mirror of
https://github.com/privacyguides/i18n.git
synced 2025-06-18 16:54:21 +00:00
New Crowdin translations by GitHub Action
This commit is contained in:
Crowdin Bot
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ Tails está diseñado para formatearse por completo después de cada reinicio. [
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** es un sistema operativo de código abierto diseñado para proporcionar una fuerte seguridad para la informática de escritorio a través de máquinas virtuales seguras (también conocido como "Qubes"). Qubes se basa en Xen, el Sistema de Ventanas X y Linux, y puede ejecutar la mayoría de las aplicaciones Linux y utilizar la mayoría de los controladores de Linux.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Página Principal](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Servicio Onion" }
|
||||
@ -161,7 +161,7 @@ Tails está diseñado para formatearse por completo después de cada reinicio. [
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Código Fuente" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribuir }
|
||||
|
||||
Qubes OS asegura el ordenador aislando subsistemas (por ejemplo, redes, USB, etc.) y aplicaciones en máquinas virtuales separadas. Si una parte del sistema se ve comprometida, es probable que el aislamiento adicional proteja al resto del sistema.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
Para más información sobre el funcionamiento de Qubes, consulte nuestra página [Qubes OS overview](os/qubes-overview.md).
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Visión General de Qubes"
|
||||
icon: simple/qubesos
|
||||
description: Qubes es un sistema operativo basado en el aislamiento de aplicaciones dentro de máquinas virtuales para una mayor seguridad.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Cada VM se denomina *Qube* y puedes asignar a cada Qube un nivel de confianza en función de su finalidad. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## ¿Cómo funciona Qubes OS?
|
||||
|
||||
Qubes utiliza la [compartimentación](https://www.qubes-os.org/intro/) para mantener el sistema seguro. Qubes son creados de plantillas, las predeterminadas siendo para Fedora, Debian y [Whonix](../desktop.md#whonix). Qubes OS también te permite crear máquinas virtuales de un solo uso [desechables](https://www.qubes-os.org/doc/how-to-use-disposables/).
|
||||
Qubes utiliza la [compartimentación](https://www.qubes-os.org/intro/) para mantener el sistema seguro. Qubes son creados de plantillas, las predeterminadas siendo para Fedora, Debian y [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Arquitectura, Crédito: Qué es Qubes OS Introducción</figcaption>
|
||||
|
||||
Cada aplicación Qubes tiene un [borde de color](https://www.qubes-os.org/screenshots/) que puede ayudarte a seguir la pista de la máquina virtual en la que se está ejecutando. Podrías, por ejemplo, usar un color específico para tu navegador bancario, mientras usas un color diferente para un navegador general no confiado.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. Podrías, por ejemplo, usar un color específico para tu navegador bancario, mientras usas un color diferente para un navegador general no confiado.
|
||||
|
||||
|
||||
<figcaption>Bordes de ventana de Qubes, Crédito: Capturas de pantalla de Qubes</figcaption>
|
||||
|
||||
## ¿Por qué utilizar Qubes?
|
||||
|
||||
Qubes OS es útil si tu [modelo de amenazas](../basics/threat-modeling.md) requiere una fuerte compartimentación y seguridad, como por ejemplo si crees que vas a abrir archivos no confiables de fuentes no confiables. Una razón típica para utilizar Qubes OS es abrir documentos de fuentes desconocidas.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utiliza [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (es decir, un "AdminVM") para controlar otras VMs invitadas o Qubes en el SO anfitrión. Otras máquinas virtuales muestran ventanas de aplicaciones individuales dentro del entorno de escritorio de Dom0. Permite codificar por colores las ventanas en función de los niveles de confianza y ejecutar aplicaciones que pueden interactuar entre sí con un control muy granular.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copiar y pegar texto
|
||||
|
||||
Puedes [copiar y pegar texto](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) utilizando `qvm-copy-to-vm` o las instrucciones siguientes:
|
||||
|
||||
1. Pulsa **Ctrl+C** para decirle a la máquina virtual en la que estás que quieres copiar algo.
|
||||
2. Pulsa **Ctrl+Shift+C** para indicar a la VM que ponga este búfer a disposición del portapapeles global.
|
||||
3. Pulsa **Ctrl+Shift+V** en la máquina virtual de destino para que el portapapeles global esté disponible.
|
||||
4. Pulsa **Ctrl+V** en la máquina virtual de destino para pegar el contenido en el búfer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### Intercambio de archivos
|
||||
|
||||
Para copiar y pegar archivos y directorios (carpetas) de una VM a otra, puedes utilizar la opción **Copiar a otra AppVM...** o **Mover a otra AppVM...**. La diferencia es que la opción **Mover** borrará el archivo original. Cualquiera de las dos opciones protegerá tu portapapeles de ser filtrado a cualquier otro Qubes. Esto es más seguro que la transferencia de archivos con air-gap, porque un ordenador con air-gap seguirá viéndose obligado a analizar particiones o sistemas de archivos. Esto no es necesario con el sistema de copia inter-qube.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. La diferencia es que la opción **Mover** borrará el archivo original. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Esto no es necesario con el sistema de copia inter-qube.
|
||||
|
||||
??? info "AppVMs o qubes no tienen sus propios sistemas de archivos"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
Puedes [copiar y mover archivos](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) entre Qubes. Al hacerlo, los cambios no son inmediatos y pueden deshacerse fácilmente en caso de accidente.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Al hacerlo, los cambios no son inmediatos y pueden deshacerse fácilmente en caso de accidente. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Interacciones inter-VM
|
||||
|
||||
El framework [qrexec](https://www.qubes-os.org/doc/qrexec/) es una parte central de Qubes que permite la comunicación de máquinas virtuales entre dominios. Está construido sobre la librería Xen *vchan*, que facilita el [aislamiento a través de políticas](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. Está construido sobre la librería Xen *vchan*, que facilita el [aislamiento a través de políticas](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Recursos Adicionales
|
||||
|
||||
Para obtener información adicional, te animamos a consultar las extensas páginas de documentación de Qubes OS que se encuentran en el [sitio web Qubes OS](https://www.qubes-os.org/doc/). Copias offline se pueden descargar desde el [repositorio de documentación ](https://github.com/QubesOS/qubes-doc)de Qubes OS.
|
||||
|
||||
- Fondo Tecnológico Abierto: [*Posiblemente el sistema operativo más seguro del mundo*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Compartimentación del software frente a separación física*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Particionando mi vida digital en dominios de seguridad*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Artículos Relacionados*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -149,9 +149,9 @@ Par conception, Tails est censé se réinitialiser complètement après chaque r
|
||||
|
||||
!!! recommendation
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** est un système d'exploitation open-source conçu pour fournir une sécurité forte pour l'informatique de bureau à travers des machines virtuelles sécurisées (aussi connus sous le nom de "Qubes"). Qubes est basé sur Xen, le système X Window et Linux, et peut exécuter la plupart des applications Linux et utiliser la plupart des pilotes Linux.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Page d'accueil](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Service onion" }
|
||||
@ -160,7 +160,7 @@ Par conception, Tails est censé se réinitialiser complètement après chaque r
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Code source" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribuer }
|
||||
|
||||
Qubes OS sécurise l'ordinateur en isolant les sous-systèmes (par exemple, réseau, USB, etc.) et les applications dans des VMs distinctes. Si une partie du système est compromise, l'isolation supplémentaire est susceptible de protéger le reste du système.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
Pour plus d'informations sur le fonctionnement de Qubes, lisez notre page [Introduction à Qubes](os/qubes-overview.md) .
