Tsis muaj ntau cov ntawv ntawm Habré mob siab rau Qubes operating system, thiab cov uas kuv tau pom tsis piav txog ntau yam ntawm kev siv nws. Hauv qab qhov kev txiav, Kuv vam tias yuav kho qhov no siv qhov piv txwv ntawm kev siv Qubes raws li kev tiv thaiv (tawm tsam) ib puag ncig Windows thiab, tib lub sijhawm, kwv yees tus naj npawb ntawm cov neeg siv lus Lavxias ntawm lub kaw lus.
Vim li cas Qubes?
Zaj dab neeg ntawm qhov kawg ntawm kev txhawb nqa rau Windows 7 thiab kev ntxhov siab ntau ntxiv ntawm cov neeg siv coj mus rau qhov xav tau los npaj cov haujlwm ntawm OS no, suav nrog cov hauv qab no:
- xyuas kom muaj kev siv tag nrho Windows 7 nrog lub peev xwm rau tus neeg siv los nruab cov kev hloov tshiab thiab ntau yam kev siv (nrog rau hauv Internet);
- ua kom tiav lossis xaiv tsis suav nrog kev sib tham hauv network raws li cov xwm txheej (kev ua haujlwm tsis raug cai thiab cov qauv lim tsheb);
- muab lub peev xwm los xaiv txuas cov xov xwm tshem tawm thiab cov khoom siv.
Cov txheej txheem txwv no presupposes tus neeg siv tau npaj kom meej, txij li kev tswj hwm ywj pheej tau tso cai, thiab cov kev txwv tsis cuam tshuam txog kev thaiv nws cov peev txheej, tab sis rau kev cais tawm ntawm qhov yuam kev lossis cuam tshuam software cuam tshuam. Cov. Tsis muaj tus neeg ua txhaum sab hauv hauv tus qauv.
Hauv peb txoj kev tshawb nrhiav kev daws teeb meem, peb sai sai tso tseg lub tswv yim ntawm kev siv cov kev txwv tsis pub siv cov cuab yeej built-in lossis ntxiv Windows, vim nws nyuaj heev rau kev txwv tsis pub tus neeg siv nrog cov cai tswj hwm, ua rau nws muaj peev xwm txhim kho cov ntawv thov.
Cov kev daws teeb meem tom ntej yog kev sib cais siv virtualization. Cov cuab yeej paub zoo rau desktop virtualization (piv txwv li, virtualbox) tsis zoo rau kev daws teeb meem kev nyab xeeb thiab cov kev txwv uas tau teev tseg yuav tsum tau ua los ntawm tus neeg siv tas li hloov lossis kho cov khoom ntawm cov qhua virtual tshuab (tom qab no xa mus rau raws li VM), uas ua rau muaj kev pheej hmoo ntawm kev ua yuam kev.
Tib lub sijhawm, peb muaj kev paub siv Qubes ua tus neeg siv lub desktop, tab sis muaj kev tsis ntseeg txog kev ruaj ntseg ntawm kev ua haujlwm nrog qhua Windows. Nws tau txiav txim siab los tshuaj xyuas qhov tam sim no version ntawm Qubes, txij li cov kev txwv tau hais kom haum zoo heev rau hauv lub ntsiab lus ntawm qhov system no, tshwj xeeb tshaj yog kev siv cov qauv siv tshuab virtual thiab kev sib koom ua ke. Tom ntej no, kuv yuav sim luv luv tham txog cov tswv yim thiab cov cuab yeej ntawm Qubes, siv cov piv txwv ntawm kev daws qhov teeb meem.
Hom Xen virtualization
Qubes yog raws li Xen hypervisor, uas txo qis kev ua haujlwm ntawm kev tswj hwm cov peev txheej processor, nco thiab tshuab virtual. Tag nrho lwm yam kev ua haujlwm nrog cov khoom siv yog tsom rau hauv dom0 raws li Linux ntsiav (Qubes rau dom0 siv Fedora faib).
