Kicksecure for KVM

From Kicksecure
Jump to navigation Jump to search
Documentation Previous page: VirtualBox Index page: Documentation Next page: Qubes Kicksecure for KVM

About this KVM Page
Contributor maintained wiki page.
Support Status stable
Difficulty medium
Contributor HulaHooparchive.org iconarchive.today icon
Support Community support only!
unofficial logo re-design for the KVMarchive.org iconarchive.today icon virtualizer + Kicksecure
KVM virtualizerarchive.org iconarchive.today icon (unofficial [1]) logo

This is the KVM flavor of the Kicksecure project.

Info COMMUNITY SUPPORT ONLY : THIS WHOLE WIKI PAGE is only supported by the community. Kicksecure developers are very unlikely to provide free support for this content. See Community Support for further information, including implications and possible alternatives.

Introduction

[edit]

Much of the warnings and use case instructions from Whonix KVM, such as running the OS headlesslyarchive.org iconarchive.today icon or using shared foldersarchive.org iconarchive.today icon, are applicable.

For more details about Kicksecure, check Kicksecure pages.

Support tickets should be forwarded to the KVM subforumarchive.org iconarchive.today icon.

Install KVM

[edit]

For Kicksecure on Intel / AMD, install:

sudo apt install --no-install-recommends qemu-system-x86 qemu-system-gui qemu-system-modules-spice qemu-utils libvirt-daemon libvirt-daemon-driver-qemu libvirt-daemon-driver-storage libvirt-clients virt-manager gir1.2-spiceclientgtk-3.0 passt ovmf swtpm swtpm-tools safe-rm xz-utils

For Kicksecure on PowerPC, install:

sudo apt install --no-install-recommends qemu-system-ppc qemu-system-gui qemu-system-modules-spice qemu-utils libvirt-daemon-system libvirt-daemon-driver-qemu libvirt-daemon-driver-storage libvirt-clients virt-manager gir1.2-spiceclientgtk-3.0 passt swtpm swtpm-tools safe-rm xz-utils

Build from Scratch

[edit]

Advanced users are encouraged to build Kicksecure images for high security assurance.

Download Kicksecure

[edit]

By downloading, you acknowledge that you have read, understood and agreed to our Terms of Service and License Agreement.

FREE

Symbol representing GUI

GUI

stable LXQt

Download Kicksecure LXQt (KVM) (stable) (FREE!) KVM

Optional: Digital signature verification.

Version (stable): 18.2.1.9

Only experienced users: This step is only useful and recommended for very experienced users. All other users please skip this step.

  • Digital signatures are a tool enhancing download security. They are commonly used across the internet and nothing special to worry about.
  • Optional, not required: Digital signatures are optional and not mandatory for using Kicksecure, but an extra security measure for advanced users. If you've never used them before, it might be overwhelming to look into them at this stage. Just ignore them for now.
  • Learn more: Curious? If you are interested in becoming more familiar with advanced computer security concepts, you can learn more about digital signatures here: Verifying Software Signatures

Choose your verification method below. This step requires that you have already downloaded Kicksecure LXQt.

OpenPGP LXQt stable

OpenPGP Signature

Download Kicksecure OpenPGP Key

signify LXQt stable

SHA-512 checksum file

SHA-512 checksum file signify signature

Download Kicksecure signify Key

Read Verify the images to learn more about the verification process for the images.

testers LXQt

Download Kicksecure LXQt (KVM) (testers) (FREE!) KVM

Optional: Digital signature verification.

Version (testers): 18.1.4.2

Only experienced users: This step is only useful and recommended for very experienced users. All other users please skip this step.

  • Digital signatures are a tool enhancing download security. They are commonly used across the internet and nothing special to worry about.
  • Optional, not required: Digital signatures are optional and not mandatory for using Kicksecure, but an extra security measure for advanced users. If you've never used them before, it might be overwhelming to look into them at this stage. Just ignore them for now.
  • Learn more: Curious? If you are interested in becoming more familiar with advanced computer security concepts, you can learn more about digital signatures here: Verifying Software Signatures

Choose your verification method below. This step requires that you have already downloaded Kicksecure LXQt.

