backup with debian-10-minimal based sys-usb fails

[Sven Semmler]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Very recently I migrated all my AppVMs to a debian-10 (buster)
template, which itself was created by upgrading the debian-9 template.

Equally my sys-net, sys-usb and sys-firewall dispvms are based on a
debian-10-minimal, which was upgraded from the debian-9-minimal. There
was one little hick-up with the qubes-update-proxy (tinyproxy), but
unman quickly pointed out what needed to be done.

Now I have only 2 things left that don't work as before:

1) Currently I can't backup. I never tried the CLI way and will do so
soon. Until now I always used the qubes manager. However, since my
sys-usb is based on the minimal debian-10 template ... it doesn't work
anymore. When I want to make a backup I simply get a message that the
backup is not running. Also, in both cases (making and restoring
backup) the dialog that lets me select target/source doesn't show up
anymore after clicking the "..." button.

I searched qubes-users and qubes-issue and did install the
qubes-core-admin-client in the template but that alone doesn't do the
trick. What could my next step be? Which log file to check? Any idea
what could be missing? (If I switch back to the fedora-minimal based
sys-usb it works).

2) When selecting what to backup I am used to see sys-net(0),
sys-usb(0) and sys-firewall(0) and exclude them. They are of size zero
as they are named disposable vms. However now I see both sys-net and
sys-firewall having a size (~30 MB slowly increasing day by day !?!)
But they are of class DispVM and are based on dvm-sys which in turn is
based on the minimal debian template. What could be going on here?

Why am I doing this? ... over the last few months I have formed the
impression that some of the more knowledgeable contributors on
qubes-users (e.g. unman and tasket) prefer debian. And I do get
annoyed be the super frequent updates of fedora. So I thought I'd try
out to switch everything to debian in the hope that I would then have
templates that can stay in use for many months if not years before I
need to switch again (I went through fedora 24-29 since using qubes).
Also another person with linux background said something about the
debian package format being better and more secure against
man-in-the-middle attacks (haven't researched that claim myself yet).

If anyone has information to confirm or disabuse me of the above
impressions, I am all ears.

Thank you!

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE18ry22WNibwI1qeq2m4We49UH7YFAlygWcYACgkQ2m4We49U
H7ZhABAA4gEFBVqImM+Xr7yjHKqJ1NC+kJez7yBUSxxPfRPoZhzoFuRJxlsSrit4
Bkglan0auyqDWQLaUjMwy3NWJQpxvBQuv/1HpQN1q3FuZoKw0giCT1ZkZ+FhvOwv
UsjmyiXdOmPSCXeejDLAhuwX1ZmUEV1JuLxAnexswEMe1QZV1N8Qa1DwwFG5XoEw
SXYLXKgZceTT/OQXh8CZhiKCAEKEOX38U86w0OXVdNH4oSPcoLy14MAXa0WlDukk
7QXeh4kPfsOx9hWxtQMKJ3Lyw4kxZoTvXFOGzUx94WyGRuuTQpru8CQJywAdM0Xe
sTbOmxyQAeH5ABY9ZUsO/I4BTq34uSpLEFDirNQ7FnK+vcG2MwdjnSP7xdDR1Iom
Hw4sRhvlnJzWxFuZVoT2F2dLKnNd833d6zy4xyiy2h0LkHETDyo4Oprp5uVDrJPk
1J43eZHBdHF+YjAREwC1/JPkfbGWOx1q5KpVE3TtQpOf82kLjJNWBqaERyEY1J/e
QAAnRPbXI1LNUYazOkJ1Qv992gsyglHPDqdQtl+g8bKudRznvdoEr+kLyn1uduF9
A7IUT1Ctk+NVyA7N9msjSCdzPiANCIdMddqL94zvpRuSaRTK7qRUN7z5fspt3XZb
3NPvTTh0hRinNh7c1rrzLdnJfb/0QDl9bX6touxhuOOdkYwAgAE=
=Ujwj
-----END PGP SIGNATURE-----

[unman]

1. The minimal template is minimal - it doenst have any GUI file
manager.
When you click on the ... button it spawns a file manager in the backup
qube. Since you dont have one installed it cant be opened.
You could install a file manager but then you're getting closer to the
normal Debian template which is pretty minimal.
If you are committed to minimal service qubes, CLI backup .

2. DisposableVMs will still have *some* size, as they differ from the
underlying template. When they are closed those differences will be
thrown away. (Just as you can download an iso in a disposableVM and see
the size balloon.)
I dont know what exactly is happening in your case - logs perhaps?

I'm not convinced about Debian packages being more secure than rpm: they
are, of course nicer. :-)
I'm a long standing Debian user with an antipathy to RedHat and Fedora.
The biggest drawback in using Debian packages in Qubes is that they are
configured on install, which requires some user intervention across
various qubes. Fedora doesnt do this, I think.

