{"id":41811,"date":"2020-02-16T20:45:57","date_gmt":"2020-02-16T17:45:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ispolzovanie-qubesos-dlya-raboty-s-windows-7"},"modified":"2020-02-16T20:45:57","modified_gmt":"2020-02-16T17:45:57","slug":"ispolzovanie-qubesos-dlya-raboty-s-windows-7","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/ispolzovanie-qubesos-dlya-raboty-s-windows-7","title":{"rendered":"Pou\u017eit\u00ed QubesOS pro pr\u00e1ci s Windows 7","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Na Habu nen\u00ed mnoho \u010dl\u00e1nk\u016f v\u011bnovan\u00fdch opera\u010dn\u00edmu syst\u00e9mu Qubes, a ty, kter\u00e9 jsem vid\u011bl, m\u00e1lo popisuj\u00ed zku\u0161enosti s jeho vyu\u017eit\u00edm. Douf\u00e1m, \u017ee toto naprav\u00edm na p\u0159\u00edkladu pou\u017eit\u00ed Qubes jako ochrann\u00e9ho prost\u0159edku pro Windows a z\u00e1rove\u0148 zhodnot\u00edm po\u010det rusky mluv\u00edc\u00edch u\u017eivatel\u016f syst\u00e9mu.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Pou\u017eit\u00ed QubesOS pro pr\u00e1ci s Windows 7\" src=\"\/wp-content\/uploads\/2020\/02\/9625f1a9464dc610d1f3266571cf8929.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Pro\u010d Qubes?<\/h2>\n<p><\/p>\n<p>Situace s koncem technick\u00e9 podpory Windows 7 a zvy\u0161uj\u00edc\u00ed se obavy u\u017eivatel\u016f vedla k nutnosti zorganizovat pr\u00e1ci tohoto opera\u010dn\u00edho syst\u00e9mu s ohledem na n\u00e1sleduj\u00edc\u00ed po\u017eadavky:<\/p>\n<p><\/p>\n<ul>\n<li>zajistit pou\u017eit\u00ed pln\u011b aktivovan\u00e9 Windows 7 s mo\u017enost\u00ed u\u017eivatelsk\u00e9ho instalov\u00e1n\u00ed aktualizac\u00ed a r\u016fzn\u00fdch aplikac\u00ed (v\u010detn\u011b p\u0159es Internet);<\/li>\n<li>implementovat \u00fapln\u00e9 nebo selektivn\u00ed vylou\u010den\u00ed s\u00ed\u0165ov\u00fdch interakc\u00ed na z\u00e1klad\u011b podm\u00ednky (re\u017eimy offline a filtrov\u00e1n\u00ed provozu);<\/li>\n<li>poskytnout mo\u017enost selektivn\u00edho p\u0159ipojen\u00ed extern\u00edch nosi\u010d\u016f a za\u0159\u00edzen\u00ed.<\/li>\n<\/ul>\n<p><\/p>\n<p>Tento soubor omezen\u00ed p\u0159edpokl\u00e1d\u00e1 jasn\u011b p\u0159ipraven\u00e9ho u\u017eivatele, nebo\u0165 je povoleno samostatn\u00e9 administrativn\u00ed \u0159\u00edzen\u00ed, a omezen\u00ed nesouvis\u00ed s blokov\u00e1n\u00edm jeho potenci\u00e1ln\u00edch \u010din\u016f, ale s vylou\u010den\u00edm mo\u017en\u00fdch chyb \u010di destruktivn\u00edho vlivu softwaru. Tedy intern\u00ed naru\u0161itel v modelu nen\u00ed.<\/p>\n<p><\/p>\n<p>P\u0159i hled\u00e1n\u00ed \u0159e\u0161en\u00ed jsme rychle opustili my\u0161lenku implementovat omezen\u00ed vno\u0159en\u00fdmi nebo dodate\u010dn\u00fdmi prost\u0159edky Windows, proto\u017ee je dost obt\u00ed\u017en\u00e9 efektivn\u011b omezit u\u017eivatele s administr\u00e1torsk\u00fdmi pr\u00e1vy, zat\u00edmco mu z\u016fstane mo\u017enost instalovat aplikace.<\/p>\n<p><\/p>\n<p>Dal\u0161\u00edm variantou \u0159e\u0161en\u00ed byla izolace pomoc\u00ed virtualizace. \u0160iroce zn\u00e1m\u00e9 n\u00e1stroje pro desktopovou virtualizaci (nap\u0159\u00edklad jako virtualbox) jsou \u0161patn\u011b p\u0159izp\u016fsobeny pro bezpe\u010dnostn\u00ed \u00fakoly a uveden\u00e1 omezen\u00ed bude nutn\u00e9 neust\u00e1le nastavovat u\u017eivatel\u016fm p\u0159ep\u00edn\u00e1n\u00edm nebo nastavov\u00e1n\u00edm vlastnost\u00ed hostitelsk\u00e9 virtu\u00e1ln\u00ed ma\u0161iny (d\u00e1le V\u041c), co\u017e zvy\u0161uje rizika chyb.