OpenPGP LXQt testers

OpenPGP Signature

Download Kicksecure OpenPGP Key

signify LXQt testers

SHA-512 checksum file

SHA-512 checksum file signify signature

Download Kicksecure signify Key

Read Verify the images to learn more about the verification process for the images.

Symbol representing CLI

CLI

stable CLI

Download Kicksecure CLI (KVM) (stable) (FREE!) KVM

Optional: Digital signature verification.

Version (stable): 18.2.1.9

Only experienced users: This step is only useful and recommended for very experienced users. All other users please skip this step.

  • Digital signatures are a tool enhancing download security. They are commonly used across the internet and nothing special to worry about.
  • Optional, not required: Digital signatures are optional and not mandatory for using Kicksecure, but an extra security measure for advanced users. If you've never used them before, it might be overwhelming to look into them at this stage. Just ignore them for now.
  • Learn more: Curious? If you are interested in becoming more familiar with advanced computer security concepts, you can learn more about digital signatures here: Verifying Software Signatures

Choose your verification method below. This step requires that you have already downloaded Kicksecure CLI.

OpenPGP CLI stable

OpenPGP Signature

Download Kicksecure OpenPGP Key

signify CLI stable

SHA-512 checksum file

SHA-512 checksum file signify signature

Download Kicksecure signify Key

Read Verify the images to learn more about the verification process for the images.

testers CLI

Download Kicksecure CLI (KVM) (testers) (FREE!) KVM

Optional: Digital signature verification.

Version (testers): 18.1.4.2

Only experienced users: This step is only useful and recommended for very experienced users. All other users please skip this step.

  • Digital signatures are a tool enhancing download security. They are commonly used across the internet and nothing special to worry about.
  • Optional, not required: Digital signatures are optional and not mandatory for using Kicksecure, but an extra security measure for advanced users. If you've never used them before, it might be overwhelming to look into them at this stage. Just ignore them for now.
  • Learn more: Curious? If you are interested in becoming more familiar with advanced computer security concepts, you can learn more about digital signatures here: Verifying Software Signatures

Choose your verification method below. This step requires that you have already downloaded Kicksecure CLI.

OpenPGP CLI testers

OpenPGP Signature

Download Kicksecure OpenPGP Key

signify CLI testers

SHA-512 checksum file

SHA-512 checksum file signify signature

Download Kicksecure signify Key

Read Verify the images to learn more about the verification process for the images.

Note: Save your download to your usual ~/Downloads folder.

Decompress

[edit]

1. Change directory.

The decompression command below must be run from within the folder where you downloaded the archive (most likely in ~/Downloads or ~/ (home) folder).

Note: Adjust the folder if you stored the archive elsewhere.

cd ~/Downloads

2. Do not use unxz! Extract the images using GNU tar.

3. Make sure the xz-utils package is installed on your system. [2]

If you followed the installation instructions above, this should already be the case.

4. Decompress.

If your filesystem does support Sparse Files [3]:

tar -xSvf Kicksecure*.libvirt.xz

If your filesystem does not support sparse files:

tar -xvf Kicksecure*.libvirt.xz

5. Wait.

Be aware that the extraction process may take an exceptionally long time to complete. It is recommended to allow the terminal to run uninterrupted after executing the command to ensure successful decompression.

6. Done.

Importing Kicksecure VM Template

[edit]

The supplied XML files serve as a description for libvirt and define the properties of a Kicksecure VM and the networking it should have.

  • Define the properties of Kicksecure VM

virsh -c qemu:///session define Kicksecure*.xml

Tell libvirt to stop trying to adjust resources limits and force libvirt to skip it

[edit]

Libvirt tries to set the VM process maximum core dump file size to "unlimited", but the system will blocks it because unprivileged users not allowed to raise their own hard resource limits (setrlimit).

