qvm-create-windows-qube-1: A Shell repository from brendanhoar

Qvm-Create-Windows-Qube

Spin up new Windows qubes quickly, effortlessly and securely

About

Qvm-Create-Windows-Qube is a tool for quickly and conveniently installing fresh new Windows qubes with Qubes Windows Tools (QWT) drivers automatically. It officially supports Windows 7, 8.1 and 10 as well as Windows Server 2008 R2, 2012 R2, 2016 and 2019.

The project emphasizes correctness, security and treating Windows as an untrusted guest operating system throughout the entire process. The installation takes place 100% air gapped and features optional Whonix integration on the finished Windows qube for added privacy.

It also features other niceties such as automatic installation of packages including Firefox, Office 365, Notepad++, Visual Studio and more using Chocolatey to get you up and running quickly in your new environment.

As featured on: Hacker News | Proudly ranked in the top 10 on the front page of Hacker News as well as first place for Show HN

Installation

Download the installation script by opening the link, right-clicking and then selecting "Save [Page] as..."
Copy install.sh into Dom0 by running the following command in Dom0:
- qvm-run -p --filter-escape-chars --no-color-output <name_of_qube_script_is_located_on> "cat '/home/user/Downloads/install.sh'" > install.sh
- Make sure to get all the single and double quotes
Review the code of install.sh to ensure its integrity
- Safer with escape character filtering enabled in the prior step; qvm-run disables it by default when the output is a file
Run chmod +x install.sh && ./install.sh
- Note that this will install packages in the global default TemplateVM, which is fedora-XX by default
Review the code of the resulting /usr/bin/qvm-create-windows-qube

A more streamlined and secure installation process with packaging will be shipping with Qubes R4.1.

Updating

To update Qvm-Create-Windows-Qube, start by simply deleting the windows-mgmt VM and main program by running the following command in Dom0:

qvm-remove -f windows-mgmt && sudo rm /usr/bin/qvm-create-windows-qube

Lastly, follow the installation steps above to reinstall.

Note that this will also delete any Windows ISOs that have already been downloaded. This may be desirable in the case that Microsoft has updated the Windows ISOs (meaning you should redownload them anyway). However, if you would like to avoid downloading any of the Windows ISOs again, simply navigate to /home/user/Documents/qvm-create-windows-qube/windows-media/isos in the windows-mgmt VM and copy its contents to another (preferably disposable) qube. After the reinstall is complete, copy those ISOs back into windows-mgmt at the aforementioned directory.

Usage

Usage: qvm-create-windows-qube [options] -i <iso> -a <answer file> <name>
  -h, --help
  -c, --count <number> Number of Windows qubes with given basename desired
  -t, --template Make this qube a TemplateVM instead of a StandaloneVM
  -n, --netvm <qube> NetVM for Windows to use
  -s, --seamless Enable seamless mode persistently across reboots
  -o, --optimize Optimize Windows by disabling unnecessary functionality for a qube
  -y, --spyless Configure Windows telemetry settings to respect privacy
  -w, --whonix Apply Whonix recommended settings for a Windows-Whonix-Workstation
  -p, --packages <packages> Comma-separated list of packages to pre-install (see available packages at: https://chocolatey.org/packages)
  -P, --pool <name> LVM storage pool to install Windows on (https://www.qubes-os.org/doc/secondary-storage/)
  -i, --iso <file> Windows media to automatically install and setup
  -a, --answer-file <xml file> Settings for Windows installation

Downloading Windows ISO

The download-windows.sh script (located at /home/user/Documents/qvm-create-windows-qube/windows-media/isos/download-windows.sh in windows-mgmt) securely downloads the Windows ISO to be used by Qvm-Create-Windows-Qube from official Microsoft servers.

windows-mgmt is air gapped from the network. This means that in order to securely perform the download, one must copy the download-windows.sh script and SHA256SUMS file to another (disposable) qube followed by transferring the newly downloaded ISO(s) into windows-mgmt and placing them into the /home/user/Documents/qvm-create-windows-qube/windows-media/isos directory. Alternatively, windows-mgmt can temporarily be given network access, however, this isn't recommended for security reasons.

Creating Windows VM

Important: Be sure to read the Qubes Windows Tools Known Issues section below for a couple small upstream issues in the case of Windows 10 and other newer OSs all of which have easy workarounds available.