<\/p>\n<p><\/p>\n<p>Z\u00e1rove\u0148 jsme m\u011bli zku\u0161enosti s pou\u017e\u00edv\u00e1n\u00edm Qubes jako u\u017eivatelsk\u00e9ho desktopov\u00e9ho syst\u00e9mu, ale byli jsme skepti\u010dt\u00ed ohledn\u011b stability pr\u00e1ce s hostitelsk\u00fdm Windows. Bylo rozhodnuto otestovat aktu\u00e1ln\u00ed verzi Qubes, proto\u017ee stanoven\u00e1 omezen\u00ed velmi dob\u0159e zapadaj\u00ed do paradigmatu tohoto syst\u00e9mu, zejm\u00e9na realizace \u0161ablon virtu\u00e1ln\u00edch stroj\u016f a vizu\u00e1ln\u00ed integrace. N\u00e1sleduj\u00edc\u00ed text se pokus\u00edm stru\u010dn\u011b p\u0159edstavit my\u0161lenky a n\u00e1stroje Qubes na p\u0159\u00edkladu vy\u0159e\u0161en\u00ed dan\u00e9ho \u00fakolu.<\/p>\n<p><\/p>\n<h2>Typy virtualizace Xen<\/h2>\n<p><\/p>\n<p>Qubes je postaven na hypervizoru Xen, kter\u00fd minimalizuje funkce spr\u00e1vy zdroj\u016f procesoru, pam\u011bti a virtu\u00e1ln\u00edch stroj\u016f. Ve\u0161ker\u00e1 dal\u0161\u00ed pr\u00e1ce se za\u0159\u00edzen\u00edmi je soust\u0159ed\u011bna v dom0 na b\u00e1zi j\u00e1dra Linuxu (v Qubes pro dom0 se pou\u017e\u00edv\u00e1 distribuce Fedora).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Pou\u017eit\u00ed QubesOS pro pr\u00e1ci s Windows 7\" src=\"\/wp-content\/uploads\/2020\/02\/d8bfeb6cc8daef0370c9d567486c0356.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Xen podporuje n\u011bkolik typ\u016f virtualizace (budu uv\u00e1d\u011bt p\u0159\u00edklady pro Intel architekturu, i kdy\u017e Xen podporuje i jin\u00e9):<\/p>\n<p><\/p>\n<ul>\n<li>paravirtualizace (PV) \u2014 re\u017eim virtualizace bez pou\u017eit\u00ed hardwarov\u00e9 podpory, p\u0159ipom\u00edn\u00e1 kontejnerovou virtualizaci, m\u016f\u017ee b\u00fdt pou\u017e\u00edv\u00e1n pro syst\u00e9my s p\u0159izp\u016fsoben\u00fdm j\u00e1drem (v takov\u00e9m re\u017eimu funguje dom0);<\/li>\n<li>pln\u00e1 virtualizace (HVM) \u2014 v tomto re\u017eimu se pro zdroje procesoru pou\u017e\u00edv\u00e1 hardwarov\u00e1 podpora, zat\u00edmco ve\u0161ker\u00e9 ostatn\u00ed za\u0159\u00edzen\u00ed jsou emulov\u00e1na prost\u0159ednictv\u00edm QEMU. Je to nejuniverz\u00e1ln\u011bj\u0161\u00ed zp\u016fsob spu\u0161t\u011bn\u00ed r\u016fzn\u00fdch opera\u010dn\u00edch syst\u00e9m\u016f;<\/li>\n<li>paravirtualizace hardwaru (PVH \u2014 ParaVirtualized Hardware) \u2014 re\u017eim virtualizace s vyu\u017eit\u00edm hardwarov\u00e9 podpory, kdy j\u00e1dro hostitelsk\u00e9ho syst\u00e9mu pou\u017e\u00edv\u00e1 ovlada\u010de upraven\u00e9 pro specifikace hypervizoru (nap\u0159\u00edklad sd\u00edlenou pam\u011b\u0165), co\u017e eliminuje pot\u0159ebu emulace QEMU a zvy\u0161uje v\u00fdkon vstupu a v\u00fdstupu. J\u00e1dro Linuxu od verze 4.11 m\u016f\u017ee fungovat v tomto re\u017eimu.<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Pou\u017eit\u00ed QubesOS pro pr\u00e1ci s Windows 7\" src=\"\/wp-content\/uploads\/2020\/02\/ffafc6a75aa9248659848c4bf08956e1.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Od verze Qubes 4.0 se z bezpe\u010dnostn\u00edch d\u016fvod\u016f upou\u0161t\u00ed od vyu\u017e\u00edv\u00e1n\u00ed re\u017eimu paravirtualizace (mimo jin\u00e9 kv\u016fli zn\u00e1m\u00fdm zranitelnostem architektury Intel, kter\u00e9 jsou z\u010d\u00e1sti eliminov\u00e1ny pou\u017eit\u00edm pln\u00e9 virtualizace), standardn\u011b se pou\u017e\u00edv\u00e1 re\u017eim PVH.<\/p>\n<p><\/p>\n<p>P\u0159i pou\u017eit\u00ed emulace (re\u017eim HVM) se spu\u0161t\u011bn\u00ed QEMU prov\u00e1d\u00ed v izolovan\u00e9 VM zvan\u00e9 stubdomain, \u010d\u00edm\u017e se sni\u017euj\u00ed rizika zneu\u017eit\u00ed potenci\u00e1ln\u00edch chyb v implementaci (projekt QEMU obsahuje mnoho k\u00f3du, v\u010detn\u011b pro kompatibilitu).<br \/>\nTakov\u00fd re\u017eim by se v na\u0161em p\u0159\u00edpad\u011b m\u011bl pou\u017e\u00edt pro Windows.