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Introduction à Qubes"
|
||||
icon: simple/qubesos
|
||||
description: Qubes est un système d'exploitation conçu pour isoler les applications au sein de machines virtuelles afin de renforcer la sécurité.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) est un système d'exploitation open-source qui utilise l'hyperviseur [Xen](https://en.wikipedia.org/wiki/Xen) pour fournir une sécurité forte pour l'informatique de bureau par le biais de machines virtuelles isolées. Chaque VM est appelée un *Qube* et vous pouvez attribuer à chaque Qube un niveau de confiance en fonction de son objectif. Étant donné que Qubes OS assure la sécurité en utilisant l'isolation et en n'autorisant des actions qu'au cas par cas, il est à l'opposé de [l'énumération de méchanceté](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## Comment fonctionne Qubes OS ?
|
||||
|
||||
Qubes utilise la [compartimentation](https://www.qubes-os.org/intro/) pour assurer la sécurité du système. Les Qubes sont créés à partir de modèles, les valeurs par défaut étant pour Fedora, Debian et [Whonix](../desktop.md#whonix). Qubes OS vous permet également de créer des machines virtuelles à usage unique [jetable](https://www.qubes-os.org/doc/how-to-use-disposables/) .
|
||||
Qubes utilise la [compartimentation](https://www.qubes-os.org/intro/) pour assurer la sécurité du système. Les Qubes sont créés à partir de modèles, les valeurs par défaut étant pour Fedora, Debian et [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Architecture de Qubes, Crédit : Intro de Qu'est-ce que Qubes OS</figcaption>
|
||||
|
||||
Chaque application Qubes possède une [bordure colorée](https://www.qubes-os.org/screenshots/) qui peut vous aider à garder une trace de la machine virtuelle dans laquelle elle est exécutée. Vous pouvez, par exemple, utiliser une couleur spécifique pour votre navigateur bancaire, tout en utilisant une couleur différente pour un navigateur général non fiable.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. Vous pouvez, par exemple, utiliser une couleur spécifique pour votre navigateur bancaire, tout en utilisant une couleur différente pour un navigateur général non fiable.
|
||||
|
||||
|
||||
<figcaption>Bordures de fenêtres de Qubes, Crédit : Captures d'écran Qubes</figcaption>
|
||||
|
||||
## Pourquoi devrais-je utiliser Qubes ?
|
||||
|
||||
Qubes OS est utile si votre [modèle de menace](../basics/threat-modeling.md) exige une compartimentation et une sécurité fortes, par exemple si vous pensez ouvrir des fichiers non fiables provenant de sources non fiables. Une raison typique d'utiliser Qubes OS est d'ouvrir des documents provenant de sources inconnues.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilise la VM Xen [Dom0](https://wiki.xenproject.org/wiki/Dom0) (c'est-à-dire une "AdminVM") pour contrôler d'autres VM invitées ou Qubes sur l'OS hôte. Les autres VMs affichent des fenêtres d'applications individuelles dans l'environnement de bureau de Dom0. Cela vous permet d'attribuer un code de couleur aux fenêtres en fonction des niveaux de confiance et d'exécuter des applications qui peuvent interagir les unes avec les autres avec un contrôle très granulaire.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copier et coller du texte
|
||||
|
||||
Vous pouvez [copier et coller du texte](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) en utilisant `qvm-copy-to-vm` ou les instructions ci-dessous :
|
||||
|
||||
1. Appuyez sur **Ctrl+C** pour indiquer à la VM dans laquelle vous vous trouvez que vous souhaitez copier quelque chose.
|
||||
2. Appuyez sur **Ctrl+Maj+C** pour dire à la VM de rendre ce tampon disponible au presse-papiers global.
|
||||
3. Appuyez sur **Ctrl+Shift+V** dans la VM de destination pour rendre le presse-papiers global disponible.
|
||||
4. Appuyez sur **Ctrl+V** dans la VM de destination pour coller le contenu dans le tampon.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### Échange de fichiers
|
||||
|
||||
Pour copier et coller des fichiers et des répertoires (dossiers) d'une VM à l'autre, vous pouvez utiliser l'option **Copier vers une autre AppVM...** ou **Déplacer vers une autre AppVM...**. La différence est que l'option **Déplacer** supprime le fichier d'origine. L'une ou l'autre de ces options protégera votre presse-papiers contre les fuites vers d'autres Qubes. C'est plus sûr que le transfert de fichiers par ordinateur non connectés car un ordinateur sera toujours obligé d'analyser les partitions ou les systèmes de fichiers. Cela n'est pas nécessaire avec le système de copie inter-qube.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. La différence est que l'option **Déplacer** supprime le fichier d'origine. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Cela n'est pas nécessaire avec le système de copie inter-qube.
|
||||
|
||||
??? info "Les AppVMs ou les qubes n'ont pas leur propre système de fichiers"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
Vous pouvez [copier et déplacer des fichiers](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) entre les Qubes. Ce faisant, les changements ne sont pas immédiats et peuvent être facilement annulés en cas d'accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Ce faisant, les changements ne sont pas immédiats et peuvent être facilement annulés en cas d'accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Interactions inter-VM
|
||||
|
||||
L'[environnement qrexec](https://www.qubes-os.org/doc/qrexec/) est une partie essentielle de Qubes qui permet la communication des machines virtuelles entre les domaines. Il est construit sur la bibliothèque Xen *vchan*, qui facilite [l'isolation de par le biais de politiques](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. Il est construit sur la bibliothèque Xen *vchan*, qui facilite [l'isolation de par le biais de politiques](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Ressources supplémentaires
|
||||
|
||||
Pour de plus amples informations, nous vous encourageons à consulter les pages de documentation complètes de Qubes OS, situées sur le [site web de Qubes OS](https://www.qubes-os.org/doc/). Des copies hors ligne peuvent être téléchargées à partir du [dépôt de documentationde](https://github.com/QubesOS/qubes-doc) Qubes OS.
|
||||
|
||||
- Open Technology Fund : [*Sans doute le système d'exploitation le plus sûr au monde*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska : [*Compartimentage logiciel vs. séparation physique*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska : [*Partitionnement de ma vie numérique en domaines de sécurité*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS : [*Articles connexes*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ Tailsכולל[uBlock Origin](desktop-browsers.md#ublock-origin) בדפדפן Tor
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes מבוססת על Xen, מערכת החלונות X ולינוקס, ויכולה להריץ את רוב יישומי לינוקס ולהשתמש ברוב מנהלי ההתקן של לינוקס.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ Tailsכולל[uBlock Origin](desktop-browsers.md#ublock-origin) בדפדפן Tor
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "סקירה כללית של Qubes"
|
||||
icon: simple/qubesos
|
||||
description: Qubes היא מערכת הפעלה הבנויה סביב בידוד אפליקציות בתוך מכונות וירטואליות לאבטחה מוגברת.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. כל VM נקרא *Qube* ואתה יכול להקצות לכל Qube רמת אמון על סמך מטרתו. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## איך עובדת מערכת ההפעלה של Qubes?
|
||||
|
||||
Qubes משתמשת ב[מידור](https://www.qubes-os.org/intro/) כדי לשמור על אבטחת המערכת. Qubes נוצרים מתבניות, ברירת המחדל היא עבור Fedora, Debian ו-[Whonix](../desktop.md#whonix). מערכת ההפעלה Qubes מאפשרת לך גם ליצור מכונות וירטואליות לשימוש [חד פעמי](https://www.qubes-os.org/doc/how-to-use-disposables/).
|
||||
Qubes משתמשת ב[מידור](https://www.qubes-os.org/intro/) כדי לשמור על אבטחת המערכת. Qubes נוצרים מתבניות, ברירת המחדל היא עבור Fedora, Debian ו-[Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>ארכיטקטורת Qubes, קרדיט: מהי הקדמה למערכת ההפעלה של Qubes</figcaption>
|
||||
|
||||
לכל אפליקציה של Qubes יש [גבול צבעוני](https://www.qubes-os.org/screenshots/) שיכול לעזור לך לעקוב אחר המכונה הוירטואלית שבה היא פועלת. אתה יכול, למשל, להשתמש בצבע ספציפי עבור הדפדפן הבנקאי שלך, תוך שימוש בצבע אחר עבור דפדפן כללי שאינו מהימן.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. אתה יכול, למשל, להשתמש בצבע ספציפי עבור הדפדפן הבנקאי שלך, תוך שימוש בצבע אחר עבור דפדפן כללי שאינו מהימן.
|
||||
|
||||
|
||||
<figcaption>גבולות החלונות של Qubes, קרדיט: צילומי מסך של Qubes</figcaption>
|
||||
|
||||
## מדוע עלי להשתמש ב-Qubes?
|
||||
|
||||
מערכת ההפעלה של Qubes שימושית אם [מודל האיום](../basics/threat-modeling.md) שלך דורש מידור ואבטחה חזקות, כגון אם אתה חושב שתפתח קבצים לא מהימנים ממקורות לא מהימנים. סיבה טיפוסית לשימוש ב-Qubes OS היא פתיחת מסמכים ממקורות לא ידועים.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
מערכת ההפעלה Qubes משתמשת ב-[Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (כלומר, "AdminVM") לשליטה ב-VM אורחים או Qubes אחרים במערכת ההפעלה המארח. VMs אחרים מציגים חלונות יישומים בודדים בתוך סביבת שולחן העבודה של Dom0. זה מאפשר לך לצבוע חלונות על סמך רמות אמון ולהפעיל יישומים שיכולים לקיים אינטראקציה זה עם זה עם שליטה פרטנית מאוד.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### העתקה והדבקה של טקסט
|
||||
|
||||
אתה יכול [להעתיק ולהדביק טקסט](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) באמצעות `qvm-copy -to-vm` או ההוראות שלהלן:
|
||||
|
||||
1. הקש על **Ctrl+C** כדי לומר ל-VM שאתה נמצא בו שאתה רוצה להעתיק משהו.
|
||||
2. הקש על **Ctrl+Shift+C** כדי לומר ל-VM להפוך את המאגר הזה לזמין ללוח הגלובלי.