Windows 10

Video demonstration

qvm-create-windows-qube -n sys-firewall -oyp firefox,notepadplusplus,office365proplus -i win10x64.iso -a win10x64-pro.xml work-win10

qvm-create-windows-qube -n sys-firewall -oyp steam -i win10x64.iso -a win10x64-pro.xml game-console

Windows Server 2019

qvm-create-windows-qube -n sys-firewall -oy -i win2019-eval.iso -a win2019-datacenter-eval.xml fs-win2019

Windows 10 LTSC

A more stable, minified, secure and private version of Windows 10 officially provided by Microsoft
This version of Windows 10 is recommended for those who need the best in Windows security and privacy

qvm-create-windows-qube -n sys-firewall -oyp firefox,notepadplusplus,office365proplus -i win10x64-ltsc-eval.iso -a win10x64-ltsc-eval.xml work-win10

qvm-create-windows-qube -n sys-whonix -oyw -i win10x64-ltsc-eval.iso -a win10x64-ltsc-eval.xml anon-win10

Windows 7

Not recommended because Windows 7 is no longer supported by Microsoft, however, it's the only desktop OS the Qubes GUI driver (in Qubes Windows Tools) supports if seamless window integration or dynamic resizing is required

Video demonstration

qvm-create-windows-qube -n sys-firewall -soyp firefox,notepadplusplus,office365proplus -i win7x64-ultimate.iso -a win7x64-ultimate.xml work-win7

Security

Qvm-Create-Windows-Qube is "reasonably secure" as Qubes would have it.

windows-mgmt is air gapped
The entirety of the Windows qube setup process is done air gapped
- Exception: If (and only if) packages are configured for installation then Windows will be allowed access to the Internet at the very end of the Windows qube installation
Entire class of command injection vulnerabilities eliminated in the Dom0 shell script by not letting it parse any output from the untrusted windows-mgmt qube
- Only exit codes are passed by qvm-run; no variables
- This also mitigates the fallout of another Shellshock Bash vulnerability
Downloading of the Windows ISOs is made secure by enforcing:
- ISOs are downloaded straight from Microsoft controlled subdomains of microsoft.com
- HTTPS TLS 1.2/1.3
- SHA-256 verification of the files after download
Windows is treated as an untrusted guest operating system the entire way through
The impact of any theoretical vulnerabilities in handling of the Windows ISO (e.g. vulnerability in filesystem parsing) or answer file is limited to windows-mgmt
All commits by the maintainers are always signed with their respective PGP keys
- Should signing ever cease, assume compromise
- Current maintainer 1: Elliot Killick
  - PGP key: 018F B9DE 6DFA 13FB 18FB 5552 F9B9 0D44 F83D D5F2
- Current maintainer 2: Frédéric Pierret (No Keybase account)
  - PGP key: 9FA6 4B92 F95E 706B F28E 2CA6 4840 10B5 CDC5 76E2
  - Mostly concerned with Qubes R4.1 support
    - See the release4.1 branch and qubes-mgmt-salt-windows-mgmt

Windows

Maintenance

Don't forget to apply any applicable updates upon creation of your Windows qube. Microsoft frequently builds up-to-date ISOs for current versions of Windows, such as Windows 10. For these Windows versions, it's recommended to periodically visit the official Microsoft site download-windows.sh provides to get a fresh Windows image out of the box.

Advisories

Windows 7 and Windows Server 2008 R2 reached end of life (EOL) on January 14, 2020. Updates for these OSs are still available with Extended Security Updates (ESUs) if paid for. Office 365 for these OSs will continue getting security updates at no additional cost until January 2023.

Privacy

Qvm-Create-Windows-Qube aims to be the most private way to use Windows. Many Qubes users switched from Windows (or another proprietary OS) in part to get away from Microsoft (or Big Tech in general) and so being able to use Windows from a safe distance is of utmost importance to this project. Or at least, as safe a distance as possible for what is essentially a huge, proprietary binary blob.

Windows Telemetry

Configures Windows telemetry settings to respect privacy.

Opt-out of Customer Experience Improvement Program (CEIP)
Disable Windows Error Reporting (WER)
Disable DiagTrack service
Switch off all telemetry in Windows 10 "Settings" application
Enable "Security" level of telemetry on compatible editions of Windows 10
See spyless.bat for more info

Whonix Recommendations for Windows-Whonix-Workstation

Everything mentioned here up to "Even more security" is implemented. "Most security" is to use an official Whonix-Workstation built yourself from source. This feature is not official or endorsed by Whonix.

It's recommended to read this Whonix documentation to understand the implications of using Windows in this way.

Easy to Reset Fingerprint

There are countless unique identifiers present in every Windows installation such as the MachineGUID, installation ID, NTFS drive Volume Serial Numbers (VSNs) and more. With Qvm-Create-Windows-Qube, these unique identifiers can easily be reset by automatically reinstalling Windows.

