Document Kali Linux VM creation

[andrewdavidwong]

@Jeeppler wrote:

Katooline allows you to install Kalilinux tools in Debian. With other words
is allows you to turn a existing Debian VM into a Kalilinux VM.

The steps for Qubes OS are:

1. Create a new AppVM and set the mark on standalone option in the GUI
   dialog

2. Follow the installation instructions for Katoolin:

   http://www.tecmint.com/install-kali-linux-tools-using-katoolin-on-ubuntu-debian/

3. Install the packages you want to have

The advantage of this approach is, that the Qubes OS developers or any
community member does not have to maintain an extra distribution for Qubes OS.

If this works and turns out to be a good way to create Kali Linux VMs in Qubes, it should be documented.

[andrewdavidwong]

Related thread: https://groups.google.com/d/topic/qubes-users/abycwxvHYSM/discussion

[andrewdavidwong]

Related thread: https://groups.google.com/d/topic/qubes-users/abycwxvHYSM/discussion

[andrewdavidwong]

Achim Patzner:

You might add that there are other options besides this (e. g. using PTF) which might not be as devastating to /usr (i. e. don’t necessarily require their own template).

[andrewdavidwong]

Achim Patzner:

You might add that there are other options besides this (e. g. using PTF) which might not be as devastating to /usr (i. e. don’t necessarily require their own template).

[Vfreeze31]

Added some content to the starting page for the Kali Guide. Not sure how good it is but hopefully it can be the start for something.

[Vfreeze31]

Added some content to the starting page for the Kali Guide. Not sure how good it is but hopefully it can be the start for something.

[Jeeppler]

Do you have a link?

[Jeeppler]

Do you have a link?

[andrewdavidwong]

Thanks, @Vfreeze31! It looks like a good start. Merged: QubesOS/qubes-doc@bc433f4

[andrewdavidwong]

Thanks, @Vfreeze31! It looks like a good start. Merged: QubesOS/qubes-doc@bc433f4

[andrewdavidwong]

@Jeeppler, here's the link: https://www.qubes-os.org/doc/kali/

[andrewdavidwong]

@Jeeppler, here's the link: https://www.qubes-os.org/doc/kali/

[crypt0beard]

Andrew,

Has anyone tested these instructions? If not, I can do so as well as document it.

[crypt0beard]

Andrew,

Has anyone tested these instructions? If not, I can do so as well as document it.

[andrewdavidwong]

@crypt0beard: That would be great, thanks! I don't know whether anyone else has tested them yet. (@Jeeppler, @Vfreeze31?)

[andrewdavidwong]

@crypt0beard: That would be great, thanks! I don't know whether anyone else has tested them yet. (@Jeeppler, @Vfreeze31?)

[Jeeppler]

I tested the Kalilinux installation with Katoolin. I also took some screenshots.

I run into some issues with some packages LionSec/katoolin#21, but overall it was successful.

I was not using the instructions from qubes-doc Kali. There are some steps missing. I will update the documentation this weekend.

@crypt0beard I would be happy if you could test the updated instructions.

[Jeeppler]

I tested the Kalilinux installation with Katoolin. I also took some screenshots.

I run into some issues with some packages LionSec/katoolin#21, but overall it was successful.

I was not using the instructions from qubes-doc Kali. There are some steps missing. I will update the documentation this weekend.

@crypt0beard I would be happy if you could test the updated instructions.

[crypt0beard]

@Jeeppler Sure thing, I will keep an eye out for the updated instructions.

[crypt0beard]

@Jeeppler Sure thing, I will keep an eye out for the updated instructions.

[Vfreeze31]

Thank you for your work @Jeeppler, we appriciate all you can do to assist.

I am sorry as I did not test as currently I do not have a qubes system to test them on and these kinds of instructions do need to be tested.

[Vfreeze31]

Thank you for your work @Jeeppler, we appriciate all you can do to assist.

I am sorry as I did not test as currently I do not have a qubes system to test them on and these kinds of instructions do need to be tested.

[Jeeppler]

@andrewdavidwong where shall I put screenshots or other images in qubes-doc?

[Jeeppler]

@andrewdavidwong where shall I put screenshots or other images in qubes-doc?

[andrewdavidwong]

Please submit a pull request to add them (in a directory named "Kali") here.

[andrewdavidwong]

Please submit a pull request to add them (in a directory named "Kali") here.

[Jeeppler]

how shall I link them?

[Jeeppler]

how shall I link them?

[crypt0beard]

If you want to send them directly to me for testing I can take a look at them, as far as putting up online I would talk to the Qubes guys.
On Jun 10, 2016 19:18, Jeppler notifications@github.com wrote:how shall I link them?

—You are receiving this because you were mentioned.Reply to this email directly, view it on GitHub, or mute the thread.