|
||||
3. הקש על **Ctrl+Shift+V** ב-VM היעד כדי להפוך את הלוח הגלובלי לזמין.
|
||||
4. הקש על **Ctrl+V** ב-VM היעד כדי להדביק את התוכן במאגר.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### החלפת קבצים
|
||||
|
||||
כדי להעתיק ולהדביק קבצים וספריות (תיקיות) מ-VM אחד לאחר, אתה יכול להשתמש באפשרות **העתק ל-AppVM אחר...** או **עבור ל-AppVM אחר...**. ההבדל הוא שהאפשרות ה**העבר** תמחק את הקובץ המקורי. כל אחת מהאפשרויות תגן על הלוח שלך מפני דליפה לכל Qubes אחר. זה מאובטח יותר מהעברת קבצים עם רווח אוויר מכיוון שמחשב עם רווח אוויר עדיין ייאלץ לנתח מחיצות או מערכות קבצים. זה לא נדרש עם מערכת ההעתקה inter-qube.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. ההבדל הוא שהאפשרות ה**העבר** תמחק את הקובץ המקורי. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. זה לא נדרש עם מערכת ההעתקה inter-qube.
|
||||
|
||||
??? info "ל-AppVMs או qubes אין מערכות קבצים משלהם"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
אתה יכול [להעתיק ולהעביר קבצים](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) בין Qubes. כאשר עושים זאת השינויים לא מתבצעים באופן מיידי וניתן לבטל אותם בקלות במקרה של תאונה.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. כאשר עושים זאת השינויים לא מתבצעים באופן מיידי וניתן לבטל אותם בקלות במקרה של תאונה. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### אינטראקציות בין-VM
|
||||
|
||||
[מסגרת qrexec](https://www.qubes-os.org/doc/qrexec/) היא חלק מרכזי ב-Qubes המאפשר תקשורת מכונה וירטואלית בין דומיינים. הוא בנוי על גבי ספריית Xen *vchan*, המאפשרת [בידוד באמצעות מדיניות](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. הוא בנוי על גבי ספריית Xen *vchan*, המאפשרת [בידוד באמצעות מדיניות](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## מקורות נוספים
|
||||
|
||||
למידע נוסף, אנו ממליצים לך לעיין בדפי התיעוד הנרחבים של Qubes OS הממוקמים ב[אתר האינטרנט של Qubes OS](https://www.qubes-os.org/doc/). ניתן להוריד עותקים לא מקוונים מ[מאגר התיעוד](https://github.com/QubesOS/qubes-doc) של Qubes OS.
|
||||
|
||||
- Open Technology Fund: [*ללא ספק מערכת ההפעלה המאובטחת בעולם*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*מידור תוכנה לעומת הפרדה פיזית*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*חלוקת החיים הדיגיטליים שלי לתחומי אבטחה*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*מאמרים קשורים*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes a Xen-en, az X Window System-en és a Linuxon alapul, képes a legtöbb Linux alkalmazás futtatására és a legtöbb Linux illesztőprogram használatára.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: pg/qubes-os
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Android
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Ikhtisar Qubes"
|
||||
icon: simple/qubesos
|
||||
description: Qubes adalah sistem operasi yang dibangun dengan mengisolasi aplikasi di dalam mesin virtual untuk meningkatkan keamanan.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) adalah sistem operasi sumber terbuka yang menggunakan hypervisor [Xen](https://en.wikipedia.org/wiki/Xen) untuk memberikan keamanan yang kuat untuk komputasi desktop melalui mesin virtual yang terisolasi. Setiap VM disebut *Qube* dan Anda dapat menetapkan tingkat kepercayaan untuk setiap Qube berdasarkan tujuannya. Karena Qubes OS menyediakan keamanan dengan menggunakan isolasi, dan hanya mengizinkan tindakan berdasarkan basis per kasus, ini merupakan kebalikan dari [enumerasi kejahatan](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## Bagaimana cara kerja Qubes OS?
|
||||
|
||||
Qubes menggunakan kompartementalisasi [](https://www.qubes-os.org/intro/) untuk menjaga sistem tetap aman. Qubes dibuat dari beberapa template, umumnya untuk Fedora, Debian dan [Whonix](../desktop.md#whonix). Qubes OS juga memungkinkan Anda untuk membuat mesin virtual [sekali pakai](https://www.qubes-os.org/doc/how-to-use-disposables/).
|
||||
Qubes menggunakan kompartementalisasi [](https://www.qubes-os.org/intro/) untuk menjaga sistem tetap aman. Qubes dibuat dari beberapa template, umumnya untuk Fedora, Debian dan [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Arsitektur Qubes, Kredit: Apa itu Qubes OS Intro</figcaption>
|
||||
|
||||
Setiap aplikasi Qubes memiliki [batas berwarna](https://www.qubes-os.org/screenshots/) yang dapat membantu Anda melacak mesin virtual yang sedang berjalan. Anda dapat menggunakan warna tertentu di peramban khusus untuk perbankan, sementara menggunakan warna yang berbeda untuk peramban umum yang tidak terpercaya.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. Anda dapat menggunakan warna tertentu di peramban khusus untuk perbankan, sementara menggunakan warna yang berbeda untuk peramban umum yang tidak terpercaya.
|
||||
|
||||
|
||||
<figcaption>Batas jendela Qubes, Kredit: Tangkapan Layar Qubes</figcaption>
|
||||
|
||||
## Mengapa saya harus menggunakan Qubes?
|
||||
|
||||
Qubes OS berguna jika [ancaman model](../basics/threat-modeling.md) Anda membutuhkan kompartementalisasi dan keamanan yang kuat, misalnya jika Anda merasa akan membuka file yang tidak terpercaya dari sumber yang tidak terpercaya. Alasan umum untuk menggunakan Qubes OS adalah untuk membuka dokumen dari sumber yang tidak dikenal.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS menggunakan [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (yaitu, "AdminVM") untuk mengendalikan VM tamu atau Qubes lain pada OS host. VM lain menampilkan jendela aplikasi individual dalam lingkungan desktop Dom0. Ini memungkinkan Anda untuk memberi kode warna pada jendela berdasarkan tingkat kepercayaan dan menjalankan aplikasi yang dapat berinteraksi satu sama lain dengan kontrol yang sangat terperinci.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Menyalin dan Menempel Teks
|
||||
|
||||
Anda dapat [menyalin dan menempelkan teks](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) menggunakan `qvm-copy-to-vm` atau dengan petunjuk di bawah ini:
|
||||
|
||||
1. Tekan **Ctrl+C** untuk memberi tahu VM yang sedang Anda gunakan bahwa Anda ingin menyalin sesuatu.
|
||||
2. Tekan **Ctrl+Shift+C** untuk memberi tahu VM agar buffer ini tersedia di clipboard global.
|
||||
3. Tekan **Ctrl+Shift+V** di VM dengan tujuan untuk membuat papan klip global tersedia.
|
||||
4. Tekan **Ctrl+V** di VM tujuan untuk menempelkan konten di buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### Pertukaran File
|
||||
|
||||
Untuk menyalin dan menempelkan file dan direktori (folder) dari satu VM ke VM lainnya, Anda dapat menggunakan opsi **Copy to Other AppVM...** atau **Move to Other AppVM...**. Perbedaannya adalah bahwa opsi **Pindahkan** akan menghapus file asli. Opsi mana pun akan melindungi papan klip Anda agar tidak bocor ke Qubes lainnya. Ini lebih aman daripada transfer file melalui celah udara karena komputer yang memiliki celah udara masih akan dipaksa untuk mengurai partisi atau sistem file. Hal itu tidak diperlukan dengan sistem penyalinan antar-qube.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. Perbedaannya adalah bahwa opsi **Pindahkan** akan menghapus file asli. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Hal itu tidak diperlukan dengan sistem penyalinan antar-qube.
|
||||
|
||||
??? info "AppVM atau qubes tidak memiliki sistem file sendiri"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
Anda dapat [menyalin dan memindahkan file](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) di antara Qubes. Ketika melakukan hal tersebut, perubahan tidak langsung dilakukan dan dapat dengan mudah dibatalkan jika terjadi kecelakaan.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Ketika melakukan hal tersebut, perubahan tidak langsung dilakukan dan dapat dengan mudah dibatalkan jika terjadi kecelakaan. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Interaksi Antar-VM
|
||||
|
||||
Kerangka kerja qrexec [](https://www.qubes-os.org/doc/qrexec/) adalah bagian inti dari Qubes yang memungkinkan komunikasi mesin virtual antar domain. Ini dibangun di atas pustaka Xen *vchan*, yang memfasilitasi [isolasi melalui kebijakan](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. Ini dibangun di atas pustaka Xen *vchan*, yang memfasilitasi [isolasi melalui kebijakan](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Sumber Daya Tambahan
|
||||
|
||||
Untuk informasi tambahan, kami menganjurkan Anda untuk membaca halaman dokumentasi Qubes OS yang luas yang terletak di [Situs Web Qubes OS](https://www.qubes-os.org/doc/). Salinan offline dapat diunduh dari [repositori dokumentasi](https://github.com/QubesOS/qubes-doc) Qubes OS.