Limitations

Fingerprinting is possible through the hypervisor in the event of VM compromise, here are some practical examples (not specific to Windows):

Xen clocksource as wallclock
- Timezone leak can at least be mitigated by configuring UTC time in the BIOS/UEFI, the local timezone can still be configured for XFCE Dom0 clock
- However, time correlation between VMs remain trivial
CPUID
Generally some of the VM interfaces documented here (e.g. screen dimensions)

Frequently Asked Questions (FAQ)

Do I need a Windows license to use this project?

No, with every Windows installation comes an embedded trial product key which is used by default if none other is provided. Qvm-Create-Windows-Qube explicitly specifies no product key in the answer files in order to use the default trial key.

On general consumer versions of Windows such as (non-enterprise) 7, 8.1 and 10, these trials extend forever with the understanding that a watermark or pop up may start appearing requesting activation of the product.

On Windows Enterprise and Server Evaluation versions, once the trial is up the machine will automatically be shut down after being up for a set amount of time by the Windows License Monitoring Service (C:\Windows\System32\wlms\wlms.exe). When this occurs, the aforementioned reason for shutdown will be logged in the Event Viewer. To renew the trial run slmgr /rearm in the command prompt. This will work for the number of times specified in slmgr /dlv (it can vary) at which point the product must be activated or reinstalled.

It's recommended that you license the product when the trial is up in all cases.

Giving Windows Internet access is not required for using the trial key (as it's embedded within each ISO). However, it is required for activating Windows with a product key of your own (unless you do activation by phone).

What is the purpose of the `windows-mgmt` AppVM? May I delete it once the Windows installation is complete?

The purpose of the windows-mgmt AppVM is to securely isolate everything that goes on as part of the Windows installation to a single virtual machine. That way, the exploitation of any bugs that exist in, for example, in the Linux ISO filesystem parsing code is limited in the amount of harm it can do should a Windows ISO be malicious. This is the security principle upon which all of Qubes OS is built upon, it's known as "security by isolation" or "security by compartmentalization".

Feel free to delete windows-mgmt if you are sure there are no more Windows VMs you would like to create. However, if it's just the disk space you want to reclaim then you can simply delete the ISOs located at /home/user/Documents/qvm-create-windows-qube/windows-media/isos (in windows-mgmt) to save the vast majority of that space.

Contributing

You can start by giving this project a star! High quality PRs are also welcome! Take a look at the todo list below if you're looking for things that need improvement. Other improvements such as more elegant ways of completing a task, code cleanup and other fixes are also welcome.

Lots of Windows-related GSoCs for those interested.

The logo of this project is by Max Andersen, used with written permission.

This project is the product of an independent effort that is not officially endorsed by Qubes OS.

Qubes Windows Tools Known Issues

Please send patches for these if you are able to. Although, be aware that Qubes Windows Tools is currently unmaintained.

All OSs (Windows 8.1/10 and Windows Server 2012 R2 or greater in the default configuration)

No Windows display when Qubes GUI driver is not installed
- Any OS other than Windows 7/Windows Server 2008 R2 does not support Qubes GUI driver
- Temporary fix: Run qvm-features <name_of_windows_qube> gui 1 in Dom0 to make the display show up after Windows qube creation completes successfully

All OSs except Windows 7 and Windows Server 2008 R2

Prompt to install earlier version of .NET
- This only appears to be a cosmetic issue because qrexec services still work
  - This prompt can safely be ignored
- Has been merged but QWT needs to be rebuilt to include it and there's currently no maintainer

Windows 10 and Windows Server 2019

Private disk creation fails
- Temporary fix: Close the prepare-volume.exe window causing there to be no private disk (can't make a TemplateVM) but besides that Windows qube creation will continue as normal
- Has been merged but QWT needs to be rebuilt to include it and there's currently no maintainer

Older Xen Drivers Notice (for newer OSs such as Windows 10)

Due to instabilities of the older Xen drivers currently packaged with Qubes Windows Tools, there is a non-zero chance (probably about 1 in 10) that the first boot after Qubes Windows Tools installation will result in a Windows crash (BSOD) in newer OSs such as Windows 10. This is an issue with the underlying drivers which Qvm-Create-Windows-Qube cannot help. If this occurs, it's recommended to delete that qube and re-run the same qvm-create-windows-qube command to restart the installation from scratch.

Once the Windows qube gets up and running though, community reports have proven these older Xen drivers to be stable even in Windows 10.

Mailing list threads

Windows tagged Qubes OS GitHub issues

Todo

End Goal

Have a feature similar (or superior) to VMWare's Windows "Easy Install" feature on Qubes OS. VMWare's solution is proprietary and only available in their paid products.

VirtualBox also has something similar but it's not as feature-rich.

brendanhoar/qvm-create-windows-qube-1