<\/p>\n<p><\/p>\n<h2>Slu\u017eebn\u00ed virtu\u00e1ln\u00ed stroje<\/h2>\n<p><\/p>\n<p>V architektu\u0159e bezpe\u010dnosti Qubes je jednou z kl\u00ed\u010dov\u00fdch funkc\u00ed hypervizora p\u0159ed\u00e1v\u00e1n\u00ed PCI za\u0159\u00edzen\u00ed do hostitelsk\u00e9ho prost\u0159ed\u00ed. Vylou\u010den\u00ed hardwaru umo\u017e\u0148uje izolovat hostitelskou \u010d\u00e1st syst\u00e9mu od extern\u00edch \u00fatok\u016f. Xen to podporuje pro re\u017eimy PV a HVM, p\u0159i\u010dem\u017e ve druh\u00e9m p\u0159\u00edpad\u011b je vy\u017eadov\u00e1na podpora IOMMU (Intel VT-d) \u2014 hardwarov\u00e9 \u0159\u00edzen\u00ed pam\u011bti pro virtualizovan\u00e1 za\u0159\u00edzen\u00ed.<\/p>\n<p><\/p>\n<p>Takto se vytv\u00e1\u0159\u00ed n\u011bkolik syst\u00e9mov\u00fdch virtu\u00e1ln\u00edch stroj\u016f:<\/p>\n<p><\/p>\n<ul>\n<li>sys-net, kter\u00fd p\u0159eb\u00edr\u00e1 s\u00ed\u0165ov\u00e1 za\u0159\u00edzen\u00ed a kter\u00fd se pou\u017e\u00edv\u00e1 jako most pro dal\u0161\u00ed VM, nap\u0159\u00edklad realizuj\u00edc\u00ed funkce firewallu nebo klienta VPN;<\/li>\n<li>sys-usb, kter\u00fd p\u0159eb\u00edr\u00e1 USB a dal\u0161\u00ed ovlada\u010de perifern\u00edch za\u0159\u00edzen\u00ed;<\/li>\n<li>sys-firewall, kter\u00fd nepou\u017e\u00edv\u00e1 za\u0159\u00edzen\u00ed, ale funguje jako firewall pro p\u0159ipojen\u00e9 VM.<\/li>\n<\/ul>\n<p><\/p>\n<p>Pro pr\u00e1ci s USB za\u0159\u00edzen\u00edmi se pou\u017e\u00edvaj\u00ed proxy slu\u017eby, kter\u00e9 zaji\u0161\u0165uj\u00ed mimo jin\u00e9:<\/p>\n<p><\/p>\n<ul>\n<li>pro t\u0159\u00eddu za\u0159\u00edzen\u00ed HID (human interface device) p\u0159enos p\u0159\u00edkaz\u016f do dom0;<\/li>\n<li>pro p\u0159enosn\u00e9 disky p\u0159esm\u011brov\u00e1n\u00ed svazk\u016f za\u0159\u00edzen\u00ed do dal\u0161\u00edch VM (s v\u00fdjimkou dom0);<\/li>\n<li>p\u0159esm\u011brov\u00e1n\u00ed p\u0159\u00edmo USB za\u0159\u00edzen\u00ed (pou\u017e\u00edv\u00e1 se USBIP a integra\u010dn\u00ed n\u00e1stroje).<\/li>\n<\/ul>\n<p><\/p>\n<p>V takov\u00e9 konfiguraci m\u016f\u017ee \u00fasp\u011b\u0161n\u00fd \u00fatok p\u0159es s\u00ed\u0165ov\u00fd z\u00e1sobn\u00edk nebo p\u0159ipojen\u00e1 za\u0159\u00edzen\u00ed v\u00e9st k kompromitaci pouze spu\u0161t\u011bn\u00e9 slu\u017eebn\u00ed VM, nikoli cel\u00e9 syst\u00e9mu. A po restartu slu\u017eebn\u00ed VM se na\u010dte v p\u016fvodn\u00edm stavu.<\/p>\n<p><\/p>\n<h2>N\u00e1stroje pro integraci VM<\/h2>\n<p><\/p>\n<p>Existuje n\u011bkolik zp\u016fsob\u016f, jak interagovat s pracovn\u00ed plochou virtu\u00e1ln\u00edho stroje \u2014 instalace aplikac\u00ed do hostitelsk\u00e9ho syst\u00e9mu nebo emulace videa pomoc\u00ed virtualiza\u010dn\u00edch prost\u0159edk\u016f. Jako hostitelsk\u00e9 aplikace mohou fungovat r\u016fzn\u00e9 univerz\u00e1ln\u00ed prost\u0159edky pro vzd\u00e1len\u00fd p\u0159\u00edstup (RDP, VNC, Spice atd.) nebo p\u0159izp\u016fsoben\u00e9 konkr\u00e9tn\u00edm hypervizoru (takov\u00e9to n\u00e1stroje obvykle naz\u00fdv\u00e1me hostitelsk\u00fdmi utilitami). M\u016f\u017ee b\u00fdt tak\u00e9 pou\u017eit sm\u00ed\u0161en\u00fd p\u0159\u00edstup, kdy hypervizor emuluje vstup-v\u00fdstup pro hostitelsk\u00fd syst\u00e9m a venku poskytuje mo\u017enost pou\u017e\u00edvat protokol kombinuj\u00edc\u00ed vstup-v\u00fdstup, nap\u0159\u00edklad jako u Spice. V tomto p\u0159\u00edpad\u011b vzd\u00e1len\u00e9 p\u0159\u00edstupov\u00e9 n\u00e1stroje obvykle optimalizuj\u00ed obraz, proto\u017ee jsou navr\u017eeny pro pr\u00e1ci p\u0159es s\u00ed\u0165, co\u017e negativn\u011b ovliv\u0148uje kvalitu obrazu.