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Kompartementalisasi perangkat lunak vs pemisahan fisik*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Memisahkan kehidupan digital saya ke dalam domain keamanan*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Artikel Terkait*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -150,9 +150,9 @@ Di design, Tails dovrebbe ripristinarsi completamente dopo ogni riavvio. L'[arch
|
||||
|
||||
!!! recommendation
|
||||
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** è un sistema operativo open source progettato per fornire un forte sicurezza per l'informatica desktop, tramite macchine virtuali sicure (anche note come "Qube"). Si basa su Xen, il Sistema X Window, e su Linux, e può eseguire gran parte delle applicazioni di Linux, e utilizzare molti dei suoi driver.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Home](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Servizio Onion" }
|
||||
@ -161,7 +161,7 @@ Di design, Tails dovrebbe ripristinarsi completamente dopo ogni riavvio. L'[arch
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Codice Sorgente" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribuisci }
|
||||
|
||||
Qubes OS protegge il computer isolando i sistemi secondri (es., rete, USB, etc.) e le applicazioni, in VM separate. Dovesse esser compromessa una parte del sistema, l'isolamento aggiuntivo potrebbe proteggere il resto del sistema.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
Per ulteriori informazioni sul funzionamento di Qubes, leggi la nostra pagina [Panoramica su Qubes OS](os/qubes-overview.md).
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Panoramica di Qubes"
|
||||
icon: simple/qubesos
|
||||
description: Qubes è un sistema operativo basato sull'isolamento delle app su macchine virtuali, per una maggiore sicurezza.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) è un sistema operativo open source che utiilzza l'ipervisore [Xen](https://en.wikipedia.org/wiki/Xen) per fornire una forte sicurezza per l'informatica desktop, tramite macchine virtuali isolate. Ogni macchina virtuale è chiamata *Qube* e, a ognuna di esse, puoi assegnare un livello di fiducia, basato sul suo scopo. Poiché Qubes OS fornisce sicurezza tramite l'isolamento, e permette le azioni soltanto a seconda del caso, è l'opposto dell'[enumerazione delle minacce](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## Come funziona Qubes OS?
|
||||
|
||||
Qubes utilizza la [compartimentazione](https://www.qubes-os.org/intro/) per mantenere il sistema sicuro. I Qube sono creati da modelli, predefiniti per Fedora, Debian e [Whonix](../desktop.md#whonix). Inoltre, Qubes OS ti consente di creare mcchine virtuali [monouso](https://www.qubes-os.org/doc/how-to-use-disposables/) e a uso singolo.
|
||||
Qubes utilizza la [compartimentazione](https://www.qubes-os.org/intro/) per mantenere il sistema sicuro. I Qube sono creati da modelli, predefiniti per Fedora, Debian e [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Architettura di Qubes, Crediti: Introduzione a Qubes OS</figcaption>
|
||||
|
||||
Ogni applicazione di Qubes ha un [bordo colorato](https://www.qubes-os.org/screenshots/), che può aiutarti a tenere traccia della macchina virtuale in esecuzione. Ad esempio, potresti utilizzare un colore specifico per le operazioni bancarie, utilizzandone uno differente per un browser generico non affidabile.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. Ad esempio, potresti utilizzare un colore specifico per le operazioni bancarie, utilizzandone uno differente per un browser generico non affidabile.
|
||||
|
||||
|
||||
<figcaption>Bordi delle finestre di Qubes, Crediti: Screenshot di Qubes</figcaption>
|
||||
|
||||
## Perché dovrei usare Qubes?
|
||||
|
||||
Qubes OS è utile se il tuo [modello di minaccia](../basics/threat-modeling.md) richiede un forte compartimentazione e sicurezza, ad esempio, se ritieni che aprirai file non attendibili da fonti non sicure. Un tipico motivo per utilizzare Qubes OS è aprire documenti da fonti sconosciute.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizza la VM di Xen [Dom0](https://wiki.xenproject.org/wiki/Dom0) (cioè, "AdminVM"), per controllare altre VM ospiti o Qubes sul sistema operativo del host. Le altre VM mostrano le finestre delle singole applicazioni, nell'ambiente desktop di Dom0. Ti consente di codificare per colore le finestre, secondo i livelli di fiducia e di eseguire le app che possono interagire tra loro, con un controllo molto granulare.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copiare e incollare il testo
|
||||
|
||||
Puoi [copiare e incollare il testo](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) utilizzando `qvm-copy-to-vm` o le istruzioni seguenti:
|
||||
|
||||
1. Premi **Ctrl+C** per comunicare alla macchina virtuale in cui ti trovi che vuoi copiare qualcosa.
|
||||
2. Premi **Ctrl+Shift+C** per comunicare alla macchina virtuale di rendere disponibile questo buffer negli appunti globali.
|
||||
3. Premi **Ctrl+Shift+V** nella macchina virtuale di destinazione per rendere disponibili gli appunti globali.
|
||||
4. Premi **Ctrl+V** nella macchina virtuale di destinazione per incollare il contenuto nel buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### Scambio di file
|
||||
|
||||
Per copiare e incollare file e directory (cartelle) da una macchina virtuale all'altra, si può usare l'opzione **Copy to Other AppVM...** o **Move to Other AppVM...**. La differenza è che l'opzione **Move** eliminerà il file originale. Entrambe le opzioni proteggeranno i tuoi appunti dall'essere trapelati a qualsiasi altra Qube. Ciò è più sicuro del trasferimento di file isolaato, poiché un computer isolato sarà comunque forzato a recuperare partizioni o file di sistema. Ciò non è necessario con il sistema di copia tra Qube.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. La differenza è che l'opzione **Move** eliminerà il file originale. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Ciò non è necessario con il sistema di copia tra Qube.
|
||||
|
||||
??? info "Le AppVM o Qube non hanno i propri file di sistema"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
Puoi [copiare e spostare i file](https://www.qubes-os.org/doc/how-to-copy-and-move-files/), tra Qube. Così facendo, le modifiche non sono effettuate immediatamente e sono facilmente annullabili, in caso di incidente.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Così facendo, le modifiche non sono effettuate immediatamente e sono facilmente annullabili, in caso di incidente. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Interazioni tra VM
|
||||
|
||||
Il [quadro qrexec](https://www.qubes-os.org/doc/qrexec/) è una parte fondamentale di Qubes, che consente la comunicazione tra i domini delle macchine virtuali. Si basa sulla libreria di Xen *vchan*, che facilita l'[isolamento tramite politiche](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. Si basa sulla libreria di Xen *vchan*, che facilita l'[isolamento tramite politiche](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Risorse aggiuntive
|
||||
|
||||
Per ulteriori informazioni si consiglia di consultare le ampie pagine di documentazione di Qubes OS presenti sul [sito web di Qubes OS](https://www.qubes-os.org/doc/). Le copie offline sono scaricabili dalla [repository della documentazione](https://github.com/QubesOS/qubes-doc) di Qubes OS.
|
||||
|
||||
- Open Technology Fund: [*Probabilmente il sistema operativo più sicuro al mondo*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Compartimentazione del software vs. separazione fisica*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partizionamento della mia vita digitale in domini di sicurezza*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Articoli correlati*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ Tails는 재부팅 시마다 완전히 초기화되도록 설계되었습니다.
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ Tails는 재부팅 시마다 완전히 초기화되도록 설계되었습니다.