[crypt0beard]

If you want to send them directly to me for testing I can take a look at them, as far as putting up online I would talk to the Qubes guys.
On Jun 10, 2016 19:18, Jeppler notifications@github.com wrote:how shall I link them?

—You are receiving this because you were mentioned.Reply to this email directly, view it on GitHub, or mute the thread.

[andrewdavidwong]

@Jeeppler:

how shall I link them?

Using standard Markdown notation. Take a look at the way it's done on this page, for example:

![fork](/attachment/wiki/doc-edit/05-fork.png)

[andrewdavidwong]

@Jeeppler:

how shall I link them?

Using standard Markdown notation. Take a look at the way it's done on this page, for example:

![fork](/attachment/wiki/doc-edit/05-fork.png)

[Jeeppler]

@andrewdavidwong thanks

[Jeeppler]

@andrewdavidwong thanks

[lorenzog]

Hi all,

I've cleaned up the instructions and added my own notes. I have a repo forked here: https://github.com/lorenzog/qubes-doc/blob/master/managing-os/kali.md

Please note that it's not yet stable - while I can safely add tools to my Kali template, I cannot add e.g. kali-linux-full because it requires desktop components that depend on a newer X server which will break qubes-agent because it wasn't compiled for it.

Any feedback more than welcome.

[lorenzog]

Hi all,

I've cleaned up the instructions and added my own notes. I have a repo forked here: https://github.com/lorenzog/qubes-doc/blob/master/managing-os/kali.md

Please note that it's not yet stable - while I can safely add tools to my Kali template, I cannot add e.g. kali-linux-full because it requires desktop components that depend on a newer X server which will break qubes-agent because it wasn't compiled for it.

Any feedback more than welcome.

[Jeeppler]

@lorenzog what package produces the issue?

[Jeeppler]

@lorenzog what package produces the issue?

[lorenzog]

@Jeeppler if I pin xserver-xorg* and xorg* to debian jessie, then that's what happens:

• Trying to install kali-linux-web fails because it depends on kali-linux
• Trying to install kali-linux failes because it depends on kali-desktop-common
• Trying to install kali-desktop-common fails because it depends on xserver-xorg-legacy
• Trying to install xserver-xorg-legacy fails because it would remove qubes-core-agent, xserver-xorg-core, xserver-xorg-input-all

At that point I stopped as qubes-core-agent is important.

I think the next step would be to try to recompile it as a debian package against the xorg provided by kali, and see what happens.

[lorenzog]

@Jeeppler if I pin xserver-xorg* and xorg* to debian jessie, then that's what happens:

• Trying to install kali-linux-web fails because it depends on kali-linux
• Trying to install kali-linux failes because it depends on kali-desktop-common
• Trying to install kali-desktop-common fails because it depends on xserver-xorg-legacy
• Trying to install xserver-xorg-legacy fails because it would remove qubes-core-agent, xserver-xorg-core, xserver-xorg-input-all

At that point I stopped as qubes-core-agent is important.

I think the next step would be to try to recompile it as a debian package against the xorg provided by kali, and see what happens.

[cyrinux]

Hi, @lorenzog I have follow and do a merge request on your guide for add apt-get update && apt-get dist-upgrade, after this all works

[cyrinux]

Hi, @lorenzog I have follow and do a merge request on your guide for add apt-get update && apt-get dist-upgrade, after this all works

[Jeeppler]

I actually created a guide for Kalilinux with and without Katoolin as well as for PTF and BlackArch. I will create a pull request as soon as I finish the documentation for #911 too.

Installing the kali-linux package is a problem for me too, but it does not want to remove all the qubes-packages. Kali seems to reconfigure some Xorg settings.

[Jeeppler]

I actually created a guide for Kalilinux with and without Katoolin as well as for PTF and BlackArch. I will create a pull request as soon as I finish the documentation for #911 too.

Installing the kali-linux package is a problem for me too, but it does not want to remove all the qubes-packages. Kali seems to reconfigure some Xorg settings.

[Jeeppler]

I created a pull request in qubes-doc and qubes-attachment for the documentation.

[Jeeppler]

I created a pull request in qubes-doc and qubes-attachment for the documentation.

[lorenzog]

@cyrinux so after the apt-get update and dist-upgrade, can you install kali-linux-all and run the appVM normally i.e. launching terminals from Qubes?

[lorenzog]

@cyrinux so after the apt-get update and dist-upgrade, can you install kali-linux-all and run the appVM normally i.e. launching terminals from Qubes?

[cyrinux]

No lorenzo you are right but I can install the package. Without this I
can't install it. For the moment only access via xl console work. There is
yet xorg problem?

Le ven. 17 juin 2016 10:43, Lorenzo G. notifications@github.com a écrit :

@cyrinux https://github.com/cyrinux so after the apt-get update and
dist-upgrade, can you install kali-linux-all and run the appVM normally
i.e. launching terminals from Qubes?