Xen txhawb nqa ntau hom virtualization (Kuv yuav muab piv txwv rau Intel architecture, txawm hais tias Xen txhawb lwm tus):
- paravirtualization (PV) - hom virtualization yam tsis muaj kev siv kho vajtse txhawb nqa, nco txog lub thawv virtualization, tuaj yeem siv rau cov tshuab nrog cov kernel hloov kho (dom0 ua haujlwm hauv hom no);
- tag nrho virtualization (HVM) - hauv hom no, kev txhawb nqa kho vajtse yog siv rau cov peev txheej processor, thiab tag nrho lwm yam khoom siv tau ua raws li QEMU. Qhov no yog txoj hauv kev zoo tshaj plaws los khiav ntau yam kev khiav haujlwm;
- paravirtualization ntawm hardware (PVH - ParaVirtualized Hardware) - hom virtualization siv kho vajtse txhawb nqa thaum, ua haujlwm nrog kho vajtse, cov qhua system kernel siv cov tsav tsheb yoog raws li lub peev xwm ntawm hypervisor (piv txwv li, sib koom nco), tshem tawm qhov xav tau ntawm QEMU emulation. thiab nce I/O kev ua tau zoo. Lub Linux ntsiav pib los ntawm 4.11 tuaj yeem ua haujlwm hauv hom no.
Pib nrog Qubes 4.0, rau kev nyab xeeb vim li cas, kev siv hom paravirtualization raug tso tseg (suav nrog vim paub qhov tsis zoo hauv Intel architecture, uas yog ib feem txo qis los ntawm kev siv tag nrho virtualization); PVH hom yog siv los ntawm lub neej ntawd.
Thaum siv emulation (HVM hom), QEMU tau tsim nyob rau hauv ib qho kev cais VM hu ua stubdomain, yog li txo qhov kev pheej hmoo ntawm kev siv cov kev ua yuam kev hauv kev siv (QEMU project muaj ntau txoj cai, suav nrog rau kev sib raug zoo).
Hauv peb qhov xwm txheej, hom no yuav tsum siv rau Windows.
Kev pabcuam virtual tshuab
Hauv Qubes kev ruaj ntseg architecture, ib qho ntawm cov peev txheej tseem ceeb ntawm tus neeg saib xyuas yog kev hloov pauv ntawm PCI li mus rau qhov chaw qhua. Kev cais tawm kho vajtse tso cai rau koj cais tus tswv tsev ntawm qhov system los ntawm kev tawm tsam sab nraud. Xen txhawb nqa qhov no rau PV thiab HVM hom, nyob rau hauv rooj plaub thib ob nws xav tau kev txhawb nqa rau IOMMU (Intel VT-d) - kev tswj hwm kho vajtse rau cov khoom siv virtualized.
Qhov no tsim ntau lub tshuab virtual tshuab:
- sys-net, uas cov khoom siv hauv network tau hloov pauv thiab siv los ua tus choj rau lwm tus VMs, piv txwv li, cov uas siv cov haujlwm ntawm firewall lossis VPN tus neeg siv khoom;
- sys-usb, uas USB thiab lwm yam khoom siv hluav taws xob tau hloov pauv;
- sys-firewall, uas tsis siv cov cuab yeej siv, tab sis ua haujlwm raws li firewall rau VMs txuas.
Txhawm rau ua haujlwm nrog USB li, cov kev pabcuam npe raug siv, uas muab, ntawm lwm yam:
- rau HID (tib neeg interface ntaus ntawv) ntaus ntawv hauv chav kawm, xa cov lus txib mus rau dom0;
- rau tshem tawm cov xov xwm, redirection ntawm cov khoom ntim rau lwm VMs (tshwj tsis yog rau dom0);
- redirecting ncaj qha mus rau ib tug USB ntaus ntawv (siv USBIP thiab integration cuab yeej).
