How-to: Fix dom0 Qubes-Whonix ™ UpdatesProxy Settings
From Whonix
< Qubes
If you see the following warning...
WARNING: Execution of /usr/bin/apt-get prevented by /etc/uwt.d/40_qubes.conf because no torified Qubes updates proxy found.
If this warning message is transient, it can be safely ignored. Otherwise, try one of the fixes below.
Contents
Update dom0[edit]
To launch a dom0 terminal, click the Qubes App Launcher (blue/grey "Q") and then open the Terminal Emulator (Xfce Terminal).
Upgrade Qubes dom0. [1]
sudo qubes-dom0-update
Error Resolution Methods[edit]
The following fixes are listed in order of preference.
Salt Fix[edit]
Use salt to setup dom0 settings. [2]
sudo qubesctl state.sls qvm.anon-whonix
Next, check if the problem has been corrected. Run the following command in Whonix ™ TemplateVM.
sudo systemctl restart qubes-whonix-torified-updates-proxy-check
Then try to update / use apt-get again.
If there are still problems, try the manual fix below.
Manual Fix[edit]
Please make sure Whonix-Gateway ™ (sys-whonix) is running.
- Qubes R3.2: The NetVM of this TemplateVM should be set to Whonix-Gateway ™ (
sys-whonix). [3] - Qubes R4 or higher: Check the dom0
/etc/qubes-rpc/policy/qubes.UpdatesProxysettings.
At the very top of that file, the following text should appear.
$tag:whonix-updatevm $default allow,target=sys-whonix
If it is not there, add it.
To view a complete example of the /etc/qubes-rpc/policy/qubes.UpdatesProxy file, please press on expand on the right.
/etc/qubes-rpc/policy/qubes.UpdatesProxy (raw):
## Note that policy parsing stops at the first match,
## so adding anything below "$anyvm $anyvm action" line will have no effect
## Please use a single # to start your custom comments
# Upgrade all TemplateVMs through sys-whonix.
#$type:TemplateVM $default allow,target=sys-whonix
# Upgrade {{project name}} TemplateVMs through sys-whonix.
$tag:whonix-updatevm $default allow,target=sys-whonix
# Deny {{project name}} TemplateVMs using UpdatesProxy of any other VM.
$tag:whonix-updatevm $anyvm deny
# Default rule for all TemplateVMs - direct the connection to sys-net
$type:TemplateVM $default allow,target=sys-net
$anyvm $anyvm deny
If Multiple Qubes-Whonix ™ TemplateVMs are configured -- like when the Whonix ™ TemplateVM is cloned -- please press on expand on the right.
The following syntax should apply.
Name-Of-{{project_name}}-TemplateVM $default allow,target={{gateway_product_name_short}}-TemplateBased-ProxyVM
Example entry for Whonix-Gateway ™ TemplateVM.
whonix-gw-14 $default allow,target=sys-whonix
Example entry for Whonix-Workstation ™ TemplateVM.
whonix-ws-14 $default allow,target=sys-whonix
To test if it is fixed, run the following command in Whonix ™ TemplateVM.
sudo systemctl restart qubes-whonix-torified-updates-proxy-check
Then try to update / use apt-get again.
Reinstallation Fix[edit]
If the salt and manual fix attempts both fail, then follow the steps to Reinstall Qubes-Whonix ™ TemplateVMs. If reinstallation also fails, then ask for support in the Whonix ™ forums.
Development[edit]
The following development resources are recommended for interested readers:
- https://github.com/Whonix/qubes-whonix/blob/master/etc/uwt.d/40_qubes.conf
- https://github.com/Whonix/qubes-whonix/blob/master/usr/share/uwt/qubes_torfied_dom0.txt
- https://github.com/Whonix/qubes-whonix/blob/master/lib/systemd/system/qubes-whonix-torified-updates-proxy-check.service
- https://github.com/Whonix/qubes-whonix/blob/master/usr/lib/qubes-whonix/init/torified-updates-proxy-check
- https://github.com/QubesOS/qubes-core-admin/blob/master/qubes-rpc-policy/qubes.UpdatesProxy.policy
- https://github.com/Whonix/uwt
Footnotes[edit]
- ↑ This is required to make sure a recent version of Qubes repository definition files, Qubes salt as well as qubes-core-admin-addon-whonix gets installed.
- ↑ Dev/Qubes#salt
- ↑ Qubes R3.2 reached EOL on 28 March, 2019. It is strongly recommended to upgrade to Qubes R4.0 to stay safe.
No comments for now due to spam. Use Whonix forums instead.
Have you contributed to Whonix ™? If so, feel free to add your name and highlight what you did on the Whonix authorship page.
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.
Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)
Whonix ™ is a derivative of and not affiliated with Debian. Debian is a registered trademark owned by Software in the Public Interest, Inc.
Whonix ™ is produced independently from the Tor® anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else.
By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint.