Kali VM no longer responding

[Lucas Arnström]

Hi, I have been using a debian template converted into kali for quite
some time. But recently, neither the kali template nor any appvms based
on it are responding. I can start the vms just fine, but cant do much
other than that. It seems to be some recent change that induced this
problem, considering i have been able to use the very same vms for quite
some time. But after my last update they all stopped working.

I have attempted to do a complete rebuild of my kali template. I got
everything set up, but as soon as I restarted the template I got the
same issue again.

I'm attaching the logs.

// Lucas

[qubenix]

Lucas Arnström:

I've had this same experience after a dist-upgrade on my debian-9
template (d9) about 12 hours ago. I had made a clone of this template
about two weeks ago and added the kali repos and some packages.
Strangely, my kali template (and AppVM based on it) work normal even
though it was also upgraded at the same time.

```
user@dom0:~$ qvm-run -p d9 gnome-terminal
Unable to init server: Could not connect: Connection refused
Failed to parse arguments: Cannot open display:
```

--
qubenix
GPG: B536812904D455B491DCDCDD04BE1E61A3C2E500

[a.mc...@yandex.com]

That means not only me has the same issue with debian-9 template. I've started reinstalling template.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Looks like this issue:
https://github.com/QubesOS/qubes-issues/issues/2514

Rebuilt package just uploaded to testing repository
(qubes-gui-agent_3.2.10-2+deb9u1).

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYThG0AAoJENuP0xzK19csldEH/jrTxcryYPNjC/umInRN2BG4
Lgc3EaAdtlF+wVnW+EKD0aq/8Xiyxq0VetCiGHRMH5ia4o9StnUnFQUTIE77gWuJ
ocy7XfP+n8rhpBfE/cCpVVeUZiFTJMP4CgRAmnw5o4od1Qx0Kf6t15ORc92GjXRt
aW1MZBkRfWSoXDWHaux8flw2UvNo5tSI3ugyo3eRSRJxCmKDvgBRoSW/OXZPdhUV
VHgt2mGouf1UALO/OSSqvewlsD93AEyh8hjio3qjtCziFzTEsHT9N7jzFdpB8R53
LN/XFF9IxjXiIMB/UEVDRe+ypWhg6TNfUku/ZE5TCTLeMBKgj132738bb7UYsZA=
=MQId
-----END PGP SIGNATURE-----

[qubenix]

Marek Marczykowski-Górecki:

Doesn't seem to be fixed in stretch, stretch-testing, or
stretch-securitytesting yet.

```
[user@dom0 ~]$ qvm-run -p d9 "sudo apt-get update && sudo apt-get
dist-upgrade -y"
Hit:1 http://vwakviie2ienjx6t.onion/debian stretch InRelease
Hit:2 http://sgvtcaew4bxjd7ln.onion stretch/updates InRelease
Hit:3 http://deb.qubes-os.org/r3.2/vm stretch-testing InRelease
Hit:4 http://deb.qubes-os.org/r3.2/vm stretch-securitytesting InRelease
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
Calculating upgrade...
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
[user@dom0 ~]$ qvm-run -p d9 "sudo dpkg -l" | grep qubes-guiii
qubes-gui-agent 3.2.8+deb9u1
amd64 Makes X11 windows available to qubes dom0
```
--
qubenix
GPG: B536812904D455B491DCDCDD04BE1E61A3C2E500

[qubenix]

Marek Marczykowski-Górecki:

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Mon, Dec 12, 2016 at 05:10:00PM +0000, qubenix wrote:
> Marek Marczykowski-Górecki:

> > Looks like this issue:
> > https://github.com/QubesOS/qubes-issues/issues/2514
> >
> > Rebuilt package just uploaded to testing repository
> > (qubes-gui-agent_3.2.10-2+deb9u1).
> >
> >
>
> Doesn't seem to be fixed in stretch, stretch-testing, or
> stretch-securitytesting yet.
>
> ```
> [user@dom0 ~]$ qvm-run -p d9 "sudo apt-get update && sudo apt-get
> dist-upgrade -y"
> Hit:1 http://vwakviie2ienjx6t.onion/debian stretch InRelease
> Hit:2 http://sgvtcaew4bxjd7ln.onion stretch/updates InRelease
> Hit:3 http://deb.qubes-os.org/r3.2/vm stretch-testing InRelease
> Hit:4 http://deb.qubes-os.org/r3.2/vm stretch-securitytesting InRelease
> Reading package lists...
> Reading package lists...
> Building dependency tree...
> Reading state information...
> Calculating upgrade...
> 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
> [user@dom0 ~]$ qvm-run -p d9 "sudo dpkg -l" | grep qubes-gui
> ii qubes-gui-agent 3.2.8+deb9u1 amd64 Makes X11 windows available to
> qubes dom0
> ```

Interesting, I have qubes-gui-agent 3.2.11 already, from
stretch-testing. Do you have some caching proxy in between?

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYTxerAAoJENuP0xzK19csdMMH/iJr7fL/7PkzfLmExgc/Q7wi
vp4M3UUo4j+gk70ROhR3I2kvLNccgeYmKnR5n2Mw1vTO9/mfGyHoXvZXx3+DPz33
o22MnV/ZBicRpBHFy3FxQ3LnLSmpnRy9xNHzuyWQA1U3ASS4CJtEUIXVaAOSExhv
uBZwqgGiBo1h14q4NTSi+wVvhXTxCCnDsv6kf8qUnNDcUo+zrubr+A4wm2qfwH1i
DcPNc5j1+FXX/NQMjT9nMdeb9Ri68bcXsapjUtq1FZuZda0Q2rcTaBpEgv4U+pYR
zStJWxje+oLxCdCMttByA3gHGjLXNDhqQLNJnSr/YFsaERW7gnLIXMWpuFjk7f4=
=Z1cq
-----END PGP SIGNATURE-----

[qubenix]

Marek Marczykowski-Górecki:

At one point I was using Rustybirds update cache proxy, but I've since
switched back to a whonix-gw and unchecked "Allow connections to Updates
Proxy".

