sep 17 00:00:00 2001 From: "Manuel Amador (Rudd-O)" Date: Wed, 3 Mar 2021 20:33:36 +0000 Subject: [PATCH 2/8] New version. --- qubes-network-server.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qubes-network-server.spec b/qubes-network-server.spec index ffff138..b8a500a 100644 --- a/qubes-network-server.spec +++ b/qubes-network-server.spec @@ -3,7 +3,7 @@ %define mybuildnumber %{?build_number}%{?!build_number:1} Name: qubes-network-server -Version: 0.0.13 +Version: 0.0.14 Release: %{mybuildnumber}%{?dist} Summary: Turn your Qubes OS into a network server BuildArch: noarch From 754b710dd361e5132502f6371cd094e052945600 Mon Sep 17 00:00:00 2001 From: "Manuel Amador (Rudd-O)" Date: Fri, 5 Mar 2021 02:08:18 +0000 Subject: [PATCH 3/8] Package fix. --- qubes-network-server.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qubes-network-server.spec b/qubes-network-server.spec index b8a500a..4b21707 100644 --- a/qubes-network-server.spec +++ b/qubes-network-server.spec @@ -90,7 +90,7 @@ echo 'enable qubes-routing-manager.service' > "$RPM_BUILD_ROOT"/%{_presetdir}/75 %doc README.md TODO %files -n qubes-core-admin-addon-network-server -%attr(0644, root, root) %{python3_sitelib}/qubesnetworkserver +%attr(0644, root, root) %{python3_sitelib}/qubesnetworkserver/* %{python3_sitelib}/qubesnetworkserver-*.egg-info %post From 6b8520f0766c42ecbd345cfb0a6cee2929c35440 Mon Sep 17 00:00:00 2001 From: "Manuel Amador (Rudd-O)" Date: Fri, 5 Mar 2021 02:08:24 +0000 Subject: [PATCH 4/8] Tag 0.0.15. --- qubes-network-server.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qubes-network-server.spec b/qubes-network-server.spec index 4b21707..8e9c374 100644 --- a/qubes-network-server.spec +++ b/qubes-network-server.spec @@ -3,7 +3,7 @@ %define mybuildnumber %{?build_number}%{?!build_number:1} Name: qubes-network-server -Version: 0.0.14 +Version: 0.0.15 Release: %{mybuildnumber}%{?dist} Summary: Turn your Qubes OS into a network server BuildArch: noarch From 498c3c410567d00f1e37409c5d028cc5523e9a0f Mon Sep 17 00:00:00 2001 From: "Manuel Amador (Rudd-O)" Date: Mon, 29 Mar 2021 17:04:53 +0000 Subject: [PATCH 5/8] Tag 0.0.16. --- qubes-network-server.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qubes-network-server.spec b/qubes-network-server.spec index 8e9c374..266842a 100644 --- a/qubes-network-server.spec +++ b/qubes-network-server.spec @@ -3,7 +3,7 @@ %define mybuildnumber %{?build_number}%{?!build_number:1} Name: qubes-network-server -Version: 0.0.15 +Version: 0.0.16 Release: %{mybuildnumber}%{?dist} Summary: Turn your Qubes OS into a network server BuildArch: noarch From 4b6100efce8143a96b2d17612158ac1f11ced1ee Mon Sep 17 00:00:00 2001 From: "Manuel Amador (Rudd-O)" Date: Tue, 30 Mar 2021 01:54:55 +0000 Subject: [PATCH 6/8] Add build.parameters. --- build.parameters | 1 + 1 file changed, 1 insertion(+) create mode 100644 build.parameters diff --git a/build.parameters b/build.parameters new file mode 100644 index 0000000..816f688 --- /dev/null +++ b/build.parameters @@ -0,0 +1 @@ +["RELEASE": "25 32 33"] From aa664192d6fa504527c9c117891a68c5233d197f Mon Sep 17 00:00:00 2001 From: "Manuel Amador (Rudd-O)" Date: Tue, 18 May 2021 13:10:25 +0000 Subject: [PATCH 7/8] Build.parameters updated. --- build.parameters | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.parameters b/build.parameters index 816f688..b6a422e 100644 --- a/build.parameters +++ b/build.parameters @@ -1 +1 @@ -["RELEASE": "25 32 33"] +["RELEASE": "25 34"] From b20170144259b022851cebda058b5fd88ea4b469 Mon Sep 17 00:00:00 2001 From: "Manuel Amador (Rudd-O)" Date: Wed, 16 Jun 2021 10:43:17 +0000 Subject: [PATCH 8/8] Documentation buffups. --- README.md | 36 ++++++++++++++++++----------- doc/Setting up your first server.md | 7 +++--- 2 files changed, 26 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index 37b6925..7316a27 100644 --- a/README.md +++ b/README.md @@ -10,13 +10,9 @@ please see `release-3.2` branch. For Qubes OS release 4.1 support, please see ` ## Why? -Qubes OS is a magnificent operating system, but there are so many use cases that its networking -model cannot crack: +Qubes OS is a magnificent operating system. That said, there are many use cases its networking +model does not work well for: -* As an automated integration testing system. Qubes OS would be - phenomenal for this, and its automation tools would make it - extremely easy to bring up and tear down entire environments. - If only those environments could network with each other securely! * Remote management of Qubes OS instances. Vanilla Qubes OS cannot easily be managed remotely. A better networking model would allow for orchestration tools — such as @@ -25,8 +21,12 @@ model cannot crack: within each VM. * Anything that involves a secure server, serving data to people or machines, simply cannot be done under vanilla Qubes OS. +* As an automated integration testing system. Qubes OS would be + phenomenal for this, and its automation tools would make it + extremely easy to bring up and tear down entire environments. + If only those environments could network with each other securely! -## Enhanced networking model +### The traditional Qubes networking model The traditional Qubes OS networking model contemplates a client-only use case. User VMs (AppVMs or StandaloneVMs) are attached to ProxyVMs, @@ -44,7 +44,9 @@ for multiple VMs, which need to carefully override the existing firewall rules, and require careful thought not to open the system to unexpected attack vectors. The Qubes OS user interface provides no help either. -Qubes network server changes all that. +### The Qubes network server networking model + +Qubes network server builds on that. ![Qubes network server model](./doc/Qubes network server model.png) @@ -66,12 +68,18 @@ to machines on the same network as the NetVM. ## How to use this software -Once installed (see below), usage of the software is straightforward. +Once installed (**see below for installation instructions**), usage of +the software is straightforward. -These sample instructions assume you already have an AppVM VM set up, -named `testvm`, and that your `sys-net` VM is attached to a network with -subnet `192.168.16.0/24`. +These sample instructions assume: +* you understand the distinction between dom0 and qubes +* you already have an AppVM VM set up, named `testvm`, +* your `sys-net` VM is attached to a network with subnet `192.168.16.0/24` + — this, of course, may vary depending on your local router configuration. + +*Do not proceed any further if you do not yet meet these requirements.* + First, attach the VM you want to expose to the network to a NetVM that has an active network connection: @@ -101,9 +109,9 @@ Here are documents that will help you take advantage of Qubes network server: * [Setting up your first server](doc/Setting up your first server.md) * [Setting up an SSH server](doc/Setting up an SSH server.md) -## Installation +## Installation of packages -Installation consists of two steps: +Package installation consists of two steps (**the package creation instructions are below**): 1. Deploy the `qubes-core-admin-addon-network-server` RPM to your `dom0`. 2. Deploy the `qubes-network-server` RPM to the TemplateVM backing your diff --git a/doc/Setting up your first server.md b/doc/Setting up your first server.md index 4b8dd26..bd1f7e9 100644 --- a/doc/Setting up your first server.md +++ b/doc/Setting up your first server.md @@ -5,13 +5,14 @@ is meant to be a standalone VM that contains files, being served by a running HTTP server (port 80) within it. This VM is attached to a NetVM `sys-net`, with IP address `192.168.1.4` on a local network `192.168.1.0/24`. Our goal will be to make `httpserver` accessible -to your laptop on the same physical network, which we'll assume has -IP address `192.168.1.8`. +to your client laptop on the same physical network, which we'll +assume has IP address `192.168.1.8`. ##Assign a static address First step is to assign an address — let's make it `192.168.1.6` — -to `httpserver`: +to `httpserver` (of course, you should make sure that this IP +address isn't used by any other equipment in your network): ``` qvm-prefs -s httpserver ip 192.168.1.6