Qubes installation guide

Qubes OS is a security-oriented desktop operating system that uses cloud-based virtualization. Xen to isolate applications and processes into independent compartments called qubes (lightweight virtual machines). If a component is compromised — the browser, email client, or any application — isolation prevents the attacker from accessing the rest of the system. Created by Joanna Rutkowska and the Invisible Things Lab team, Qubes OS is considered one of the most secure operating systems available for everyday use.

Isolation security architecture

The Qubes OS architecture is based on the principle of security by compartmentalization. Instead of running all applications in a single environment, each activity runs in a separate virtual machine with its own kernel, file system, and network stack:

• Dom0 — The administrative domain that controls the Xen hypervisor. It does not have network access and its only function is to manage the VMs and the graphical environment.
• AppVMs — Virtual application machines where the user runs their daily software (browser, office automation, terminal).
• TemplateVMs — Base templates that provide the root file system to the AppVMs. Updates are made only to the template.
• ServiceVMs — VMs dedicated to system services such as network (sys-net), firewall (sys-firewall), USB (sys-usb) and storage.
• DisposableVMs — Ephemeral VMs that are automatically created and destroyed, ideal for opening untrusted files or links.

Each qube is visually identified with a window border color indicating your trust level: red for untrusted activities, green for sensitive work, yellow for general use, etc. The user interacts with all VMs from a single integrated desktop.

System requirements

Qubes OS has specific hardware requirements due to its reliance on the Xen hypervisor and virtualization extensions:

• CPU — 64-bit processor with support for Intel VT-x with EPT either AMD-V with RVI. Intel VT-d or AMD-Vi (IOMMU) is required for PCI device isolation.
• RAM — Minimum 6 GB, recommended 16 GB or more. Each qube consumes independent memory.
• Storage — Minimum 32 GB SSD. Recommended 128 GB or more for comfortable use with multiple templates.
• GPU — Integrated Intel graphics work better. NVIDIA/AMD dedicated GPUs may have Xen compatibility issues.
• TPM — Optional but recommended for Anti Evil Maid (AEM).

Important: Qubes OS must be installed directly on physical (bare-metal) hardware. It cannot be run inside another virtual machine, since Xen is a type 1 hypervisor that needs direct access to the hardware.

Hardware Compatibility Check

Before starting the installation, it is essential to verify that the hardware supports the necessary virtualization extensions:

# Verificar soporte VT-x/AMD-V
grep -E '(vmx|svm)' /proc/cpuinfo

# Verificar IOMMU en el kernel
dmesg | grep -i iommu

# Comprobar que VT-d/AMD-Vi está habilitado en BIOS
dmesg | grep -i "DMAR\|AMD-Vi"

If the previous commands do not return results, access the BIOS/UEFI of your computer and enable Intel VT-x, Intel VT-d (or AMD equivalents) in the processor configuration section. Consult the hardware compatibility list (HCL) official to verify your specific model.

ISO download and verification

Download the ISO image from official download page. It is essential to verify the integrity and authenticity of the image before installing it:

# Importar la clave maestra de firma de Qubes OS
wget https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
gpg --import qubes-master-signing-key.asc

# Verificar la huella de la clave maestra (debe coincidir con la publicada en la web)
gpg --fingerprint 0x36879494

# Importar la clave de la release actual
wget https://keys.qubes-os.org/keys/qubes-release-4-signing-key.asc
gpg --import qubes-release-4-signing-key.asc

# Verificar la firma de la ISO
gpg --verify Qubes-R4.2.3-x86_64.iso.asc Qubes-R4.2.3-x86_64.iso

To create bootable USB installation media:

# Identificar el dispositivo USB (por ejemplo /dev/sdb)
lsblk

# Escribir la ISO en el USB (CUIDADO: esto borrará todo el contenido del USB)
sudo dd if=Qubes-R4.2.3-x86_64.iso of=/dev/sdX bs=1M status=progress conv=fsync

Installation process

Qubes OS currently uses the installer Anaconda (based on Fedora). The process is quite straightforward compared to the first versions of the project:

1. Boot from USB — Configure BIOS/UEFI to boot from USB. Select Install Qubes OS in the GRUB menu.
2. Language selection — Choose your language and keyboard settings.
3. Disk configuration — Select the destination disk. Qubes offers full disk encryption with LUKS by default. It is strongly recommended to activate encryption.
4. Partitioned — The automatic scheme uses LVM thin provisioning on LUKS. For most users, automatic configuration is the correct option.
5. User Settings — Create your user account and password. This user will be the administrator of Dom0.
6. Template selection — Choose the base templates to install: Fedora (default), Debian, Whonix (for anonymity via Tor).