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -150,7 +150,7 @@ Het is de bedoeling dat Tails zichzelf volledig reset na elke herstart. Een vers
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is gebaseerd op Xen, het X Window System, en Linux, en kan de meeste Linux-toepassingen draaien en de meeste Linux-stuurprogramma's gebruiken.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -159,7 +159,7 @@ Het is de bedoeling dat Tails zichzelf volledig reset na elke herstart. Een vers
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overzicht"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is een besturingssysteem dat apps isoleert binnen virtuele machines voor een betere beveiliging.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Elke VM wordt een *Qube* genoemd en je kunt elke Qube een vertrouwensniveau toewijzen op basis van het doel ervan. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## Hoe werkt Qubes OS?
|
||||
|
||||
Qubes gebruikt [compartimentering](https://www.qubes-os.org/intro/) om het systeem veilig te houden. Qubes worden aangemaakt op basis van sjablonen, waarbij de standaard opties Fedora, Debian en [Whonix](../desktop.md#whonix)zijn. Met Qubes OS kunt u ook [wegwerpbare](https://www.qubes-os.org/doc/how-to-use-disposables/) virtuele machines creëren.
|
||||
Qubes gebruikt [compartimentering](https://www.qubes-os.org/intro/) om het systeem veilig te houden. Qubes worden aangemaakt op basis van sjablonen, waarbij de standaard opties Fedora, Debian en [Whonix](../desktop.md#whonix)zijn. Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architectuur, Krediet: Wat is Qubes OS Intro</figcaption>
|
||||
|
||||
Elke Qube-applicatie heeft een [gekleurde rand](https://www.qubes-os.org/screenshots/) die je kan helpen bij het bijhouden van de virtuele machine waarin het draait. Je kunt bijvoorbeeld een specifieke kleur gebruiken voor jouw bankbrowser, en een andere kleur voor een algemene niet-vertrouwde browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. Je kunt bijvoorbeeld een specifieke kleur gebruiken voor jouw bankbrowser, en een andere kleur voor een algemene niet-vertrouwde browser.
|
||||
|
||||
|
||||
<figcaption>Qubes vensterranden, krediet: Qubes Screenshots</figcaption>
|
||||
|
||||
## Waarom zou ik Qubes gebruiken?
|
||||
|
||||
Qubes OS is nuttig als jouw [bedreigingsmodel](../basics/threat-modeling.md) een sterke compartimentering en beveiliging vereist, bijvoorbeeld als je denkt dat je onvertrouwde bestanden van onvertrouwde bronnen zult openen. Een typische reden om Qubes OS te gebruiken is het openen van documenten van onbekende bronnen.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS maakt gebruik van [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (dwz een "AdminVM") voor het besturen van andere gast-VM 's of Qubes op het host-besturingssysteem. Andere VM 's geven individuele toepassingsvensters weer binnen de desktopomgeving van Dom0. Hiermee kun je vensters een kleurcode geven op basis van vertrouwensniveaus en apps draaien die met elkaar kunnen communiceren met zeer fijnmazige controle.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Tekst kopiëren en plakken
|
||||
|
||||
Je kunt [tekst kopiëren en plakken](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) met behulp van `qvm-copy-to-vm` of de onderstaande instructies:
|
||||
|
||||
1. Druk op **Ctrl+C** om de VM waarin je je bevindt te vertellen dat je iets wilt kopiëren.
|
||||
2. Druk op **Ctrl+Shift+C** om de VM te vertellen deze buffer beschikbaar te maken voor het algemene klembord.
|
||||
3. Druk op **Ctrl+Shift+V** in de doel-VM om het globale klembord beschikbaar te maken.
|
||||
4. Druk op **Ctrl+V** in de bestemmings-VM om de inhoud in de buffer te plakken.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### Bestandsuitwisseling
|
||||
|
||||
Om bestanden en mappen (mappen) van de ene VM naar de andere te kopiëren en te plakken, kunt je de optie **Kopiëren naar andere AppVM...** of **Verplaatsen naar andere AppVM...**gebruiken. Het verschil is dat de optie **Verplaatsen** het oorspronkelijke bestand verwijdert. Beide opties beschermen jouw klembord tegen uitlekken naar andere Qubes. Dit is veiliger dan bestandsoverdracht via air-gapped, omdat een air-gapped computer nog steeds gedwongen wordt partities of bestandssystemen te parseren. Dat is niet nodig met het inter-qube kopieersysteem.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. Het verschil is dat de optie **Verplaatsen** het oorspronkelijke bestand verwijdert. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Dat is niet nodig met het inter-qube kopieersysteem.
|
||||
|
||||
??? info "AppVM's of qubes hebben geen eigen bestandssystemen"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
Je kunt [bestanden kopiëren en verplaatsen](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) tussen Qubes. Daarbij worden de wijzigingen niet onmiddellijk aangebracht en kunnen ze bij een ongeval gemakkelijk ongedaan worden gemaakt.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. Daarbij worden de wijzigingen niet onmiddellijk aangebracht en kunnen ze bij een ongeval gemakkelijk ongedaan worden gemaakt. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interacties
|
||||
|
||||
Het [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is een kernonderdeel van Qubes dat communicatie tussen virtuele machines in domeinen mogelijk maakt. Het is gebouwd bovenop de Xen-bibliotheek *vchan*, die [isolatie vergemakkelijkt door middel van beleid](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. Het is gebouwd bovenop de Xen-bibliotheek *vchan*, die [isolatie vergemakkelijkt door middel van beleid](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Extra bronnen
|
||||
|
||||
Voor aanvullende informatie raden wij je aan de uitgebreide Qubes OS documentatie pagina's te raadplegen op de [Qubes OS Website](https://www.qubes-os.org/doc/). Offline kopieën kunnen worden gedownload van het Qubes OS [documentatie archief](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technologie Fonds: [*Ongetwijfeld 's werelds veiligste besturingssysteem*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Softwarecompartimentering versus fysieke scheiding*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*De verdeling van mijn digitale leven in veiligheidsdomeinen*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Verwante artikelen*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Android
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## Como funciona o Qubes OS?
|
||||
|
||||
Qubes usa [compartimentação](https://www.qubes-os.org/intro/) para manter o sistema seguro. Os Qubes são criados a partir de modelos, sendo as predefinições para Fedora, Debian e [Whonix](../desktop.md#whonix). O Qubes OS também permite que você crie máquinas virtuais [descartáveis](https://www.qubes-os.org/doc/how-to-use-disposables/) de uso único.
|
||||
Qubes usa [compartimentação](https://www.qubes-os.org/intro/) para manter o sistema seguro. Os Qubes são criados a partir de modelos, sendo as predefinições para Fedora, Debian e [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Por Que Devo Usar Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Cópia e Colagem de Texto
|
||||
|
||||
Você pode [copiar e colar texto](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) usando `qvm-copy-to-vm` ou as instruções abaixo:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Recursos Adicionais
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Artigos Relacionados*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes é baseado no Xen, o Sistema X Window e Linux, e pode executar a maioria das aplicações Linux e utilizar a maioria dos drivers Linux.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
Recomendamos armazenar uma chave de recuperação local em um local seguro, em vez de utilizar a recuperação do iCloud FileVault. "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
Recomendamos armazenar uma chave de recuperação local em um local seguro, em vez de utilizar a recuperação do iCloud FileVault. info "AppVMs or qubes do not have their own file systems"
|
||||
Recomendamos armazenar uma chave de recuperação local em um local seguro, em vez de utilizar a recuperação do iCloud FileVault. "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Recursos Adicionais
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ Tails содержит [uBlock Origin](desktop-browsers.md#ublock-origin) в Tor
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes основан на Xen, X Window System и Linux, и может запускать большинство Linux-приложений и использовать большинство драйверов для Linux.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ Tails содержит [uBlock Origin](desktop-browsers.md#ublock-origin) в Tor
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Обзор Qubes"
|
||||
icon: simple/qubesos
|
||||
description: Qubes - это операционная система, построенная на изоляции приложений в виртуальных машинах для обеспечения повышенной безопасности.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Каждая ВМ называется *Qube*, и вы можете назначить каждому Qube уровень доверия в зависимости от его назначения. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## Как работает Qubes OS?
|
||||
|
||||
Qubes использует [компартментализацию(разделение)](https://www.qubes-os.org/intro/) для обеспечения безопасности системы. Qubes создаются на основе шаблонов, по умолчанию Fedora, Debian и [Whonix](../desktop.md#whonix). Qubes OS также позволяет создавать [одноразовые](https://www.qubes-os.org/doc/how-to-use-disposables/) виртуальные машины.
|
||||
Qubes использует [компартментализацию(разделение)](https://www.qubes-os.org/intro/) для обеспечения безопасности системы. Qubes создаются на основе шаблонов, по умолчанию Fedora, Debian и [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Каждое приложение Qubes имеет [цветную рамку](https://www.qubes-os.org/screenshots/), которая помогает вам понять, в какой виртуальной машине оно запущено. Например, вы можете использовать определенный цвет для банковского браузера, а другой цвет - для общего ненадежного браузера.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. Например, вы можете использовать определенный цвет для банковского браузера, а другой цвет - для общего ненадежного браузера.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Почему мне стоит использовать Qubes?
|
||||
|
||||
Qubes OS полезна, если ваша [модель угроз](../basics/threat-modeling.md) требует сильного разделения и безопасности, например, если вы думаете, что будете открывать недоверенные файлы из недоверенных источников. Типичная причина использования Qubes OS - открытие документов из неизвестных источников.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS использует ВМ [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen (т.е. "AdminVM") для управления другими гостевыми ВМ или Qubes на хостовой ОС. Другие ВМ отображают отдельные окна приложений в среде рабочего стола Dom0. Это позволяет вам выделять окна цветом в зависимости от уровня доверия и запускать приложения, которые могут взаимодействовать друг с другом с очень детальным контролем.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Копирование и вставка текста
|
||||
|
||||
Вы можете [копировать и вставлять текст](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/), используя `qvm-copy-to-vm` или приведенные ниже инструкции:
|
||||
|
||||
1. Нажмите **Ctrl+C**, чтобы сообщить ВМ, в которой вы находитесь, что вы хотите что-то скопировать.