<\/p>\n<p><\/p>\n<p>Qubes nab\u00edz\u00ed vlastn\u00ed prost\u0159edky pro integraci VM. P\u0159edev\u0161\u00edm je to grafick\u00fd subsyst\u00e9m \u2014 okna z r\u016fzn\u00fdch VM se zobrazuj\u00ed na jedin\u00e9 pracovn\u00ed plo\u0161e s vlastn\u00edm barevn\u00fdm r\u00e1mov\u00e1n\u00edm. Obecn\u011b jsou prost\u0159edky integrace zalo\u017eeny na mo\u017enostech hypervizoru \u2014 sd\u00edlen\u00e9 pam\u011bti (Xen grant table), prost\u0159edc\u00edch notifikace (Xen event channel), sd\u00edlen\u00e9m \u00falo\u017ei\u0161ti xenstore a komunika\u010dn\u00edm protokolu vchan. Pomoc\u00ed nich se realizuj\u00ed z\u00e1kladn\u00ed komponenty qrexec a qubes-rpc, a aplika\u010dn\u00ed slu\u017eby \u2014 p\u0159esm\u011brov\u00e1n\u00ed zvuku nebo USB, p\u0159enos soubor\u016f nebo obsahu schr\u00e1nky, vykon\u00e1v\u00e1n\u00ed p\u0159\u00edkaz\u016f a spou\u0161t\u011bn\u00ed aplikac\u00ed. Existuje mo\u017enost nastavovat politiky, kter\u00e9 omezuj\u00ed dostupn\u00e9 slu\u017eby na VM. Na obr\u00e1zku n\u00ed\u017ee je p\u0159\u00edklad postupu inicializace interakce dvou VM.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Pou\u017eit\u00ed QubesOS pro pr\u00e1ci s Windows 7\" src=\"\/wp-content\/uploads\/2020\/02\/eb0706697196168d2d50a90e25090497.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Takto prob\u00edh\u00e1 pr\u00e1ce ve VM bez pou\u017eit\u00ed s\u00edt\u011b, co\u017e umo\u017e\u0148uje pln\u011b vyu\u017e\u00edvat autonomn\u00ed VM k vyhnut\u00ed se \u00faniku informac\u00ed. Nap\u0159\u00edklad t\u00edmto zp\u016fsobem je realizov\u00e1no odd\u011blen\u00ed kryptografick\u00fdch operac\u00ed (PGP\/SSH), kdy se soukrom\u00e9 kl\u00ed\u010de pou\u017e\u00edvaj\u00ed v izolovan\u00fdch VM a nep\u0159esahuj\u00ed jejich hranice.<\/p>\n<p><\/p>\n<h2>\u0160ablony, aplikace a jednor\u00e1zov\u00e9 VM<\/h2>\n<p><\/p>\n<p>V\u0161echny \u010dinnosti u\u017eivatele v Qubes prob\u00edhaj\u00ed ve virtu\u00e1ln\u00edch stroj\u00edch. Hlavn\u00ed hostitelsk\u00fd syst\u00e9m slou\u017e\u00ed k \u0159\u00edzen\u00ed jejich \u010dinnosti a vizualizaci. Opera\u010dn\u00ed syst\u00e9m se instaluje spolu se z\u00e1kladn\u00edm souborem virtu\u00e1ln\u00edch stroj\u016f na z\u00e1klad\u011b \u0161ablon (TemplateVM). Takov\u00e1 \u0161ablona p\u0159edstavuje Linux VM zalo\u017eenou na distribuci Fedora nebo Debian, se nainstalovan\u00fdmi a nakonfigurovan\u00fdmi prost\u0159edky integrace, vyhrazen\u00fdmi syst\u00e9mov\u00fdmi a u\u017eivatelsk\u00fdmi odd\u00edly. Instalace a aktualizace softwaru se prov\u00e1d\u00ed standardn\u00edm spr\u00e1vcem bal\u00ed\u010dk\u016f (dnf nebo apt) z nakonfigurovan\u00fdch repozit\u00e1\u0159\u016f s povinnou kontrolou digit\u00e1ln\u00edho podpisu (GnuPG). \u00da\u010delem takov\u00fdch VM je zajistit d\u016fv\u011bru k aplikativn\u00edm VM, kter\u00e9 na jejich z\u00e1klad\u011b b\u011b\u017e\u00ed.<\/p>\n<p><\/p>\n<p>Aplika\u010dn\u00ed VM (AppVM) p\u0159i startu pou\u017e\u00edv\u00e1 sn\u00edmek syst\u00e9mov\u00e9ho odd\u00edlu p\u0159\u00edslu\u0161n\u00e9 \u0161ablony VM, a po dokon\u010den\u00ed pr\u00e1ci tento sn\u00edmek odstran\u00ed bez zachov\u00e1n\u00ed zm\u011bn. Pot\u0159ebn\u00e1 u\u017eivatelsk\u00e1 data jsou ulo\u017eena v unik\u00e1tn\u00edm u\u017eivatelsk\u00e9m odd\u00edlu pro ka\u017edou aplika\u010dn\u00ed VM, kter\u00fd je p\u0159ipojen do dom\u00e1c\u00edho adres\u00e1\u0159e.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Pou\u017eit\u00ed QubesOS pro pr\u00e1ci s Windows 7\" src=\"\/wp-content\/uploads\/2020\/02\/604c4f94fdb9644b589f87104364dc20.