Estructura de qubes creados tras la instalación inicial:

Dom0               → Administración (sin red)
sys-net            → Gestión de interfaces de red
sys-firewall       → Firewall entre sys-net y las AppVMs
sys-usb            → Aislamiento de dispositivos USB
vault              → Almacenamiento offline (sin red)
personal           → AppVM para uso personal
work               → AppVM para trabajo
untrusted          → AppVM para navegación no confiable
whonix-gw          → Gateway Tor (si se instaló Whonix)
whonix-ws          → Workstation Tor (si se instaló Whonix)

Initial post-installation configuration

After the first boot, it is important to perform some basic configurations to secure the system:

# En Dom0: actualizar el sistema completo
sudo qubesctl --all state.sls update.qubes-vm

# Listar todas las VMs y su estado
qvm-ls

# Verificar que sys-net y sys-firewall están ejecutándose
qvm-ls --running

To update templates individually:

# Actualizar la plantilla Fedora
qvm-run --auto --pass-io --no-gui fedora-39 \
  'sudo dnf upgrade --refresh -y'

# Actualizar la plantilla Debian
qvm-run --auto --pass-io --no-gui debian-12 \
  'sudo apt update && sudo apt full-upgrade -y'

# Apagar las plantillas tras actualizar
qvm-shutdown fedora-39 debian-12

Management of qubes and security domains

The power of Qubes OS lies in the ability to create and manage separate security domains based on the trust level of each activity:

# Crear una AppVM para banca online (máxima seguridad)
qvm-create banking --template fedora-39 --label green

# Crear una AppVM desechable para abrir archivos sospechosos
qvm-create --class DispVM --template fedora-39-dvm --label red temp-analysis

# Crear una AppVM sin acceso a red (vault para contraseñas/claves GPG)
qvm-create secrets --template fedora-39 --label black
qvm-prefs secrets netvm none

# Asignar memoria máxima a una VM
qvm-prefs banking maxmem 4096

# Ejecutar una aplicación en un qube específico
qvm-run banking firefox
qvm-run work libreoffice

The system of inter-VM copy and paste requires an explicit key combination (Ctrl+Shift+C to copy, Ctrl+Shift+V to paste into the destination VM), which prevents malicious software from accessing the clipboard of other VMs.

Network and firewall configuration

The network in Qubes OS is completely virtualized. Each AppVM is connected through a chain of ServiceVMs that provide isolation:

AppVM (work) → sys-firewall → sys-net → Internet
AppVM (anon) → sys-whonix   → sys-firewall → sys-net → Internet

# Cambiar la NetVM de un qube (enrutar por Tor)
qvm-prefs anon-browser netvm sys-whonix

# Desconectar completamente una VM de la red
qvm-prefs secrets netvm none

# Ver las reglas de firewall de una VM
qvm-firewall work list

# Restringir una VM a solo acceder a un servidor específico
qvm-firewall banking del --rule-no 0
qvm-firewall banking add --action accept --dst 203.0.113.10 --proto tcp --dstports 443
qvm-firewall banking add --action drop

Good security practices

To get the most out of the Qubes OS security model, follow these recommendations:

• Minimize Dom0 — Never run user applications on Dom0. Its only function should be to manage the VMs.
• Separate activities — Use different qubes for banking, work, casual browsing, and sensitive activities. Never mix levels of trust.
• Use DisposableVMs — To open unknown links, email attachments or any untrustworthy content.
• Disk encryption — Make sure LUKS encryption is active with a strong password.
• Update regularly — Keep Dom0 and all templates up to date. AppVMs inherit updates from their template.
• Vault offline — Stores GPG keys, passwords, and sensitive cryptographic material in a VM without network access.
• Split GPG — Uses split GPG functionality so that private keys remain in the vault while other VMs can request signing operations.

Troubleshooting common problems

Some common problems during and after installation:

# Pantalla negra tras instalación: verificar que IOMMU está habilitado
# En GRUB, añadir al kernel Xen:
iommu=no-igfx

# VM no arranca: verificar logs
qvm-start --debug work
journalctl -b | grep -i xen

# Problemas de red: reiniciar la cadena de red
qvm-shutdown sys-firewall sys-net
qvm-start sys-net
qvm-start sys-firewall

# Espacio en disco insuficiente: verificar uso
sudo lvs | grep -i qubes
qvm-volume info work:private

Qubes OS represents a radically different approach to desktop security. Instead of trying to make a single operating system secure, it assumes that any individual component can be compromised and limits the impact through isolation. For journalists, activists, security researchers, and anyone who handles sensitive information, Qubes OS remains one of the most robust options available.

:wq!