[Chris Laprise]

On 3/31/19 10:36 AM, unman wrote:

> I'm not convinced about Debian packages being more secure than rpm: they
> are, of course nicer. :-)

To me, its a matter of Fedora packages being less secure than *everyone
else*.

> I'm a long standing Debian user with an antipathy to RedHat and Fedora.
> The biggest drawback in using Debian packages in Qubes is that they are
> configured on install, which requires some user intervention across
> various qubes. Fedora doesnt do this, I think.

Shouldn't it be possible to run 'apt' in a mode where it accepts the
default (not always 'yes') response?

The qubes-multi-update script already does this when run in unattended
mode and I've never had a problem with it, even in highly customized
Debian templates.

--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886

[Sven Semmler]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 3/31/19 9:36 AM, unman wrote:
> 1. The minimal template is minimal - it doenst have any GUI file
> manager. When you click on the ... button it spawns a file manager
> in the backup qube. Since you dont have one installed it cant be
> opened.

I neglected to mention that I did install nautilus for that very reason.

> You could install a file manager but then you're getting closer to
> the normal Debian template which is pretty minimal. If you are
> committed to minimal service qubes, CLI backup .

You convinced me. My intermediate solution will be to run sys-net and
sys-firewall as named disposable VMs based on a true minimal (not the
one I messed with, but the original minimal template plus the
qubes-core-* packets required for networking). And sys-usb as a named
disposable VM based on the plain debian template.

Soon though I will understand the CLI for backup and restore and
automate my backups using a shell script. Then sys-usb will be like
sys-net and sys-firewall already are.

Thank you for your help!

/Sven

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE18ry22WNibwI1qeq2m4We49UH7YFAlym7RQACgkQ2m4We49U
H7bMpg//XeEzn1KGpgVWGK4MCekQ2RuJXNJItOsdnnGK4yxDHbPIEewdP4EIl+ZW
/+jwoTsWXHImpSJBaaFCWBayZwhOgyUaLVBT08GGd6P6hbNYBxiOG2qdrPrCEsds
XlVfwgfPTKIVVKn2poegzZ/762c/kPa5E1aL+nB+UqCzO05kuXoH720HpVcTmywW
ig6bOeuXlowOrLMXgUKsHaA111WmEfrbReVDDzf25xrZukPiFX7FhIKT3wQfGdSf
Z+wFvL+7CEvk4WBBR5PA2y8mx5BSXiYVOuR4zKPI9yXVhZnc5QkrB9lp3LljcIqA
TF6VfsYyAYYjg7rmEe7i72gzUf8eAbXvKXvZUzfJ3cblRUxAKIdUU/rCRUJS2QvX
5gR+y4XFG4ZXit3LNxqRmi0G1aL0haSvnGWhykeTK+q7Jclym9sInabuoKs+zme4
Tu2wg7Exkvx6kJ9+DRn1DhVyi1CPAJP6dXHsqnVhy6/xpSfulMPsqugW8EngcdsK
8xYKQfO2N1ddTI6qlljeE/PLDPPsgyPW0wk0/dHadOfFQ9FrdSYV1H3ZDxfRozEH
HjL8DmXuwpgEash748pb0KQgbEGRBorUGTRWVD6RtXgBpDu15ME0MwF7DYiYMC9V
FFWPHAin1hMI3jLC+TaPRnNlkC7CPXLmKCxpBHEY2jzj3YqhOew=
=ZgVG
-----END PGP SIGNATURE-----

[Sven Semmler]

On 4/5/19 12:52 AM, Sven Semmler wrote:

You could install a file manager but then you're getting closer to
the normal Debian template which is pretty minimal. If you are
committed to minimal service qubes, CLI backup .

You convinced me. My intermediate solution will be to run sys-net and
sys-firewall as named disposable VMs based on a true minimal (not the
one I messed with, but the original minimal template plus the
qubes-core-* packets required for networking). And sys-usb as a named
disposable VM based on the plain debian template.

Actually with the normal debian template only restore works. Backup has the same issue even though the file manager and selection comes up. For the time being I have restored the fedora-29 minimal template just for sys-usb, but I'd love to find out what packages are required to make it work ... so I could use a debian based template for sys-usb.

[unman]

Why do you say this? Backup works fine with a buster qube. What is the
exact problem that you have?

[Sven Semmler]

On 4/15/19 6:25 PM, unman wrote:
> Why do you say this? Backup works fine with a buster qube. What is the
> exact problem that you have?

I apologize. The issue was between chair and keyboard. In Fedora
external drives are mounted under /run/media/user and in Debian under
/media/user ... sorry for wasting your time. I must have been very tired
last time I tried.

It all works now. Funny enough all of my qubes are based on modified
debian-minimal templates, which makes me very happy as there are no
unneeded packages installed. OCD granted. The only qube I have to run
with the full debian template is sys-usb. I'll keep searching what is
needed (natuilus and qubes-core-agent-nautilus alone are not enough). If
I figure it out, I will reply here.

Thank you!

/Sven