Connecting to Cisco ASA VPN on Qubes 3.2 with openconnect

OpenConnect on Qubes 3.2. Using a vpn ProxyVM to connect to Cisco ASA VPN .

Create a new vpn ProxyVM using fedora-26 template:

Due to a bug in software from Fedora 25 and later, you have to install a ‘NetworkManager-openconnect-gnome’ package, (which is not in the template by default) or you will get an error creating the VPN Connection in vpn:

So install the package:

Create the Openconnect connection without errors:

Configure the site:

Type your username and password, when connecting, and you’re good to go.  This also supports 2FA. You can use the upper right corner in dom0 to connect, since dom0’s network is including proxyVM’s it seems. Very neat, indeed.

VMware Horizon View Client on Qubes 3.2

Start the selected TemplateVM (I selected fedora-26, since it’s default in Qubes). Clone it if you want.

A prerequisite is the Libxxs shared object, but here was provided a solution for installing it i Fedora.

So, since this is a prerequisite for the VMware Horizon View client, install it now:

Answering yes to any questions.

Start the terminal in  and copy the download link from a browser (I try to minimize the use of direct internet access in templates). Download the client.

make the file executable and Install the client(remember sudo ;):

Obviously select yes:

Choose whatever your heart desires:

Await the copying of files…

 Choose scan to see if everything is in order:

Chose close and start the client:

Begin configuring your environment:

Assign USB-disk to VM in Qubes4.0RC4

Qubes has a new graphical feature that enables you to attach a USB device to your VM and then mount it on the VM

The above “work” was already selected and ready for unmounting. Lets go to the VM and list the added disk and mount it:

If in doubt which disk is which, deattach it in Qubes Manager and fdisk -l again to see what’s missing.

Ordering a Purism Librem 13v2 to run Qubes 4.0RC4

Privacy has increasingly become a worry for me, and with big corporations selling your data like candy, it seems like a good idea to go somewhat under the radar. Not just by not using big corps “free” services, but also protect oneself again maliciousness from evil doers, due to holes in all code made in the concept of “time-to-market” instead of security in mind.

And how do you secure yourself from Trojans, and all the other stuff, without reading every instruction on the internet about issues and how to counteract them?

You can tape your camera, run antivirus, avoid clicking this and that, but isn’t there something completely wrong with programs, if a single click can infect your computer without authorization, and all your phone’s data can be sold to the highest bidder, because you are not in charge of your data anymore. The world is as insecure as it gets.

A long time ago I abandoned facebook and I need to take a step further. I had this romantic dream of kill switches that disables bluetooth, microphones and camera, giving me the controls back, instead of being a possible victim of Trojans en mass, etc. And the idea of a browser with a bug, didn’t put my harddrive accessible to the internet. Kill switches took me to purism and compartmentalization took me to Qubes.

A match made in heaven ! 🙂

So installing Qubes 3.2 on my lenovo yoga 2 Pro, was step 1 and ordering a Purism Librem5 phone was step 2. After ordering the phone (Librem 5), I also ordered the Librem 13v2, with Qubes, with the latest hardware, so I could run Qubes 4.0, when it was released.

This is the story of how my Purism Librem13v2 was a challenge. And the story isn’t over yet.

On the 22nd of November I ordered my Librem13v2, anticipated shipping a few weeks later.

An expensive buy, but I was in the mood for a long term relationship, with Purism. NVMe disk and Qubes. A bit overpriced you might say. That’s another story. NVMe 512GB here is $200 retail, so yes.

The shipping update on the 26th of November was promising:

  • Hi Max,
  • We received a new batch of Librem 13 a few days ago. We’ll start shipping them in a few days. Since your order is fairly recent, it will probably be shipped around mid December.
  • Best regards

Mid December. Sounds good to me. Then maybe I can get it as a christmas present?