|
||||
2. Нажмите **Ctrl+Shift+C**, чтобы указать ВМ сделать этот буфер доступным для глобального буфера обмена.
|
||||
3. Нажмите **Ctrl+Shift+V** в ВМ назначения, чтобы сделать доступным глобальный буфер обмена.
|
||||
4. Нажмите **Ctrl+V** в целевой ВМ, чтобы вставить содержимое в буфер.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### Обмен файлами
|
||||
|
||||
Для копирования и вставки файлов и каталогов (папок) из одной ВМ в другую можно воспользоваться опцией **Copy to Other AppVM...** или **Move to Other AppVM...**. Разница в том, что опция **Move** удалит исходный файл. Любой из этих вариантов защитит ваш буфер обмена от утечки к другим Qubes. Это более безопасно, чем передача файлов по воздуху, поскольку компьютер с передачей по воздуху все равно будет вынужден парсить разделы или файловые системы. Этого не требуется при использовании системы копирования между несколькими Qubes.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. Разница в том, что опция **Move** удалит исходный файл. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Этого не требуется при использовании системы копирования между несколькими Qubes.
|
||||
|
||||
??? info "AppVMs или qubes не имеют собственных файловых систем"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
Вы можете [копировать и перемещать файлы](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) между Qubes. При этом изменения вносятся не сразу и могут быть легко отменены в случае аварии.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. При этом изменения вносятся не сразу и могут быть легко отменены в случае аварии. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Взаимодействие между ВМ
|
||||
|
||||
[Фреймворк qrexec](https://www.qubes-os.org/doc/qrexec/) является основной частью Qubes, которая позволяет виртуальным машинам взаимодействовать между доменами. Он построен на базе библиотеки Xen *vchan*, которая обеспечивает изоляцию [с помощью политик](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. Он построен на базе библиотеки Xen *vchan*, которая обеспечивает изоляцию [с помощью политик](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Дополнительные советы
|
||||
|
||||
Для получения дополнительной информации мы рекомендуем вам обратиться к обширной документации Qubes OS, расположенной на сайте [Qubes OS Website](https://www.qubes-os.org/doc/). Офлайн копии можно загрузить из [репозитория документации](https://github.com/QubesOS/qubes-doc) Qubes OS.
|
||||
|
||||
- Фонд открытых технологий: [*Пожалуй, самая безопасная операционная система в мире*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Программная компартментализация против физического разделения*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Разделение моей цифровой жизни по доменам безопасности*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Связанные статьи*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Översikt över Qubes"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Varje virtuell dator kallas *Qube* och du kan tilldela varje Qube en förtroendenivå baserat på dess syfte. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## Hur fungerar Qubes OS?
|
||||
|
||||
Qubes använder [compartmentalization](https://www.qubes-os.org/intro/) för att hålla systemet säkert. Qubes skapas från mallar, med Fedora, Debian och [Whonix](../desktop.md#whonix)som standard. Qubes OS låter dig också skapa en gång [engångs](https://www.qubes-os.org/doc/how-to-use-disposables/) virtuella maskiner.
|
||||
Qubes använder [compartmentalization](https://www.qubes-os.org/intro/) för att hålla systemet säkert. Qubes skapas från mallar, med Fedora, Debian och [Whonix](../desktop.md#whonix)som standard. Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes arkitektur, kredit: Vad är Qubes OS Intro</figcaption>
|
||||
|
||||
Varje Qubes-program har en färgad kant på [](https://www.qubes-os.org/screenshots/) som kan hjälpa dig att hålla reda på vilken virtuell maskin programmet körs på. Du kan till exempel använda en särskild färg för din bankwebbläsare och en annan färg för en allmänt opålitlig webbläsare.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. Du kan till exempel använda en särskild färg för din bankwebbläsare och en annan färg för en allmänt opålitlig webbläsare.
|
||||
|
||||
|
||||
<figcaption>Qubes fönstergränser, kredit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Varför ska jag använda Qubes?
|
||||
|
||||
Qubes OS är användbart om din [hotmodell](../basics/threat-modeling.md) kräver stark uppdelning och säkerhet, t.ex. om du tror att du kommer att öppna opålitliga filer från opålitliga källor. En typisk anledning till att använda Qubes OS är att öppna dokument från okända källor.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS använder [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (dvs. en "AdminVM") för att kontrollera andra gäst-VM:er eller Qubes på värdoperativsystemet. Andra virtuella datorer visar individuella programfönster i Dom0: s skrivbordsmiljö. Det gör det möjligt att färgkoda fönster baserat på förtroendenivåer och köra appar som kan interagera med varandra med mycket detaljerad kontroll.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Kopiera och klistra in text
|
||||
|
||||
Du kan [kopiera och klistra in text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) med hjälp av `qvm-copy-to-vm` eller nedanstående instruktioner:
|
||||
|
||||
1. Tryck på **Ctrl+C** för att tala om för den virtuella maskinen att du vill kopiera något.
|
||||
2. Tryck på **Ctrl+Shift+C** för att be den virtuella maskinen att göra denna buffert tillgänglig för det globala klippbordet.
|
||||
3. Tryck på **Ctrl+Shift+V** i destinations-VM för att göra det globala klippbordet tillgängligt.
|
||||
4. Tryck på **Ctrl+V** i den virtuella maskinen för att klistra in innehållet i bufferten.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### Filutbyte
|
||||
|
||||
Om du vill kopiera och klistra in filer och kataloger (mappar) från en VM till en annan kan du använda alternativet **Kopiera till annan AppVM...** eller **Flytta till annan AppVM...**. Skillnaden är att alternativet **Move** raderar den ursprungliga filen. Båda alternativen skyddar ditt klippblock från att läcka till andra Qubes. Detta är säkrare än filöverföring med luftgranskning eftersom en dator med luftgranskning fortfarande tvingas analysera partitioner eller filsystem. Detta är inte nödvändigt med inter-qube-kopieringssystemet.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. Skillnaden är att alternativet **Move** raderar den ursprungliga filen. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Detta är inte nödvändigt med inter-qube-kopieringssystemet.
|
||||
|
||||
??? info "AppVM eller qubes har inte egna filsystem"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
Du kan [kopiera och flytta filer] (https://www.qubes-os.org/doc/how-to-copy-and-move-files/) mellan Qubes. När du gör det görs inte ändringarna omedelbart och kan lätt ångras i händelse av en olycka.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. När du gör det görs inte ändringarna omedelbart och kan lätt ångras i händelse av en olycka. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM-interaktioner
|
||||
|
||||
Ramverket [qrexec](https://www.qubes-os.org/doc/qrexec/) är en central del av Qubes som gör det möjligt att kommunicera virtuella maskiner mellan domäner. Det bygger på Xen-biblioteket *vchan*, som underlättar [isolering genom policyer](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. Det bygger på Xen-biblioteket *vchan*, som underlättar [isolering genom policyer](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Ytterligare resurser
|
||||
|
||||
För ytterligare information rekommenderar vi att du konsulterar de omfattande Qubes OS-dokumentationssidorna som finns på webbplatsen [Qubes OS](https://www.qubes-os.org/doc/). Offlinekopior kan laddas ner från dokumentationsarkivet för Qubes OS [](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Fonden för öppen teknik: [*Världens förmodligen säkraste operativsystem*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitionera mitt digitala liv i säkerhetsdomäner*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Relaterade artiklar*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes is based on Xen, the X Window System, and Linux, and can run most Linux applications and use most of the Linux drivers.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes базується на Xen, X Window System та Linux і може запускати більшість програм Linux та використовувати більшість драйверів Linux.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: pg/qubes-os
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -146,7 +146,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes dựa trên Xen, X Window System, và Linux, và có thể chạy hầu hết các ứng dụng Linux và sử dụng hầu hết các trình điều khiển Linux.
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -155,7 +155,7 @@ By design, Tails is meant to completely reset itself after each reboot. Encrypte
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,55 +1,59 @@
|
||||
---
|
||||
title: "Qubes Overview"
|
||||
icon: pg/qubes-os
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. Each VM is called a *Qube* and you can assign each Qube a level of trust based on its purpose. As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## How does Qubes OS work?
|
||||
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) virtual machines.
|
||||
Qubes uses [compartmentalization](https://www.qubes-os.org/intro/) to keep the system secure. Qubes are created from templates, the defaults being for Fedora, Debian and [Whonix](../desktop.md#whonix). Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
Each Qubes application has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the virtual machine it is running in. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. You could, for example, use a specific color for your banking browser, while using a different color for a general untrusted browser.
|
||||
|
||||
|
||||
<figcaption>Qubes window borders, Credit: Qubes Screenshots</figcaption>
|
||||
|
||||
## Why Should I use Qubes?
|
||||
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong compartmentalization and security, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources.