Nyob rau hauv xws li ib tug configuration, ib tug muaj kev vam meej nres los ntawm lub network pawg los yog kev cob cog rua pab kiag li lawm yuav ua rau kom muaj kev sib haum xeeb ntawm tsuas yog khiav kev pab cuam VM, thiab tsis yog tag nrho cov system. Thiab tom qab rov pib qhov kev pabcuam VM, nws yuav raug thauj khoom hauv nws lub xeev qub.
VM integration tools
Muaj ntau txoj hauv kev los cuam tshuam nrog lub desktop ntawm lub tshuab virtual - txhim kho cov ntawv thov hauv cov qhua lossis ua yeeb yaj kiab siv cov cuab yeej virtualization. Cov ntawv thov qhua tuaj yeem yog ntau yam cuab yeej siv thoob ntiaj teb cov chaw taws teeb nkag (RDP, VNC, Spice, thiab lwm yam) lossis hloov mus rau ib tus neeg saib xyuas tshwj xeeb (cov cuab yeej no feem ntau hu ua qhua siv hluav taws xob). Ib qho kev xaiv sib xyaw kuj tuaj yeem siv tau, thaum tus hypervisor emulates I / O rau cov qhua tuaj noj mov, thiab sab nraud muab lub peev xwm los siv cov txheej txheem uas sib txuas I / O, piv txwv li, xws li Spice. Nyob rau tib lub sijhawm, cov cuab yeej nkag mus rau tej thaj chaw deb feem ntau ua kom zoo rau cov duab, vim lawv koom nrog kev ua haujlwm ntawm lub network, uas tsis muaj txiaj ntsig zoo rau cov duab zoo.
Qubes muab nws cov cuab yeej rau VM kev koom ua ke. Ua ntej ntawm tag nrho cov, qhov no yog ib tug graphics subsystem - qhov rais los ntawm txawv VMs yog tso tawm kom pom ntawm ib tug desktop nrog lawv tus kheej xim thav duab. Feem ntau, cov cuab yeej kev koom ua ke yog raws li lub peev xwm ntawm hypervisor - sib koom nco (Xen grant table), cov cuab yeej ceeb toom (Xen event channel), sib koom cia xenstore thiab vchan kev sib txuas lus raws tu qauv. Nrog lawv cov kev pab, cov khoom siv yooj yim qrexec thiab qubes-rpc, thiab cov kev pabcuam hauv daim ntawv thov raug siv - suab lossis USB redirection, hloov cov ntaub ntawv lossis cov ntawv teev cia, ua tiav cov lus txib thiab pib siv. Nws tuaj yeem tsim cov cai uas tso cai rau koj txwv cov kev pabcuam muaj nyob rau ntawm VM. Daim duab hauv qab no yog ib qho piv txwv ntawm cov txheej txheem rau kev pib sib cuam tshuam ntawm ob VMs.
Yog li, kev ua haujlwm hauv VM yog ua tiav yam tsis siv lub network, uas tso cai rau kev siv tag nrho ntawm VMs tswj hwm kom tsis txhob muaj cov ntaub ntawv tawm. Piv txwv li, qhov no yog li cas kev sib cais ntawm kev ua haujlwm cryptographic (PGP / SSH) yog siv, thaum tus yuam sij ntiag tug raug siv hauv VMs cais thiab tsis mus dhau lawv.
Templates, daim ntawv thov thiab ib zaug VMs
Txhua tus neeg siv ua haujlwm hauv Qubes yog ua tiav hauv cov tshuab virtual. Lub ntsiab host system yog siv los tswj thiab pom lawv. Lub OS tau nruab nrog rau cov txheej txheem ntawm template-based virtual machines (TemplateVM). Cov qauv no yog Linux VM raws li Fedora lossis Debian kev faib tawm, nrog cov cuab yeej kev sib koom ua ke tau teeb tsa thiab teeb tsa, thiab kev ua haujlwm siab thiab cov neeg siv khoom faib. Kev teeb tsa thiab hloov kho software yog ua los ntawm tus thawj tswj hwm pob txheej txheem (dnf lossis apt) los ntawm cov chaw khaws ntaub ntawv teeb tsa nrog qhov yuav tsum tau lees paub kos npe digital (GnuPG). Lub hom phiaj ntawm VMs no yog kom ntseeg tau tias kev ntseeg siab hauv daim ntawv thov VMs tau tsim los ntawm lawv lub hauv paus.
