Перейти к содержанию

Обзор Qubes

Qubes OS is an open-source operating system which uses the Xen hypervisor to provide strong security for desktop computing through isolated qubes, (which are Virtual Machines). You can assign each qube a level of trust based on its purpose. Qubes OS provides security by using isolation. It only permits actions on a per-case basis and therefore is the opposite of badness enumeration.

Как работает Qubes OS?

Qubes использует компартментализацию(разделение) для обеспечения безопасности системы. Qubes создаются на основе шаблонов, по умолчанию Fedora, Debian и Whonix. Qubes OS also allows you to create once-use disposable qubes.

The term qubes is gradually being updated to avoid referring to them as "virtual machines".

Some of the information here and on the Qubes OS documentation may contain conflicting language as the "appVM" term is gradually being changed to "qube". Qubes are not entire virtual machines, but maintain similar functionalities to VMs.

Архитектура Qubes

Qubes Architecture, Credit: What is Qubes OS Intro

Each qube has a colored border that can help you keep track of the domain in which it runs. Например, вы можете использовать определенный цвет для банковского браузера, а другой цвет - для общего ненадежного браузера.

Цветная рамка

Qubes window borders, Credit: Qubes Screenshots

Почему мне стоит использовать Qubes?

Qubes OS is useful if your threat model requires strong security and isolation, such as if you think you'll be opening untrusted files from untrusted sources. A typical reason for using Qubes OS is to open documents from unknown sources, but the idea is that if a single qube is compromised it won't affect the rest of the system.

Qubes OS utilizes dom0 Xen VM for controlling other qubes on the host OS, all of which display individual application windows within dom0's desktop environment. There are many uses for this type of architecture. Here are some tasks you can perform. You can see just how much more secure these processes are made by incorporating multiple steps.

Копирование и вставка текста

Вы можете копировать и вставлять текст, используя qvm-copy-to-vm или приведенные ниже инструкции:

  1. Press Ctrl+C to tell the qube you're in that you want to copy something.
  2. Press Ctrl+Shift+C to tell the qube to make this buffer available to the global clipboard.
  3. Press Ctrl+Shift+V in the destination qube to make the global clipboard available.
  4. Press Ctrl+V in the destination qube to paste the contents in the buffer.

Обмен файлами

To copy and paste files and directories (folders) from one qube to another, you can use the option Copy to Other AppVM... or Move to Other AppVM.... Разница в том, что опция Move удалит исходный файл. Either option will protect your clipboard from being leaked to any other qubes. This is more secure than air-gapped file transfer. An air-gapped computer will still be forced to parse partitions or file systems. Этого не требуется при использовании системы копирования между несколькими Qubes.

Qubes do not have their own filesystems.

You can copy and move files between qubes. При этом изменения вносятся не сразу и могут быть легко отменены в случае аварии. When you run a qube, it does not have a persistent filesystem. You can create and delete files, but these changes are ephemeral.

Взаимодействие между ВМ

The qrexec framework is a core part of Qubes which allows communication between domains. Он построен на базе библиотеки Xen vchan, которая обеспечивает изоляцию с помощью политик.

Connecting to Tor via a VPN

We recommend connecting to the Tor network via a VPN provider, and luckily Qubes makes this easy to do with a combination of ProxyVMs and Whonix.

After creating a new ProxyVM which connects to the VPN of your choice, you can chain your Whonix qubes to that ProxyVM before they connect to the Tor network, by setting the NetVM of your Whonix Gateway (sys-whonix) to the newly-created ProxyVM.

Your qubes should be configured in a manner similar to this:

Qube name Qube description NetVM
sys-net Your default network qube (pre-installed) n/a
sys-firewall Your default firewall qube (pre-installed) sys-net
sys-proxyvm The VPN ProxyVM you created sys-firewall
sys-whonix Your Whonix Gateway VM sys-proxyvm
anon-whonix Your Whonix Workstation VM sys-whonix

Дополнительные советы

Для получения дополнительной информации мы рекомендуем вам обратиться к обширной документации Qubes OS, расположенной на сайте Qubes OS Website. Офлайн копии можно загрузить из репозитория документации Qubes OS.

Вы просматриваете русскую копию Privacy Guides, переведённую нашей невероятной командой переводчиков на Crowdin. Если вы нашли ошибку или непереведённые разделы на этой странице, пожалуйста, помогите нам! Для получения дополнительной информации и советов см. наше руководство по переводу.

You're viewing the Russian copy of Privacy Guides, translated by our fantastic language team on Crowdin. If you notice an error, or see any untranslated sections on this page, please consider helping out! For more information and tips see our translation guide.