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS utilizes [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM (i.e., an "AdminVM") for controlling other guest VMs or Qubes on the host OS. Other VMs display individual application windows within Dom0's desktop environment. It allows you to color code windows based on trust levels and run apps that can interact with each other with very granular control.
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### Copying and Pasting Text
|
||||
|
||||
You can [copy and paste text](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) using `qvm-copy-to-vm` or the below instructions:
|
||||
|
||||
1. Press **Ctrl+C** to tell the VM you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the VM to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination VM to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination VM to paste the contents in the buffer.
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### File Exchange
|
||||
|
||||
To copy and paste files and directories (folders) from one VM to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other Qubes. This is more secure than air-gapped file transfer because an air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. The difference is that the **Move** option will delete the original file. Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. That is not required with the inter-qube copy system.
|
||||
|
||||
??? info "AppVMs or qubes do not have their own file systems"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between Qubes. When doing so the changes aren't immediately made and can be easily undone in case of an accident.
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. When doing so the changes aren't immediately made and can be easily undone in case of an accident. When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### Inter-VM Interactions
|
||||
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows virtual machine communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. It is built on top of the Xen library *vchan*, which facilitates [isolation through policies](https://www.qubes-os.org/news/2020/06/22/new-qrexec-policy-system/).
|
||||
|
||||
## Additional Resources
|
||||
|
||||
For additional information we encourage you to consult the extensive Qubes OS documentation pages located on the [Qubes OS Website](https://www.qubes-os.org/doc/). Offline copies can be downloaded from the Qubes OS [documentation repository](https://github.com/QubesOS/qubes-doc).
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*Related Articles*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -161,7 +161,7 @@ Tails Tor 瀏覽器預設包含 [uBlock Origin](desktop-browsers.md#ublock-origi
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** 是開源作業系統，利用安全的虛擬器為桌面運算提供更強的安全性 (a.k.a. "Qubes"). Qubes 基於 Xen、X Window System 和 Linux ，可以運行大多數 Linux 應用程式與使用大多數 Linux 驅動程式。
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -171,7 +171,7 @@ Tails Tor 瀏覽器預設包含 [uBlock Origin](desktop-browsers.md#ublock-origi
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
|
||||
Qubes OS 作業系統將子系統（例如網絡、USB等）和應用程式隔離在個別的虛擬機器中以保護電腦。 如果系統的一部分被破壞，額外的隔離可以保護系統其餘部分。
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
有關 Oubes 運作的進一步資訊，請參考我們完整的 [Qubes OS 介紹](os/qubes-overview.md) 頁面。
|
||||
|
||||
|
||||
@ -1,49 +1,53 @@
|
||||
---
|
||||
title: "Qubes概述"
|
||||
icon: simple/qubesos
|
||||
description: Qubes 作業系統利用虛擬機器來隔離應用程式以提高安全性。
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) 為開源作業系統，其使用 [Xen](https://en.wikipedia.org/wiki/Xen) 管理程序利用隔離虛擬機器來為桌面運算提供強固的安全。 每個虛擬機器被稱為 *Qube* ，可以根據其目的為各個Qube 分配信任等級。 因為 Qubes OS 使用隔離方式的安全措施，授權行為皆以個別案例為準，此正與[badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/)壞處枚舉相反。
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## Qubes OS如何工作？
|
||||
|
||||
Qubes 使用 [分區化](https://www.qubes-os.org/intro/) 來確保系統安全。 Qubes 從模板創建，預設為 Fedora、Debian 和 [Whonix](../desktop.md#whonix)。 Qubes OS還允許您創建一次性 [一次性](https://www.qubes-os.org/doc/how-to-use-disposables/) 虛擬機器。
|
||||
Qubes 使用 [分區化](https://www.qubes-os.org/intro/) 來確保系統安全。 Qubes 從模板創建，預設為 Fedora、Debian 和 [Whonix](../desktop.md#whonix)。 Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes Architecture, Credit: What is Qubes OS Intro</figcaption>
|
||||
|
||||
每個Qubes應用程序都有 [顏色邊框](https://www.qubes-os.org/screenshots/) ，幫助您追蹤它所運行的虛擬機器。 例如，可以為銀行瀏覽器使用特定的顏色，而一般不信任的瀏覽器則使用不同顏色。
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. 例如，可以為銀行瀏覽器使用特定的顏色，而一般不信任的瀏覽器則使用不同顏色。
|
||||
|
||||
|
||||
<figcaption>Qubes 視窗邊框，圖片來源： Qubes Screenshots</figcaption>
|
||||
|
||||
## 我爲什麼要使用Qubes ？
|
||||
|
||||
如果您的 [威脅模型](../basics/threat-modeling.md) 需要強大的分區和安全性，例如認為需要從不信任的來源開啟可疑檔案， Qubes OS 非常有用。 使用 Qubes OS 的某種典型原因是打開來自不明來源的文件。
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes OS 利用 [DOM0](https://wiki.xenproject.org/wiki/Dom0) Xen VM （即「AdminVM」）來控制主機作業系統上其他訪客的 VM 或 Qubes。 其他VM 在 Dom0 桌面環境中顯示個別的應用程式視窗。 您可以根據信任等級為代碼窗口上色，並透過非常細膩的控制來執行應用程式。
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### 復制和黏貼文本
|
||||
|
||||
可利用 `qvm-copy-to-vm` 或以下說明 [複製並貼上文本](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/) ：
|
||||
|
||||
1. 按 **Ctrl + C** 讓 VM 複製某些內容。
|
||||
2. 按 **Ctrl + Shift + C** 讓 VM 將此緩衝區供全局剪貼板使用。
|
||||
3. 在目標 VM 中按 **Ctrl + Shift + V** 以使全局剪貼簿可用。
|
||||
4. 在目標 VM 中按 **Ctrl + V** 將內容粘貼到緩衝區中。
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### 檔案交換
|
||||
|
||||
若要將檔案和目錄(資料夾)從一個 VM 複製貼到另一個 VM ，您可以使用選項 **Copy to Other AppVM...** 或 **Move to Other AppVM...**。 不同之處在於 **Move** 選項會刪除原始檔案。 這兩個選項都可以保護您的剪貼簿不會洩漏到任何其他 Qubes。 這比網閘式檔案傳輸更安全，因為網閘電腦仍將被迫解析分割區或檔案系統。 這在inter-qube複製系統中是不需要的。
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. 不同之處在於 **Move** 選項會刪除原始檔案。 Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. 這在inter-qube複製系統中是不需要的。
|
||||
|
||||
??? info "AppVms沒有自己的檔案系統"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
您可以在Qubes之間[複製和移動檔案](https://www.qubes-os.org/doc/how-to-copy-and-move-files/)。 當這樣做時，不會立即進行更改，並且在發生事故時可以輕鬆撤消。
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. 當這樣做時，不會立即進行更改，並且在發生事故時可以輕鬆撤消。 When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### 虛擬機之間交互
|
||||
|
||||
[qrexec 框架](https://www.qubes-os.org/doc/qrexec/) 是 Qubes 的核心構成，讓虛擬機器在域之間溝通。 它基於 Xen 庫 *vchan*之上，通過策略</a>促進
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. 它基於 Xen 庫 *vchan*之上，通過策略</a>促進
|
||||
隔離。</p>
|
||||
|
||||
|
||||
@ -52,7 +56,7 @@ Qubes OS 利用 [DOM0](https://wiki.xenproject.org/wiki/Dom0) Xen VM （即「Ad
|
||||
|
||||
如需更多資訊，建議瀏覽[Qubes OS 網站](https://www.qubes-os.org/doc/)上 Qubes OS 文件頁面。 可以從Qubes OS [文件庫](https://github.com/QubesOS/qubes-doc)下載離線副本。
|
||||
|
||||
- Open Technology Fund: [*Arguably the world's most secure operating system*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. Rutkowska: [*Software compartmentalization vs. physical separation*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. Rutkowska: [*Partitioning my digital life into security domains*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*相關文章*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
@ -152,7 +152,7 @@ Tails默认在Tor浏览器中包括 [uBlock Origin](desktop-browsers.md#ublock-o
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (a.k.a. "Qubes"). Qubes基于Xen、X窗口系统和Linux，可以运行大多数Linux应用程序并使用大多数Linux驱动程序。
|
||||
**Qubes OS** is an open-source operating system designed to provide strong security for desktop computing through secure virtual machines (or "qubes"). Qubes is based on Xen, the X Window System, and Linux. It can run most Linux applications and use most of the Linux drivers.
|
||||
|
||||
[:octicons-home-16: Homepage](https://www.qubes-os.org/){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion){ .card-link title="Onion Service" }
|
||||
@ -161,7 +161,7 @@ Tails默认在Tor浏览器中包括 [uBlock Origin](desktop-browsers.md#ublock-o
|
||||
[:octicons-code-16:](https://github.com/QubesOS/){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://www.qubes-os.org/donate/){ .card-link title=Contribute }
|
||||
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate VMs. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the system.