  • Hi Max,
  • Unfortunately, not. Your order includes a TPM add-on and those orders will be shipped in the first half of January. We received a lot of requests for TPM, so we needed more time than initially planned to modify all those orders.
  • Best regards

Damn. My christmas present was delayed. Well, the thing is worth waiting for :). Right? Half through January it was still awaiting shipment….

Hi Max,

We’re trying very hard to fulfill all orders in a timely manner and have hired additional staff. We’ll get to your order as fast as possible, probably in the next two-three weeks.

Thank you for your patience.

Best regards

Ok, now i’m getting sad. over 2 whole months before my order get’s shipped.  Well, better late than never.

On the 3rd of February, they shipped the item…. Well, they have notified USPS that there was an Item to be send, but shipped? No, not yet.

on the 6th I received this:

  • Hi Max,
  • USPS still didn’t picked up the package. You’ll probably see an update in the next 12-24 hours.
  • Best regards

Super. Well. Within  a few days, the package came to Denmark. Getting held up in Customs and I was fined 3600DKK in taxes. That’s a bit more than $600.

I better love this privacy thing. Bottom line is expensive kill switches 🙂

Well, guess what. No USB stick.. The reply was:

  • Hi Max,
  • We don’t have USB flash drives on stock at the moment. We’ll send it separately in about two weeks.
  • Best regards

Thank you very much. Well, I can wait. Let’s try this PureOS out.

The install wen’t almost without issues. The touchpad didn’t work. Known issue I was told:

  • Hi Max,
  • Yes, that’s a known problem. We’re working on a fix.
  • Best regards

Well, the install finished and the touchpad worked. Now, let’s see what this PureOS is all about. Wauw. This was one of the best, simple, beautiful, Linux distributions I have ever seen. With encryption, privacy and moderate security as default. Qubes is a bit much, and PureOS seems like the OS for me. So I decided then that PureOS  should be my primary personal VM of choice in Qubes, of course 🙂

Well, Qubes 3.2 didn’t install very well, due to known issues. 4.0 couldn’t get installed because of other issues with CoreBoot 4.7 . My Librem 13v2 is shipped with Coreboot 4.6 which does not support Qubes 4.0.

So I had bought a laptop that worked barely with 3.2 (My restored Kali VM doesn’t work and the boot loader fail) and not at all with 4.0. The whole reason for the purchase, was to get it running Qubes-OS 4.0.

Well, the Purism and Coreboot team worked hard, and it seems that the early announcement, might soon get to be a real announcement that is not just a statement, but an actual usable announcement with a guide to get your brick working. Right now, it’s still without a proper guide.

Soon I hope. Soon.

But when trying to test my poor Qubes 3.2 installation, the fan breaks down, and starts a rattling noise.

Not happy about it, the support gives me a choice of sending it overseas back to Purism or send a spare to me.

  • Hi Max,
  • There’s no need for a video. We had a similar case, where the noise would occur from time to time, and it was coming from the fan. Could you try to bring the bottom of the laptop near your ear when you hear the noise again?
  • The only thing left to do is to send the laptop back to us for repair. Or we could send you a replacement fan, if it happens that it’s a source of that noise, and if you think you could replace it by yourself.
  • Best regards

Well, I told them to send it with the missing usb-stick and I’m looking forward to it. And of course the Coreboot update. And the test of Qubes 4.0.

In restrospect, I would maybe recommend the Lenovo X1 Carbon (Which I use for work, actually) and the Qubes team uses too. Regarding hardware switches, Joanna actually commented on it regarding Qubes 4.0 that “Similarly, we don’t consider physical kill switches on Wi-Fi and Bluetooth devices to be mandatory”. So I guess, that running qubes and controlling the hardware to VM’s should suffice. And it’s cheaper than kill switches.