I have two debian-9 templates, and they both were connected to update
cache and are now connected to whonix-gw. Here's the results from my two
debian-9 templates (one is using stretch-testing and
stretch-securitytesting the other has only stretch-testing although I
don't think that should matter):

```
[user@dom0 ~]$ qvm-run -p d9 "sudo apt-get update && sudo apt-get

dist-upgrade -y -V"

Hit:1 http://vwakviie2ienjx6t.onion/debian stretch InRelease
Hit:2 http://sgvtcaew4bxjd7ln.onion stretch/updates InRelease
Hit:3 http://deb.qubes-os.org/r3.2/vm stretch-testing InRelease
Hit:4 http://deb.qubes-os.org/r3.2/vm stretch-securitytesting InRelease
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
Calculating upgrade...
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

[user@dom0 ~]$ qvm-run -p d9-kali "sudo apt-get update && sudo apt-get
dist-upgrade -y -V"

Hit:1 http://vwakviie2ienjx6t.onion/debian stretch InRelease
Hit:2 http://sgvtcaew4bxjd7ln.onion stretch/updates InRelease
Hit:3 http://deb.qubes-os.org/r3.2/vm stretch-testing InRelease

Hit:5 http://deb.bitmask.net/debian stretch InRelease
Hit:4 http://archive-3.kali.org/kali kali-rolling InRelease

Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
Calculating upgrade...

The following packages have been kept back:
qubes-gui-agent (3.2.8+deb9u1 => 3.2.11-1+deb9u1)
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.
[user@dom0 ~]$ qvm-run -p d9-kali "sudo aptitude dist-upgrade"

Reading package lists...
Building dependency tree...
Reading state information...

Reading extended state information...
Initializing package states...
Building tag database...
The following NEW packages will be installed:
xserver-xorg-input-qubes{ab} xserver-xorg-video-dummyqbs{ab}
The following packages will be upgraded:
qubes-gui-agent
1 packages upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 66.5 kB of archives. After unpacking 36.9 kB will be used.
The following packages have unmet dependencies:
xserver-xorg-video-dummyqbs : Depends: xorg-video-abi-23 which is a
virtual package, provided by:
- xserver-xorg-core
(2:1.19.0-2), but 2:1.18.4-2 is installed

Depends: xserver-xorg-core (>=
2:1.18.99.901) but 2:1.18.4-2 is installed
xserver-xorg-input-qubes : Depends: xorg-input-abi-24 which is a
virtual package, provided by:
- xserver-xorg-core (2:1.19.0-2),
but 2:1.18.4-2 is installed

Depends: xserver-xorg-core (>=
2:1.18.99.901) but 2:1.18.4-2 is installed
The following actions will resolve these dependencies:

Keep the following packages at their current version:
1) qubes-gui-agent [3.2.8+deb9u1 (now)]
2) xserver-xorg-input-qubes [Not Installed]
3) xserver-xorg-video-dummyqbs [Not Installed]



Accept this solution? [Y/n/q/?]
```

--
qubenix
GPG: B536812904D455B491DCDCDD04BE1E61A3C2E500

[qubenix]

qubenix:

I fixed the second template (d9-kali) by issuing:

sudo apt-get install -t stretch xserver-xorg-core
sudo apt-get dist-upgrade

That fixed my dependency problem and upgraded/installed the 3 packages.
Still, though, my d9 template is acting as though there is no package to
upgrade.

--
qubenix
GPG: B536812904D455B491DCDCDD04BE1E61A3C2E500

[qubenix]

qubenix:

And here's the facepalm: I had accidentally put deb-src in my
qubes-r3.list instead of deb. After fixing that my upgrade went smoothly
on the d9 template.

--
qubenix
GPG: B536812904D455B491DCDCDD04BE1E61A3C2E500

[Foppe de Haan]

thanks, this was the issue for me as well.

[J. Eppler]

Hello @qubenix,

I am interested in your Kali installation process. Did you run into any trouble during the installation? Did you follow the KaliVM installation instructions: https://www.qubes-os.org/doc/pentesting/kali/?

regards
j. Eppler

[qubenix]

J. Eppler:

Yes, followed the instructions from documentation until it came to
package installation. I *did not* attempt to install kali-linux-full,
use katoolin script, or any similar. I just install the packages as I
need to keep it minimal. Basically I have a debian-9 VM with Kali repos
added.

I also have a Kali i386 image that I will run in a standalone HVM when I
need to debug a 32 bit package. Although just yesterday I learned of
`dpkg --add-architecture i386`, which I had to do to my debian-9/Kali
template to get wine32. So now I may be able to do everything in just
one AppVM.

In summation, I've successfully followed both sets of instructions in
the Qubes docs, but skipped steps 6 and 11 in the "Create Debian Based
Kali Template" section and modified step 10 to only pull in the packages
I need.

--
qubenix
GPG: B536812904D455B491DCDCDD04BE1E61A3C2E500

[J. Eppler]

Hello,

thank you very much for the detailed answer.

best regards
J. Eppler