Thaum pib, ib daim ntawv thov VM (AppVM) siv lub snapshot ntawm qhov system muab faib ntawm cov VM template sib raug, thiab thaum ua tiav tshem tawm cov snapshot no yam tsis muaj kev hloov pauv. Cov ntaub ntawv xav tau los ntawm tus neeg siv tau muab tso rau hauv cov neeg siv muab faib tshwj xeeb rau txhua daim ntawv thov VM, uas tau muab tso rau hauv cov npe hauv tsev.
Siv cov pov tseg VMs (disposableVM) tuaj yeem pab tau los ntawm qhov pom kev ruaj ntseg. Xws li VM yog tsim los ntawm tus qauv thaum lub sijhawm pib thiab tau pib rau ib lub hom phiaj - txhawm rau ua tiav ib daim ntawv thov, ua tiav kev ua haujlwm tom qab nws raug kaw. Cov khoom pov tseg VMs tuaj yeem siv los qhib cov ntaub ntawv tsis txaus ntseeg uas nws cov ntsiab lus tuaj yeem ua rau muaj kev cuam tshuam ntawm cov ntawv thov tshwj xeeb. Lub peev xwm los khiav ib zaug VM tau koom ua ke rau hauv tus thawj tswj ntaub ntawv (Nautilus) thiab email tus thov kev pab (Thunderbird).
Windows VM kuj tuaj yeem siv los tsim cov qauv thiab VM ib zaug los ntawm kev txav tus neeg siv profile mus rau ib ntu. Nyob rau hauv peb version, xws li ib tug template yuav siv tau los ntawm cov neeg siv rau kev tswj cov dej num thiab daim ntawv thov installation. Raws li tus qauv, ntau daim ntawv thov VMs yuav raug tsim - nrog kev txwv tsis pub nkag mus rau lub network (tus qauv sys-firewall muaj peev xwm) thiab tsis muaj kev nkag mus rau lub network txhua qhov (ib qho khoom siv virtual tsis tsim). Txhua qhov kev hloov pauv thiab cov ntawv thov tau nruab rau hauv cov qauv yuav muaj los ua haujlwm hauv VMs, thiab txawm tias cov kev pabcuam bookmark tau qhia, lawv yuav tsis muaj kev nkag mus rau kev sib tham.
Sib ntaus rau Windows
Cov yam ntxwv tau piav qhia saum toj no yog lub hauv paus ntawm Qubes thiab ua haujlwm ruaj khov; cov teeb meem pib nrog Windows. Txhawm rau ua ke Windows, koj yuav tsum siv cov cuab yeej qhua Qubes Windows Cov cuab yeej (QWT), uas suav nrog cov tsav tsheb ua haujlwm nrog Xen, tus tsav tsheb qvideo thiab cov khoom siv hluav taws xob rau kev sib pauv ntaub ntawv (cov ntaub ntawv hloov chaw, ntawv teev cia). Cov txheej txheem kev teeb tsa thiab kev teeb tsa tau sau tseg hauv kev nthuav dav ntawm qhov project lub vev xaib, yog li peb yuav qhia peb cov kev paub dhau los.
