Kicksecure for Qubes

Kicksecure ™

Download

On Computer USB Installation Intel / AMD64 ARM64 Raspberry Pi PPC64 Windows (VM) Mac Linux (VM) VirtualBox (VM) Qubes (VM) KVM (VM) Debian morph to Kicksecure More options Source Code

About

Overview Features Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Forum Best Practices Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

KVM Documentation Download Security Previous page: KVM Index page: Documentation Next page: Download Security Kicksecure for Qubes

Kicksecure for Qubes OS.

Installation

Select an installation method.

Template

Warning: This is for testers-only!

In dom0.

qvm-template --enablerepo qubes-templates-community-testing install kicksecure-17

Done.

Template kicksecure-17 has been installed.

Distribution Morphing

What is distro morphing? See Distribution Morphing.

In dom0.

1. Install debian-12 as per the Qubes Debian Template documentation, which is unspecific to Kicksecure.

2. Clone Template debian-12 into Template kicksecure-17.

3. Start the kicksecure-17 Template.

---

Inside the kicksecure-17 Template.

1. Follow the instructions Install Kicksecure inside Debian, choose meta package kicksecure-qubes-cli or kicksecure-qubes-gui.

2. Shut down the Template.

3. Done.

Distribution morphing of Debian into Kicksecure is complete.

4. Change Template.

Optional: The user may change the Template for any App Qube from Debian to Kicksecure as per the usual Qubes way.

5. Create new App Qubes.

Optional: The user may create new App Qubes based on the kicksecure-17 Template as per the usual Qubes way.

HVM

Using the Kicksecure ISO is not the recommended way to install Kicksecure on Qubes.

If the user wishes to use the ISO for any reason (such as testing, development, comparison, or curiosity), the following steps apply.

Note: You need to perform downloading the Kicksecure ISO inside a separate App Qube that will be used to install Kicksecure from (in the example below, the ISO has been downloaded in "debian-personal").

1. Create a new App Qube, following the instructions in the image.

2. Remove "Install system from device" because we want to modify the VM before installing Kicksecure on it, then press "OK" to create the Kicksecure App Qube.

3. Enter the Kicksecure Qube settings.

4. Preferably, change system storage to 20 GB, then press "Advanced".

5. Disable "Include in memory balancing", then increase "Initial memory" to preferably 4 GB. Press "Apply" to adjust the edited settings, then press "Boot qube from CD-ROM" to choose the Kicksecure ISO.

6. Choose the App Qube where you have downloaded the Kicksecure ISO, then press "..." to browse for the ISO path.

7. Choose the Kicksecure ISO.

8. Make sure everything is correctly chosen, then press "OK".

9. Kicksecure is booted and ready to be installed. Kicksecure supports offline installation, so there is no need for network configuration before installation.

10. Done

HVM - Networking

If you want to use the internet before or after installation, you need to go through the following steps:

1. Right-click on the Network Manager taskbar icon, then choose "Edit connections..."

2. Choose "Wired connection 1", then press the settings (gear) icon.

3. Choose "IPv4 settings", then under "Method", select "Manual", and press "Add".

4. Fill in the blanks with the Net qube info, except for the subnet mask, which should be set as 255.255.255.0 instead of 255 at the end . If the network still does not work, try changing the gateway to 10.137.0.1 .

5. After filling in the blanks, press "Save." The Network Manager gear should update itself with the newly added information.

6. Done

See also:

• Qubes HVM: How to auto detect the network settings (IP, gateway) from inside the VM?
• Qube (VM) Recovery.

HVM - Troubleshooting

If the user sees the following:

Figure: virtual console login screen

Then increase RAM according to the instructions in chapter #ISO.

Support Status

How stable is this? It should be very stable. This is because Qubes-Whonix is based on Kicksecure.

The lead developer of Kicksecure is also a user of Qubes and uses Kicksecure in Qubes.

Service VMs

Kicksecure in Qubes service VMs such as sys-net, sys-firewall, and sys-usb are functional. This is classified as unsupported to avoid complex support requests for issues not caused by Kicksecure being directed at Kicksecure support.

If using in-VM kernel:

it's problematic for VMs with PCI devices (especially when using Debian kernel, due to old wifi drivers, but there are also other factors like significantly slower boot time in HVM mode).https://github.com/QubesOS/qubes-issues/issues/9570#issuecomment-2468812870

ClockVM

A ClockVM based on the Kicksecure Template is functional out of the box.

The only requirement is that the ClockVM uses Kicksecure as its Template. For example, if using Qubes' default settings, where ClockVM is set to sys-net by default and sys-net has been configured by the user to use the kicksecure-17 Template, then ClockVM will be functional out of the box and use sdwdate for clock synchronization. See also sdwdate chapter, Qubes Specific.

Choose graphical user interface (GUI) or command line interface (CLI).

Using GUI

1. Start Menu -> Qubes Tools -> Qubes OS Global Config -> look for Clock Qube

2. Check the ClockVM setting.

Using CLI

1. Launch a dom0 terminal.
Click the Qubes App Launcher (blue/grey "Q") → Open the Terminal Emulator (Xfce Terminal)

2. Check the ClockVM setting.

qubes-prefs clockvm

Sample setting:

sys-net

3. Optional: Change ClockVM to a different App Qube.

4. Ensure that the ClockVM has its Template set to kicksecure-17.

5. Done.

The process of using Kicksecure as ClockVM has been completed.

Qubes Persistence

Qubes (non-)persistence is a Qubes default and unspecific to Kicksecure.

Table: Qubes Inheritance and Persistence

	Inheritance	Persistence
Template	n/a	Everything
App Qubes	/etc/skel/ to /home/	/rw/ (includes /home/ and bind-dirs)
Disposable Template	/etc/skel/ to /home/	/rw/ (includes /home/, /usr/local and bind-dirs)
Disposable	/rw/ (includes /home/, /usr/local and bind-dirs)	Nothing

Qubes Template Modifications

If a Qubes Template has been modified, to make changes in App Qubes based on that Template take effect, it is required to shut down the Template and restart the App Qubes based on that Template. This is a Qubes default and unspecific to Kicksecure.

To apply changes made to a Template:

1. Make the required modification to the Template.

2. Shut down the Template.

3. Shut down the App Qube based on the modified Template.

4. Start the App Qube based on the modified Template.

5. Done.

These steps ensure that all changes made to the Template are properly propagated to the App Qubes.

Known Issues

• Qubes has potential local privilege escalation issue: harden insecure permissions inside /dev/xen folder / research security impact of the Qubes /dev/xen folder permissions #9717 -- This issue is unspecific to Kicksecure and is entirely unrelated to Kicksecure. It equally applies to App Qubes that are not using qubes-core-agent-passwordless-root such as Qubes Debian minimal Template.

Developer Information

Information for developers:

• qubes-template-kicksecure source code
• Qubes GitHub feature request: build Kicksecure Qubes Template #9573
• Kicksecure-Qubes development wiki page
• Kicksecure-Qubes Template development forum discussion
• Please contribute to Kicksecure and Qubes OS by creating and maintaining a kicksecure-17 Qubes Template.

Footnotes

KVM Documentation Download Security Previous page: KVM Index page: Documentation Next page: Download Security

Kicksecure A secure by default operating system with the latest security research in place.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Kicksecure is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2025 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!