Qubes Outgoing Firewalll...

[Jonas]

Can Qubes install puppet on every device by default. Who give every VM the config (that the user want to be insert in every VM)

I would like to enable opensnitch firewall on every VM by default. ( The Controle Interface can be enabled on the Qube-Dom0)

https://github.com/evilsocket/opensnitch

what do you think about this???

On my setup this works very well. This should be default!!

Sent with ProtonMail Secure Email.

[bo0od]

same application github page saying:

"THIS SOFTWARE IS WORK IN PROGRESS, DO NOT EXPECT IT TO BE BUG FREE AND
DO NOT RELY ON IT FOR ANY TYPE OF SECURITY."

If you want to enable it by default , enjoy doing it yourself.

'Jonas' via qubes-devel:

> Sent with [ProtonMail](https://protonmail.com) Secure Email.
>

[Steve Coleman]

On 2019-11-12 12:38, 'Jonas' via qubes-devel wrote:

> I would like to enable opensnitch firewall on every VM by default.

> what do you think about this???

To be frank, it may look pretty, but it would be a big waste of CPU and
memory resources while providing absolutely no additional security.

- A firewall that runs inside the AppVM is easily circumvented by any
application or process running in that VM, thus no real security.

- You already have a real and secure Firewall by default sitting in the
sys-firewall VM, so why add an additional drain on your memory and CPU
resources. Why not learn to use what you already have available?

- You already have the means to see what you AppVM's are connecting to
if that is what you are after. You can simply run an app like etherape
(wireshark, or tcpdump) in the sys-firewall VM and see everything being
connected to all in one app. But that does degrade security model
somewhat, because running any user level apps there is opening the
attack surface a bit.

My suggestion is to learn the system you have first before adding all
kinds of extra security compromising software/baggage that you don't
really need.

[Outback Dingo]

On Wednesday, November 13, 2019 at 5:16:11 AM UTC+7, Steve Coleman wrote:

On 2019-11-12 12:38, 'Jonas' via qubes-devel wrote:

> I would like to enable opensnitch firewall on every VM by default.

> what do you think about this???

The daemon is implemented in Go and needs to run as root in order to interact with the Netfilter packet ... WTF ... runs away screaming ......