|
||||
Qubes OS secures the computer by isolating subsystems (e.g., networking, USB, etc.) and applications in separate *qubes*. Should one part of the system be compromised, the extra isolation is likely to protect the rest of the *qubes* and the core system.
|
||||
|
||||
For further information about how Qubes works, read our full [Qubes OS overview](os/qubes-overview.md) page.
|
||||
|
||||
|
||||
@ -1,49 +1,53 @@
|
||||
---
|
||||
title: "Qubes概述"
|
||||
icon: simple/qubesos
|
||||
description: Qubes is an operating system built around isolating apps within virtual machines for heightened security.
|
||||
description: Qubes is an operating system built around isolating apps within *qubes* (formerly "VMs") for heightened security.
|
||||
---
|
||||
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated virtual machines. 每个虚拟机被称为 *Qube* ，你可以根据它的目的给每个Qube分配一个信任等级。 As Qubes OS provides security by using isolation, and only permitting actions on a per-case basis, it is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
[**Qubes OS**](../desktop.md#qubes-os) is an open-source operating system which uses the [Xen](https://en.wikipedia.org/wiki/Xen) hypervisor to provide strong security for desktop computing through isolated *qubes*, (which are Virtual Machines). You can assign each *qube* a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of [badness enumeration](https://www.ranum.com/security/computer_security/editorials/dumb/).
|
||||
|
||||
## Qubes操作系统是如何工作的？
|
||||
|
||||
Qubes使用 [分区](https://www.qubes-os.org/intro/) ，以保持系统的安全性。 Qubes是由模板创建的，默认的是Fedora、Debian和 [Whonix](../desktop.md#whonix)。 Qubes OS还允许你创建一次使用的 [一次性的](https://www.qubes-os.org/doc/how-to-use-disposables/) 虚拟机。
|
||||
Qubes使用 [分区](https://www.qubes-os.org/intro/) ，以保持系统的安全性。 Qubes是由模板创建的，默认的是Fedora、Debian和 [Whonix](../desktop.md#whonix)。 Qubes OS also allows you to create once-use [disposable](https://www.qubes-os.org/doc/how-to-use-disposables/) *qubes*.
|
||||
|
||||
??? "The term *qubes* is gradually being updated to avoid referring to them as "virtual machines"."
|
||||
|
||||
Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.
|
||||
|
||||
|
||||
<figcaption>Qubes架构，信用：什么是Qubes操作系统介绍</figcaption>
|
||||
|
||||
每个Qubes应用程序都有一个 [色的边框](https://www.qubes-os.org/screenshots/) ，可以帮助你跟踪它所运行的虚拟机。 例如，你可以为你的银行浏览器使用一种特定的颜色，而对一般的不信任的浏览器使用不同的颜色。
|
||||
Each qube has a [colored border](https://www.qubes-os.org/screenshots/) that can help you keep track of the domain in which it runs. 例如，你可以为你的银行浏览器使用一种特定的颜色，而对一般的不信任的浏览器使用不同的颜色。
|
||||
|
||||
|
||||
<figcaption>Qubes窗口边框，图片来源： Qubes截图</figcaption>
|
||||
|
||||
## 为什么我应该使用Qubes？
|
||||
|
||||
如果你的 [威胁模型](../basics/threat-modeling.md) ，需要强大的分隔和安全，例如你认为你会从不信任的来源打开不信任的文件，那么Qubes OS就很有用。 使用Qubes OS的一个典型原因是打开来自未知来源的文件。
|
||||
Qubes OS is useful if your [threat model](../basics/threat-modeling.md) requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.
|
||||
|
||||
Qubes操作系统利用 [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM（即 "AdminVM"）来控制主机操作系统上的其他客户虚拟机或Qubes。 其他虚拟机在Dom0的桌面环境中显示单个应用程序窗口。 它允许你根据信任程度对窗口进行颜色编码，并以非常细化的控制方式运行可以相互交互的应用程序。
|
||||
Qubes OS utilizes [dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM for controlling other *qubes* on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.
|
||||
|
||||
### 复制和粘贴文本
|
||||
|
||||
你可以 [，使用 `qvm-copy-to-vm` 或下面的说明复制和粘贴文本](https://www.qubes-os.org/doc/how-to-copy-and-paste-text/)。
|
||||
|
||||
1. 按 **Ctrl+C** ，告诉你所在的虚拟机，你想复制一些东西。
|
||||
2. 按 **Ctrl+Shift+C** ，告诉虚拟机将这个缓冲区提供给全局剪贴板。
|
||||
3. 在目标VM中按 **Ctrl+Shift+V** ，使全局剪贴板可用。
|
||||
4. 在目标虚拟机中按 **Ctrl+V** ，以粘贴缓冲区中的内容。
|
||||
1. Press **Ctrl+C** to tell the *qube* you're in that you want to copy something.
|
||||
2. Press **Ctrl+Shift+C** to tell the *qube* to make this buffer available to the global clipboard.
|
||||
3. Press **Ctrl+Shift+V** in the destination *qube* to make the global clipboard available.
|
||||
4. Press **Ctrl+V** in the destination *qube* to paste the contents in the buffer.
|
||||
|
||||
### 文件交换
|
||||
|
||||
要从一个虚拟机复制和粘贴文件和目录（文件夹）到另一个虚拟机，可以使用选项 **复制到其他AppVM...** 或 **移动到其他AppVM...**。 不同的是， **Move** 选项将删除原始文件。 无论哪种选择都会保护你的剪贴板不被泄露给任何其他Qubes。 这比空运的文件传输更安全，因为空运的计算机仍将被迫解析分区或文件系统。 这一点在跨区拷贝系统中是不需要的。
|
||||
To copy and paste files and directories (folders) from one *qube* to another, you can use the option **Copy to Other AppVM...** or **Move to Other AppVM...**. 不同的是， **Move** 选项将删除原始文件。 Either option will protect your clipboard from being leaked to any other *qubes*. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. 这一点在跨区拷贝系统中是不需要的。
|
||||
|
||||
??? 信息 "AppVMs或qubes没有自己的文件系统"
|
||||
??? "Qubes do not have their own filesystems."
|
||||
|
||||
你可以在Qubes之间[复制和移动文件]（https://www.qubes-os.org/doc/how-to-copy-and-move-files/）。 当这样做的时候，改变并不是立即进行的，而且在发生事故的情况下可以很容易地撤消。
|
||||
You can [copy and move files](https://www.qubes-os.org/doc/how-to-copy-and-move-files/) between *qubes*. 当这样做的时候，改变并不是立即进行的，而且在发生事故的情况下可以很容易地撤消。 When you run a *qube*, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.
|
||||
|
||||
### 虚拟机之间的相互作用
|
||||
|
||||
[qrexec框架](https://www.qubes-os.org/doc/qrexec/) 是Qubes的一个核心部分，它允许虚拟机在域之间通信。 它建立在Xen库 *vchan*的基础上，通过策略</a>，促进了
|
||||
The [qrexec framework](https://www.qubes-os.org/doc/qrexec/) is a core part of Qubes which allows communication between domains. 它建立在Xen库 *vchan*的基础上，通过策略</a>，促进了
|
||||
隔离。</p>
|
||||
|
||||
|
||||
@ -52,7 +56,7 @@ Qubes操作系统利用 [Dom0](https://wiki.xenproject.org/wiki/Dom0) Xen VM（
|
||||
|
||||
关于其他信息，我们鼓励你查阅位于 [Qubes OS网站上的大量Qubes OS文档页面](https://www.qubes-os.org/doc/)。 离线拷贝可以从Qubes OS [文档库中下载](https://github.com/QubesOS/qubes-doc)。
|
||||
|
||||
- 开放技术基金。 [*可以说是世界上最安全的操作系统*](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/)
|
||||
- J. 鲁特科夫斯卡。 [*软件区隔与物理分离*](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf)
|
||||
- J. 鲁特科夫斯卡。 [*将我的数字生活划分为安全领域*](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html)
|
||||
- Qubes OS: [*相关文章*](https://www.qubes-os.org/news/categories/#articles)
|
||||
- [Arguably the world's most secure operating system](https://www.opentech.fund/news/qubes-os-arguably-the-worlds-most-secure-operating-system-motherboard/) (Open Technology Fund)
|
||||
- [Software compartmentalization vs. physical separation](https://invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf) (J. Rutkowska)
|
||||
- [Partitioning my digital life into security domains](https://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html) (J. Rutkowska)
|
||||
- [Related Articles](https://www.qubes-os.org/news/categories/#articles) (Qubes OS)
|
||||
|
||||
Reference in New Issue
Block a user