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>U\u017eite\u010dn\u00e9 z hlediska bezpe\u010dnosti m\u016f\u017ee b\u00fdt pou\u017eit\u00ed jednor\u00e1zov\u00fdch VM (disposableVM). Takov\u00e1 VM se vytv\u00e1\u0159\u00ed na z\u00e1klad\u011b \u0161ablony v okam\u017eiku spu\u0161t\u011bn\u00ed a je spu\u0161t\u011bna s jedn\u00edm c\u00edlem - proveden\u00edm jedn\u00e9 aplikace, ukon\u010duj\u00edc\u00ed svou \u010dinnost po jej\u00edm zav\u0159en\u00ed. Jednor\u00e1zov\u00e9 VM mohou b\u00fdt pou\u017e\u00edv\u00e1ny pro otev\u00edr\u00e1n\u00ed podez\u0159el\u00fdch soubor\u016f, jejich\u017e obsah m\u016f\u017ee vy\u00fastit ve vyu\u017eit\u00ed zranitelnost\u00ed konkr\u00e9tn\u00edch aplikac\u00ed. Mo\u017enost spu\u0161t\u011bn\u00ed jednor\u00e1zov\u00e9 VM je integrov\u00e1na do spr\u00e1vce soubor\u016f (Nautilus) a po\u0161tovn\u00edho klienta (Thunderbird). <\/p>\n<p><\/p>\n<p>Windows VM m\u016f\u017ee b\u00fdt tak\u00e9 pou\u017eita k vytvo\u0159en\u00ed \u0161ablony a jednor\u00e1zov\u00e9 VM, pro to je u\u017eivatelsk\u00fd profil p\u0159enesen do samostatn\u00e9ho odd\u00edlu. V na\u0161\u00ed variant\u011b bude tato \u0161ablona pou\u017e\u00edv\u00e1na u\u017eivateli pro administrativn\u00ed \u00fakoly a instalaci aplikac\u00ed. Na z\u00e1klad\u011b \u0161ablony bude vytvo\u0159eno n\u011bkolik aplika\u010dn\u00edch VM - s omezen\u00fdm p\u0159\u00edstupem do s\u00edt\u011b (standardn\u00ed mo\u017enosti sys-firewall) a bez p\u0159\u00edstupu do s\u00edt\u011b v\u016fbec (ne vytv\u00e1\u0159\u00ed se virtu\u00e1ln\u00ed s\u00ed\u0165ov\u00e9 za\u0159\u00edzen\u00ed). Pro pr\u00e1ci v t\u011bchto VM budou dostupn\u00e9 v\u0161echny zm\u011bny a aplikace instalovan\u00e9 v \u0161ablon\u011b a i v p\u0159\u00edpad\u011b zaveden\u00ed program\u016f-zakl\u00e1dek jim nebude dostupn\u00fd s\u00ed\u0165ov\u00fd p\u0159\u00edstup pro kompromitaci.<\/p>\n<p><\/p>\n<h2>Boj za Windows<\/h2>\n<p><\/p>\n<p>Popisovan\u00e9 mo\u017enosti jsou z\u00e1kladem Qubes a funguj\u00ed pom\u011brn\u011b stabiln\u011b, probl\u00e9my za\u010d\u00ednaj\u00ed s Windows. Pro integraci Windows je nutn\u00e9 pou\u017e\u00edt sadu n\u00e1stroj\u016f Qubes Windows Tools (QWT), kter\u00e1 zahrnuje ovlada\u010de pro pr\u00e1ci s Xen, ovlada\u010d qvideo a sadu utilit pro v\u00fdm\u011bnu informac\u00ed (p\u0159enos soubor\u016f, clipboard). Proces instalace a nastaven\u00ed je podrobn\u011b zdokumentov\u00e1n na webu projektu, proto se pod\u011bl\u00edme o na\u0161e zku\u0161enosti.<\/p>\n<p><\/p>\n<p>Hlavn\u00ed probl\u00e9m spo\u010d\u00edv\u00e1 v podstat\u011b v absenci podpory vyvinut\u00e9ho n\u00e1stroje. Kl\u00ed\u010dov\u00ed v\u00fdvoj\u00e1\u0159i (QWT) jsou z\u0159ejm\u011b nedostupn\u00ed a projekt integrace s Windows \u010dek\u00e1 na hlavn\u00edho v\u00fdvoj\u00e1\u0159e. Proto bylo nejprve nutn\u00e9 zhodnotit funk\u010dnost a z\u00edskat p\u0159edstavu o mo\u017enosti jej\u00ed samostatn\u00e9 podpory v p\u0159\u00edpad\u011b pot\u0159eby. Nejn\u00e1ro\u010dn\u011bj\u0161\u00ed pro v\u00fdvoj a lad\u011bn\u00ed je grafick\u00fd ovlada\u010d, kter\u00fd emuluje grafickou kartu a displej pro vytv\u00e1\u0159en\u00ed obraz\u016f ve sd\u00edlen\u00e9 pam\u011bti, co\u017e umo\u017e\u0148uje zobrazit cel\u00fd pracovn\u00ed st\u016fl nebo p\u0159\u00edmo okno aplikace v okn\u011b hostitelsk\u00e9ho syst\u00e9mu. B\u011bhem anal\u00fdzy \u010dinnosti ovlada\u010de jsme upravili k\u00f3d pro kompilaci v prost\u0159ed\u00ed Linux a vypracovali sch\u00e9ma lad\u011bn\u00ed mezi dv\u011bma hostovan\u00fdmi syst\u00e9my Windows. V r\u00e1mci kroskompilace jsme provedli n\u011bkolik usnad\u0148uj\u00edc\u00edch zm\u011bn, zejm\u00e9na co se t\u00fd\u010de \"tich\u00e9\" instalace utilit, a odstranili jsme ru\u0161ivou degradaci v\u00fdkonu p\u0159i dlouh\u00e9m provozu ve VM. V\u00fdsledky na\u0161\u00ed pr\u00e1ce jsme sepsali do samostatn\u00e9ho. <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/tabit-pro\/qwt-crossbuild\">repozit\u00e1\u0159e<\/a><\/noindex>, \u010d\u00edm\u017e na chv\u00edli <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/QubesOS\/qubes-issues\/issues\/5065\">inspirovali<\/a><\/noindex> vedouc\u00edho v\u00fdvoj\u00e1\u0159e Qubes.