But, hey. The hype get’s you a long way, says an iphone user 😉

UPDATE 22/2-2018:

The coreboot is available, but the initial version is quite faulty, so updating will be a hassle. Be sure to get the latest Coreboot 4.7 v.3

February 2018 coreboot update now available

UPDATE  22/2-2018:

To make me feel even worse, Purism offered free TPM and International shipping on all NEW orders. So, even though my order is not quite finished, the answer to the question “Could I be included in this great offer, since my order is not yet fully received? was…

  • Only for new orders.

So there you go. $99 for the TPM and $80 for shipping and now I have to return the damn thing because of a faulty fan.

This thing is costing me more than the X1 Carbon I should have bought instead, it seems.

The most expensive kill switches in the world, and it doesn’t have a danish keyboard 🙂

UPDATE 7/3-2018

I shipped the thing back on the 1st of march and it hasn’t been delivered to Purism yet. I’m looking forward to see how long time it will be, from ordering a laptop to actually getting a working laptop. So far its’ been ….. quite some time…

UPDATE 9/3-2018:

  • After receiving the package at Purism, I inquired about when to expect the fan to be replaced and the answer was:
  • Hi Max,
  • It will probably take us 5-10 days. We’ll let you know as soon as we fix it.
  • Best regards

So, counting on approximately 3,5 months now and 4 months since initial order…

UPDATE 15/3-2018:

  • Hi Max,
  • We managed to fix your laptop. Could you send us your shipping address?

🙂 Of course. Keeping the costs down by saving on CRM systems is a great thing.

And now it’s almost shipped 😉

We have a very expensive public sector here in Denmark, so we have to make people pay the absolute maximum to get the show on the road. I must say, paying customs twice, because the same machine travels the border twice is just stupid.

UPDATE 20-03-2018

  • Hello Max Andersen,Your item is being held in Customs at 12:38 pm on March 20, 2018 in COPENHAGEN EMS, DENMARK.

    Tracking Number: XXXXXXXXXXXX

So when confronted with the customs yet again, I was send back and forth between FedEx and Customs 5 times before the issue is (maybe) resolved.

The Clearance Broker At fedex have now send an email to Customs and a few days will pass…..

If 2 days pass, We are officially 4 months from the order date. That is a huge fail.

UPDATE 21-03-2018

  • Hello Max Andersen,

    Your item cleared customs in DENMARK at 10:22 am on March 21, 2018.

    Tracking Number: XXXXXXXXXXXX

One day left for the 4 month mark…

Allow Ctrl-Alt-Del in Windows VM in Qubes 3.2

Allow Control-Alt-Delete in windows VM:

Passing Ctrl+Alt+Delete to the Windows HVM:
Qubes menu → System Tools → Keyboard → “Application Shortcuts” tab → Select the line “xflock4” – “Ctrl+Alt+Delete” → Click the “Remove” button

Select Qubes menu → Qubes VM Manager → Right click on Windows VM → VM Settings → On the “Basic” tab, tick the “Run in debug mode” checkbox → Click the “OK” button → Start Windows VM

When starting windows, 2 windows are present – press ctrl-alt-del in the 1st one and the other (with the desktop) responds to it. log in with your local account, start VPN, switch user, log in with your domain account.

Add USB network adapter to a specific Qube to configure router in Qubes 3.2

Pre-requisites: sys-usb VM

If your router needs a locally attached cable in port 1 or something similar, and you only have a USB RJ45 adapter, then you need to have a net-vm with the adaptor attached and a VM who uses this net-VM as network:

[Max@dom0 ~]$ qvm-usb 
sys-usb:3-8 5986:0535 Generic_Lenovo_EasyCamera_200901010001
sys-usb:3-2 0b95:7720 ASIX_Elec._Corp._AX88x72A_10FD4D
sys-usb:3-1 046d:c52f Logitech_USB_Receiver
sys-usb:3-7 04f3:016f ELAN_Touchscreen
sys-usb:3-6 2047:0855 Invensense_Lenovo_Yoga_31F3806F24001100
sys-usb:3-4 8087:07dc 8087_07dc
[Max@dom0 ~]$ 

The above command shows the USB network adapter (in Bold). If you are uncertain, unplug device and try again…. the difference is  key :))

Attach the device to the net-VM which will use it with the following command:

[Max@dom0 ~]$ qvm-usb -a lokal-belkin sys-usb:3-2
[Max@dom0 ~]$ 

The above 3rd listing is the network card. Also in dom0, you have 2 network interfaces up in the right corner:

The above will setup as default and try to get ipv4/ipv6 dhcp.

The above shows successful address with dhcp.

The network is now working, and the x is gone. Happy times.

Qubes OS 3.2 on Purism Librem13v2


So, my Purism Librem13v2 finally arrived. Ordered in November and delivered in February, 2 months later than first promised(mid december), due to high demand and TPM. Missing the USB stick with Qubes OS, but I was promised they will send it in a few weeks time.

Long anticipated, I looked forward to run Qubes 4.0rc4, but the installed Coreboot 4.6 version does not support Qubes OS version 4 yet, and we still await the official 4.7 release, so I was forced(and recommended) to run Qubes 3.2, with the issues it presented.

I now run Qubes 3.2, restored my VMs from my older Lenovo Yoga 2 Pro, and most stuff seems to work, except my Kali VM. A reinstall did not help :(, so I might jump to forums, if the issue persists.


After installing qubes 3.2, the system hangs during boot up. The solution is somewhat provided here:

Boot Qubes installer into recovery:

Select Troubleshooting:

Select Rescue a Qubes system:

After booting to anaconda installer choose

1) Continue

(and enter your Qubes partition password if you chose to encrypt it during install)

In the prompt:

chroot /mnt/sysimage

lsblk (To identify the whereabouts of your Qubes installation.)

GRUB_CMDLINE_XEN_DEFAULT="console=none dom0_mem=min:1024M dom0_mem=max:1024M"  (Fixed size, following recommendations: but looking at another qubes installation it says 1024/4096 as min/max. So feel free to pick)

grub2-install /dev/nvme0n (or where your Qubes installation lies.)


I managed to do without the GRUB_XEN thingy, but don’t know if there is a hidden effect of it somewhere.

exit (leave the chroot environment)


Reboot and voila. The system starts, but has a cluttered text interface for the disk encryption password, instead of the graphical part.

Here the normal graphical question:

I can live with that, but not ideal. Hopefully the coreboot 4.7 and Qubes 4 will work better together.

Initial setup after reboot:

Qubes needs to finish up the installation, asking some relevant questions about sys-usb, whonix, tor, etc.

First an opening window of no interest, but a button to click….

Then we have to select if updates should go through tor and if we need usb, and I recommend the usage of a separate qubes for USB. sys-usb might say experimental, but updates seem to fix what issues there has been.

The login window comes up and the user created during install can be used to login.

Notice the lack of wifi support for the machine.

This is purely a one time only thing and will come up after reboot:

You will be asked how you wan’t, if you wan’t, to use tor. That should be a no brainer, if you wan’t to run qubes, but I will recommend some machines configured without tor, since cloudflare and others just hate tor and blocks you terribly with captchas, etc.

Then you should update all the machines, so your sys-usb won’t hang during startup, etc.

commands like :

sudo qubes-dom0-update (updates the current dom0 qube)

sudo qubes-dom0-update qubes-template-fedora-26 (installs the newer fedora 26 template, to replace fedora-23 as default in VM Manager and the rest of the pre-configured machines is a first.

Then you can select “Update VM” on the rest of the templates and begin to either restore images from a previous qubes installation or configure email clients or other settings on your new machines.

I have problems creating kali images on the Purism Librem13v2, that works fine on other qubes-machines running Lenovo and HP, so I guess that there is something about Purism Librem13v2 and Qubes that is just not fun at all.

Hopefully CoreBoot 4.7 and Qubes 4.x will run better.