Qhov nyuaj tseem ceeb yog qhov tsis muaj kev txhawb nqa rau cov cuab yeej tsim. Key Developers (QWT) zoo nkaus li tsis muaj thiab qhov kev sib koom ua ke Windows tab tom tos tus tsim tawm. Yog li ntawd, ua ntej ntawm tag nrho cov, nws yuav tsum tau soj ntsuam nws cov kev ua tau zoo thiab tsim kom muaj kev nkag siab txog qhov muaj peev xwm txhawb nws tus kheej, yog tias tsim nyog. Qhov nyuaj tshaj plaws rau kev txhim kho thiab kev debug yog tus tsav tsheb cov duab, uas ua raws li cov video adapter thiab tso tawm kom tsim tau cov duab hauv kev sib koom nco, tso cai rau koj los tso saib tag nrho lub desktop lossis daim ntawv thov qhov rai ncaj qha rau hauv qhov rais system qhov rais. Thaum lub sijhawm kev soj ntsuam ntawm tus neeg tsav tsheb ua haujlwm, peb tau hloov kho cov cai rau kev sib dhos hauv Linux ib puag ncig thiab ua haujlwm tawm tswv yim debugging ntawm ob lub Windows qhua. Nyob rau theem crossbuild, peb tau ua ntau yam kev hloov pauv uas yooj yim rau peb, feem ntau yog hais txog "tsim" kev teeb tsa ntawm cov khoom siv hluav taws xob, thiab tseem tshem tawm qhov cuam tshuam tsis zoo ntawm kev ua haujlwm thaum ua haujlwm hauv VM ntev. Peb tau nthuav tawm cov txiaj ntsig ntawm kev ua haujlwm nyob rau hauv ib qho cais , yog li tsis ntev Lead Qubes Developer.
Cov theem tseem ceeb tshaj plaws ntawm cov qhua kev ruaj ntseg yog qhov pib ntawm Windows, ntawm no koj tuaj yeem pom lub vijtsam xiav paub (lossis tsis pom nws). Rau feem ntau ntawm cov teeb meem raug txheeb xyuas, muaj ntau yam kev ua haujlwm - tshem tawm Xen thaiv cov cuab yeej tsav tsheb, cuam tshuam VM nco ntsuas, txhim kho network teeb tsa, thiab txo tus lej ntawm cov cores. Peb cov cuab yeej qhua tsim kev teeb tsa thiab khiav ntawm qhov hloov kho tshiab Windows 7 thiab Windows 10 (tshwj tsis yog qvideo).
Thaum tsiv los ntawm ib puag ncig tiag tiag mus rau ib qho virtual, ib qho teeb meem tshwm sim nrog kev ua kom lub Windows yog tias siv OEM versions ua ntej. Cov tshuab zoo li no siv ua kom ua raws li cov ntawv tso cai teev tseg hauv UEFI lub cuab yeej. Yuav kom ua tiav qhov kev ua kom raug, nws yog ib qho tsim nyog yuav tsum tau txhais ib qho ntawm tag nrho ACPI ntu ntawm lub party system (SLIC rooj) rau cov qhua system thiab kho me ntsis rau lwm tus, sau npe rau cov chaw tsim khoom. Xen tso cai rau koj hloov kho ACPI cov ntsiab lus ntawm cov ntxhuav ntxiv, tab sis tsis hloov cov ntsiab lus tseem ceeb. Ib thaj chaw los ntawm qhov project OpenXT zoo sib xws, uas tau hloov kho rau Qubes, tau pab daws qhov teeb meem. Cov kev kho zoo li muaj txiaj ntsig tsis yog rau peb nkaus xwb thiab tau muab txhais rau hauv lub ntsiab Qubes repository thiab Libvirt lub tsev qiv ntawv.
Qhov tsis zoo ntawm Windows kev koom ua ke cov cuab yeej suav nrog qhov tsis muaj kev txhawb nqa rau lub suab, USB li, thiab qhov nyuaj ntawm kev ua haujlwm nrog kev tshaj tawm, vim tias tsis muaj kev txhawb nqa kho vajtse rau GPU. Tab sis cov saum toj no tsis tiv thaiv kev siv VM rau kev ua haujlwm nrog cov ntaub ntawv hauv chaw ua haujlwm, thiab tsis tiv thaiv kev tshaj tawm cov ntawv thov kev lag luam tshwj xeeb.