<\/p>\n<p><\/p>\n<p>Nejkriti\u010dt\u011bj\u0161\u00edm krokem z pohledu stability hostitelsk\u00e9ho syst\u00e9mu je spu\u0161t\u011bn\u00ed Windows, zde se m\u016f\u017ee objevit zn\u00e1m\u00e1 modr\u00e1 obrazovka (nebo ji dokonce ani nevid\u011bt). Pro v\u011bt\u0161inu identifikovan\u00fdch chyb byly nalezeny r\u016fzn\u00e9 obchvaty \u2014 odm\u00edtnut\u00ed ovlada\u010d\u016f Xen blokov\u00fdch za\u0159\u00edzen\u00ed, vypnut\u00ed vyva\u017eov\u00e1n\u00ed pam\u011bti VM, fixace s\u00ed\u0165ov\u00fdch nastaven\u00ed a minimalizace po\u010dtu jader. Na\u0161e sestaven\u00ed hostitelsk\u00fdch prost\u0159edk\u016f se instaluje a funguje na pln\u011b aktualizovan\u00fdch Windows 7 a Windows 10 (s v\u00fdjimkou qvideo).<\/p>\n<p><\/p>\n<p>P\u0159i p\u0159echodu z re\u00e1ln\u00e9ho prost\u0159ed\u00ed do virtu\u00e1ln\u00edho se objevuje probl\u00e9m s aktivac\u00ed Windows v p\u0159\u00edpad\u011b pou\u017eit\u00ed p\u0159edinstalovan\u00fdch OEM verz\u00ed. Tyto syst\u00e9my vyu\u017e\u00edvaj\u00ed aktivaci zalo\u017eenou na licenc\u00edch, kter\u00e9 jsou zaps\u00e1ny v UEFI za\u0159\u00edzen\u00ed. Pro spr\u00e1vn\u00e9 fungov\u00e1n\u00ed aktivace je nutn\u00e9 p\u0159ev\u00e9st do hostovac\u00edho syst\u00e9mu jeden z odd\u00edl\u016f ACPI hostitelsk\u00e9ho syst\u00e9mu v celku (SLIC tabulka) a m\u00edrn\u011b upravit dal\u0161\u00ed, zapisov\u00e1n\u00edm v\u00fdrobce. Xen umo\u017e\u0148uje nakonfigurovat obsah ACPI dodate\u010dn\u00fdch tabulek, ale bez modifikace z\u00e1kladn\u00edch. S \u0159e\u0161en\u00edm pomohl patch od podobn\u00e9ho projektu OpenXT, kter\u00fd byl p\u0159izp\u016fsoben pro Qubes. Opravy se uk\u00e1zaly jako u\u017eite\u010dn\u00e9 nejen pro n\u00e1s a byly p\u0159eneseny do hlavn\u00edho repozit\u00e1\u0159e Qubes a knihovny Libvirt.<\/p>\n<p><\/p>\n<p>Mezi z\u0159ejm\u00e9 nedostatky integra\u010dn\u00edch prost\u0159edk\u016f Windows pat\u0159\u00ed absence podpory zvuku, USB za\u0159\u00edzen\u00ed a slo\u017eitost pr\u00e1ce s m\u00e9di\u00ed, nebo\u0165 zde chyb\u00ed hardwarov\u00e1 podpora GPU. Ale uveden\u00e9 nebr\u00e1n\u00ed pou\u017e\u00edv\u00e1n\u00ed VM pro pr\u00e1ci s kancel\u00e1\u0159sk\u00fdmi dokumenty a nebr\u00e1n\u00ed spu\u0161t\u011bn\u00ed specifick\u00fdch firemn\u00edch aplikac\u00ed.<\/p>\n<p><\/p>\n<p>Po\u017eadavek na p\u0159epnut\u00ed do re\u017eimu offline nebo s omezenou s\u00edt\u00ed po vytvo\u0159en\u00ed \u0161ablony Windows VM byl spln\u011bn vytvo\u0159en\u00edm p\u0159\u00edslu\u0161n\u00fdch konfigurac\u00ed aplikovan\u00fdch VM, a mo\u017enost selektivn\u00edho p\u0159ipojen\u00ed removable m\u00e9di\u00ed byla rovn\u011b\u017e \u0159e\u0161ena standardn\u00edmi prost\u0159edky OS \u2014 p\u0159i p\u0159ipojen\u00ed jsou k dispozici v syst\u00e9mov\u00e9m VM sys-usb, odkud mohou b\u00fdt \"p\u0159esm\u011brov\u00e1ny\" k po\u017eadovan\u00e9mu VM. U\u017eivatelsk\u00e1 plocha vypad\u00e1 p\u0159ibli\u017en\u011b takto.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Pou\u017eit\u00ed QubesOS pro pr\u00e1ci s Windows 7\" src=\"\/wp-content\/uploads\/2020\/02\/ed003174a07a412071095cda51f7c2cb.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Kone\u010dn\u00e1 verze syst\u00e9mu byla u\u017eivateli p\u0159ijata pozitivn\u011b (jak to komplexn\u00ed \u0159e\u0161en\u00ed dovoluje) a standardn\u00ed prost\u0159edky syst\u00e9mu umo\u017enily roz\u0161\u00ed\u0159it pou\u017eit\u00ed na mobiln\u00ed pracovn\u00ed m\u00edsto u\u017eivatele s p\u0159\u00edstupem prost\u0159ednictv\u00edm VPN.