Since there is no root access to modify system-wide limits, then we need to tell libvirt to stop trying to adjust this limit by forcing libvirt to skip resource limits.

So to override the memory/core limits for QEMU inside user configuration directory:

  • Create new directory:

mkdir -p ~/.config/libvirt/

  • Make and edit new file:

nano ~/.config/libvirt/qemu.conf

  • Copy and Paste:
max_core = 0
max_processes = 0
max_files = 0
  • Save and exit Ctrl+x then y then Enter.
  • Reboot your system so the changes can take effect.
  • Done

Image File Installation

[edit]

The XML files are configured to use newly created user level path ~/.local/share/images instead of the default storage location of /var/lib/libvirt/images. The image files can be moved or copied, depending on storage constraints.

Notes:

  • The directory must be created before copying or moving the images. To create the path [4]:

mkdir -p ~/.local/share/images

  • The following steps move or copy the images so the virtual machines can boot.

Either move or copy.

Moving Kicksecure Image Files

Move the image files.

mv Kicksecure*.qcow2 ~/.local/share/images/Kicksecure.qcow2

Copying Kicksecure Image Files

Copy the image files.

Kicksecure disk images are sparse files, meaning they expand as data is written rather than allocating their entire size (100GB) outright. Sparse files require special commands when they are copied to ensure they retain this property; otherwise, they will occupy the full disk space.

cp --sparse=always Kicksecure*.qcow2 ~/.local/share/images/Kicksecure.qcow2

Start

[edit]

Virtual Machine Manager (Virt-Manager) GUI default is qemu:///system not qemu:///session

[edit]

If Kicksecure VM not shown in the default opening of Virt-Manager, Then this is because it assumes your VMs on default qemu:///system, so you need to change that to qemu:///session:

Go to Virtual Machine Manager → File → Add Connection... → Switch Hypervisor from QEMU/KVM to QEMU/KVM user session → Tick Autoconnect → Connect.

Images:

After that start Kicksecure VM.

If the virt-manager always going to show qemu:///system whenever you start the virt-manager, then to solve this run:

echo "export LIBVIRT_DEFAULT_URI='qemu:///session'" >> ~/.zshrc source ~/.zshrc

(If someone is using Bash instead of Zsh, change .zshrc to .bashrc, This tells your entire user profile including the GUI to always target your local user session by default).

Using Kicksecure with LXQt as Graphical User Interface (GUI) Desktop

[edit]

Start Virtual Machine Manager:

Start Menu → System Tools → Virtual Machine Manager

Start Kicksecure:

click on Kicksecure → click Open → click the play symbol

Uninstall

[edit]

If you want to remove Kicksecure KVM VM, the Kicksecure network, and Kicksecure image, click Expand on the right.

1. Power off the VM you want to Remove (If not already).

virsh -c qemu:///session destroy Kicksecure

2. Remove the KVM VM settings.

virsh -c qemu:///session undefine Kicksecure

3. Delete the images.

Note: All data will be lost unless it is backed up first. Adjust the paths to the images as appropriate.

safe-rm ~/.local/share/images/Kicksecure.qcow2

Shared Folders

[edit]

See KVM, Shared_FoldersOnion network Logo.

Footnotes

[edit]
  1. ↑ re-creation
  2. ↑ https://forums.whonix.org/t/tar-child-xz-cannot-exec-no-such-file-or-directory-install-xz-utils-package/16708/7archive.org iconarchive.today icon
  3. ↑ tar --extract --sparse --verbose --file=Kicksecure*.libvirt.xz
  4. ↑ Another less practical and not guaranteed method could be used by running virt-manager -c qemu:///session. This will open virt-manager, triggering the default storage path, and the user will see the Kicksecure image there. However, if the user tries to run it, it will not work because the image has not yet been transferred to the storage path (so it has a practical issue if the user is not aware of this). Also, there is no guarantee that it will work in every case on every distribution.

Documentation Previous page: VirtualBox Index page: Documentation Next page: Qubes

Notification image
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 14 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=KVM&oldid=111157"