Qhov yuav tsum tau hloov mus rau hom kev khiav hauj lwm yam tsis muaj lub network lossis nrog lub network txwv tom qab tsim lub Windows VM template tau ua tiav los ntawm kev tsim cov kev teeb tsa tsim nyog ntawm daim ntawv thov VMs, thiab muaj peev xwm xaiv kev sib txuas cov xov xwm tshem tawm kuj tau daws los ntawm cov cuab yeej OS txheem - thaum txuas nrog , lawv muaj nyob rau hauv qhov system VM sys-usb, los ntawm qhov chaw lawv tuaj yeem "xa" mus rau VM xav tau. Tus neeg siv lub desktop zoo li qhov no.
Qhov kawg version ntawm lub kaw lus tau zoo (raws li qhov kev daws teeb meem zoo tso cai) tau txais los ntawm cov neeg siv, thiab cov cuab yeej txheem ntawm lub kaw lus ua rau nws muaj peev xwm nthuav dav daim ntawv thov mus rau tus neeg siv lub chaw ua haujlwm mobile nrog kev nkag ntawm VPN.
Es tsis txhob ib tug xaus
Virtualization feem ntau tso cai rau koj los txo cov kev pheej hmoo ntawm kev siv Windows systems sab laug yam tsis muaj kev txhawb nqa - nws tsis yuam kev sib raug zoo nrog cov cuab yeej tshiab, nws tso cai rau koj tshem tawm lossis tswj kev nkag mus rau hauv lub network lossis los ntawm cov khoom siv sib txuas, thiab nws tso cai rau koj kom tshem tawm lossis tswj kev nkag mus rau lub kaw lus hauv lub network lossis los ntawm cov khoom siv sib txuas siv ib puag ncig tso tawm ib zaug.
Raws li lub tswv yim ntawm kev sib cais los ntawm kev siv virtualization, Qubes OS pab koj leverage cov no thiab lwm yam kev ruaj ntseg. Los ntawm sab nraud, ntau tus neeg pom Qubes feem ntau yog kev xav tsis qhia npe, tab sis nws yog ib qho tseem ceeb ntawm ob qho tib si rau engineers, uas feem ntau juggle tej yaam num, infrastructures, thiab secrets nkag mus rau lawv, thiab rau kev ruaj ntseg soj ntsuam. Kev sib cais ntawm daim ntawv thov, cov ntaub ntawv thiab formalization ntawm lawv cov kev sib raug zoo yog thawj kauj ruam ntawm kev hem thawj tsom xam thiab kev ruaj ntseg system tsim. Qhov kev sib cais no yuav pab txhim kho cov ntaub ntawv thiab txo qhov kev pheej hmoo ntawm kev ua yuam kev vim yog tib neeg - nrawm, qaug zog, thiab lwm yam.
Tam sim no, qhov tseem ceeb hauv kev txhim kho yog nthuav dav kev ua haujlwm ntawm Linux ib puag ncig. Version 4.1 tab tom npaj rau kev tso tawm, uas yuav ua raws li Fedora 31 thiab suav nrog cov qauv tam sim no ntawm cov khoom tseem ceeb Xen thiab Libvirt. Nws yog ib qho tsim nyog sau cia tias Qubes yog tsim los ntawm cov kws tshaj lij kev ruaj ntseg cov ntaub ntawv uas ib txwm tso tawm cov kev hloov tshiab sai sai yog tias muaj kev hem thawj tshiab lossis yuam kev raug txheeb xyuas.
Tom qab ntawd
Ib qho ntawm cov kev sim muaj peev xwm uas peb tab tom tsim tso cai rau peb tsim VMs nrog kev txhawb nqa rau cov qhua nkag mus rau GPU raws li Intel GVT-g thev naus laus zis, uas tso cai rau peb siv lub peev xwm ntawm cov duab adapter thiab nthuav dav ntawm cov kab ke. Thaum lub sijhawm sau ntawv, qhov haujlwm no ua haujlwm rau kev sim tsim ntawm Qubes 4.1, thiab muaj nyob rau .
Tau qhov twg los: www.hab.com