<\/p>\n<p><\/p>\n<h2>Na z\u00e1v\u011br<\/h2>\n<p><\/p>\n<p>Virtualizace obecn\u011b sni\u017euje rizika spojen\u00e1 s pou\u017eit\u00edm Windows syst\u00e9m\u016f, kter\u00e9 jsou ponech\u00e1ny bez podpory \u2014 nenut\u00ed zaji\u0161t\u011bn\u00ed kompatibility s nov\u00fdmi hardwarov\u00fdmi prost\u0159edky, umo\u017e\u0148uje vylou\u010den\u00ed nebo kontrolu p\u0159\u00edstupu k syst\u00e9mu p\u0159es s\u00ed\u0165 nebo prost\u0159ednictv\u00edm p\u0159ipojen\u00fdch za\u0159\u00edzen\u00ed, a umo\u017e\u0148uje realizaci prost\u0159ed\u00ed pro jednor\u00e1zov\u00e9 spu\u0161t\u011bn\u00ed.<\/p>\n<p><\/p>\n<p>OS Qubes, zalo\u017een\u00e1 na my\u0161lence izolace prost\u0159ednictv\u00edm virtualizace, pom\u00e1h\u00e1 vyu\u017e\u00edvat tyto a dal\u0161\u00ed mechanismy pro zaji\u0161t\u011bn\u00ed bezpe\u010dnosti. Z pohledu mnoh\u00fdch je Qubes p\u0159edev\u0161\u00edm snahou o anonymitu, ale je to u\u017eite\u010dn\u00fd syst\u00e9m jak pro in\u017een\u00fdry, kte\u0159\u00ed \u010dasto spojuj\u00ed projekty, infrastruktury a tajn\u00e9 p\u0159\u00edstupy k nim, tak pro bezpe\u010dnostn\u00ed v\u00fdzkumn\u00edky. Odd\u011blen\u00ed aplikac\u00ed, dat a formalizace jejich interakce jsou po\u010d\u00e1te\u010dn\u00edmi kroky anal\u00fdzy hrozeb a navrhov\u00e1n\u00ed ochrann\u00e9ho syst\u00e9mu. Takov\u00e9 rozd\u011blen\u00ed pom\u00e1h\u00e1 strukturovat informace a sni\u017eovat pravd\u011bpodobnost chyby zp\u016fsoben\u00e9 lidsk\u00fdm faktorem \u2014 sp\u011bchem, \u00fanavou atd.<\/p>\n<p><\/p>\n<p>V sou\u010dasnosti se hlavn\u00ed d\u016fraz v rozvoji klade na roz\u0161\u00ed\u0159en\u00ed funk\u010dnosti Linuxov\u00fdch prost\u0159ed\u00ed. P\u0159ipravuje se k vyd\u00e1n\u00ed verze 4.1, kter\u00e1 bude zalo\u017eena na Fedo\u0159e 31 a zahrnuje aktu\u00e1ln\u00ed verze kl\u00ed\u010dov\u00fdch komponent\u016f Xen a Libvirt. Je t\u0159eba poznamenat, \u017ee Qubes vytv\u00e1\u0159ej\u00ed profesion\u00e1lov\u00e9 v oblasti informa\u010dn\u00ed bezpe\u010dnosti, kte\u0159\u00ed v\u017edy rychle vyd\u00e1vaj\u00ed aktualizace v p\u0159\u00edpad\u011b zji\u0161t\u011bn\u00ed nov\u00fdch hrozeb nebo chyb.<\/p>\n<p><\/p>\n<h2>Pozn\u00e1mka na z\u00e1v\u011br<\/h2>\n<p><\/p>\n<p>Jedna z na\u0161ich vyv\u00edjen\u00fdch experiment\u00e1ln\u00edch funkc\u00ed umo\u017e\u0148uje vytv\u00e1\u0159en\u00ed VM s podporou hostitelsk\u00e9ho p\u0159\u00edstupu k GPU na z\u00e1klad\u011b technologie Intel GVT-g, co\u017e umo\u017e\u0148uje vyu\u017e\u00edvat mo\u017enosti grafick\u00e9ho adapt\u00e9ru a zna\u010dn\u011b roz\u0161\u00ed\u0159it oblast pou\u017eit\u00ed syst\u00e9mu. V dob\u011b psan\u00ed tohoto \u010dl\u00e1nku tato funkce funguje pro testovac\u00ed sestaven\u00ed Qubes 4.1 a je dostupn\u00e1 na <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/tabit-pro\/tabit-qubes-repo\">github<\/a><\/noindex>.<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/488234\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0430 \u0425\u0430\u0431\u0440\u0435 \u043d\u0435 \u0442\u0430\u043a \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u0435\u0439, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Qubes, \u0430 \u0442\u0435, \u0447\u0442\u043e \u044f \u0432\u0438\u0434\u0435\u043b \u043c\u0430\u043b\u043e \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u044b\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u041f\u043e\u0434 \u043a\u0430\u0442\u043e\u043c \u043d\u0430\u0434\u0435\u044e\u0441\u044c \u044d\u0442\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Qubes \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b (\u043e\u0442) \u0441\u0440\u0435\u0434\u044b Windows \u0438, \u043f\u043e\u043f\u0443\u0442\u043d\u043e, \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0440\u0443\u0441\u0441\u043a\u043e\u0433\u043e\u0432\u043e\u0440\u044f\u0449\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041f\u043e\u0447\u0435\u043c\u0443 Qubes? \u0418\u0441\u0442\u043e\u0440\u0438\u044f \u0441 \u043e\u043a\u043e\u043d\u0447\u0430\u043d\u0438\u0435\u043c \u0442\u0435\u0445\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Windows 7 \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0442\u0440\u0435\u0432\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41812,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41811","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0430 \u0425\u0430\u0431\u0440\u0435 \u043d\u0435 \u0442\u0430\u043a \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u0435\u0439, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Qubes, \u0430 \u0442\u0435, \u0447\u0442\u043e \u044f \u0432\u0438\u0434\u0435\u043b \u043c\u0430\u043b\u043e \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u044b\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/ispolzovanie-qubesos-dlya-raboty-s-windows-7\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 QubesOS \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 Windows 7 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0430 \u0425\u0430\u0431\u0440\u0435 \u043d\u0435 \u0442\u0430\u043a \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u0435\u0439, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Qubes, \u0430 \u0442\u0435, \u0447\u0442\u043e \u044f \u0432\u0438\u0434\u0435\u043b \u043c\u0430\u043b\u043e \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u044b\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/ispolzovanie-qubesos-dlya-raboty-s-windows-7\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-16T17:45:57+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-16T17:45:57+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pou\u017eit\u00ed QubesOS pro pr\u00e1ci s Windows 7 | ProHoster","description":"Na Habr.com nen\u00ed p\u0159\u00edli\u0161 mnoho \u010dl\u00e1nk\u016f v\u011bnovan\u00fdch opera\u010dn\u00edmu syst\u00e9mu Qubes a ty, kter\u00e9 jsem vid\u011bl, m\u00e1lo popisuj\u00ed zku\u0161enosti s jeho pou\u017eit\u00edm.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/ispolzovanie-qubesos-dlya-raboty-s-windows-7","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 QubesOS \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 Windows 7 | ProHoster","og:description":"\u041d\u0430 \u0425\u0430\u0431\u0440\u0435 \u043d\u0435 \u0442\u0430\u043a \u043c\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u0442\u0435\u0439, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Qubes, \u0430 \u0442\u0435, \u0447\u0442\u043e \u044f \u0432\u0438\u0434\u0435\u043b \u043c\u0430\u043b\u043e \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u044b\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/cs\/blog\/ispolzovanie-qubesos-dlya-raboty-s-windows-7","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-16T17:45:57+00:00","article:modified_time":"2020-02-16T17:45:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41811","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:10:22","updated":"2022-10-05 20:31:01","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/41811","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=41811"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/41811\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/41812"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=41811"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=41811"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=41811"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}