—
You are receiving this because you were mentioned.

Reply to this email directly, view it on GitHub
#1981 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AAfrqyVg7uCT51YWGZuGr-h7CDzcsG3sks5qMl5JgaJpZM4Ibt0v
.

[cyrinux]

No lorenzo you are right but I can install the package. Without this I
can't install it. For the moment only access via xl console work. There is
yet xorg problem?

Le ven. 17 juin 2016 10:43, Lorenzo G. notifications@github.com a écrit :

@cyrinux https://github.com/cyrinux so after the apt-get update and
dist-upgrade, can you install kali-linux-all and run the appVM normally
i.e. launching terminals from Qubes?

—
You are receiving this because you were mentioned.

Reply to this email directly, view it on GitHub
#1981 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AAfrqyVg7uCT51YWGZuGr-h7CDzcsG3sks5qMl5JgaJpZM4Ibt0v
.

[andrewdavidwong]

User "NewbieG" has reported a couple of problems when attempting to follow the existing instructions:

First one, works ok if you run kali from DVD without installing it. If I try
to install it, login window flickers and once logged on, the desktop shows up
'misplaced' (see attach).

Second one, as someone already pointed out in the list, introduces conflicts
between X packages from kali and X packages from the debian-9 template.

[andrewdavidwong]

User "NewbieG" has reported a couple of problems when attempting to follow the existing instructions:

First one, works ok if you run kali from DVD without installing it. If I try
to install it, login window flickers and once logged on, the desktop shows up
'misplaced' (see attach).

Second one, as someone already pointed out in the list, introduces conflicts
between X packages from kali and X packages from the debian-9 template.

[desmond-decker]

Confirmed neither installation method works. Installing as a HVM from an ISO or installing the packages into a debian-8 template as directed both result in unusable Kali VMs.

[desmond-decker]

Confirmed neither installation method works. Installing as a HVM from an ISO or installing the packages into a debian-8 template as directed both result in unusable Kali VMs.

[Jeeppler]

@desmond-decker how did you install the packages into your debian-8 template? What is a usable "Kali VM" for you?

[Jeeppler]

@desmond-decker how did you install the packages into your debian-8 template? What is a usable "Kali VM" for you?

[andrewdavidwong]

On 2016-10-07 00:37, petorian wrote:

I was wondering if anyone else is experiencing problems with installing Kali on a HVM in Qubes. When I boot the fresh installed Kali HVM i see the logon screen fine, but after that I see the top op the screen in the lower 10% of the window

[andrewdavidwong]

On 2016-10-07 00:37, petorian wrote:

I was wondering if anyone else is experiencing problems with installing Kali on a HVM in Qubes. When I boot the fresh installed Kali HVM i see the logon screen fine, but after that I see the top op the screen in the lower 10% of the window

[yilmi]

@lorenzog @cyrinux :

The package breaking qubes-gui is pulled by kali-linux meta-packages (xserver-xorg-legacy).

xserver-xorg-legacy installs the Xorg suid wrapper meant to keep compatibility with some video drivers (see https://lists.x.org/archives/xorg-devel/2014-March/040874.html)

When we run /usr/bin/Xorg (shell script) it will check if Xorg.wrap exists, if the wrapper is available it will always run it.

You have to change the default wrapper configuration in /etc/X11/Xwrapper.conf:

allowed_users = anybody
needs_root_rights = no

Reboot your VM and test gui

After some checks, I found that :

• Xwrapper configuration is already set for fedora templates
• In debian jessie /usr/bin/Xorg is a binary, In stretch they have changed it to the shell script version (check for wrapper and run it)

@andrewdavidwong : Could you open a new issue to push this configuration on debian stretch ?

[yilmi]

@lorenzog @cyrinux :

The package breaking qubes-gui is pulled by kali-linux meta-packages (xserver-xorg-legacy).

xserver-xorg-legacy installs the Xorg suid wrapper meant to keep compatibility with some video drivers (see https://lists.x.org/archives/xorg-devel/2014-March/040874.html)

When we run /usr/bin/Xorg (shell script) it will check if Xorg.wrap exists, if the wrapper is available it will always run it.

You have to change the default wrapper configuration in /etc/X11/Xwrapper.conf:

allowed_users = anybody
needs_root_rights = no

Reboot your VM and test gui

After some checks, I found that :

• Xwrapper configuration is already set for fedora templates
• In debian jessie /usr/bin/Xorg is a binary, In stretch they have changed it to the shell script version (check for wrapper and run it)

@andrewdavidwong : Could you open a new issue to push this configuration on debian stretch ?

[lorenzog]

Hi all,

I was able to generate a fully working Kali linux template on Qubes OS 3.2. No conflicts with xorg and the like.

Instructions: https://github.com/lorenzog/qubes-doc/blob/master/managing-os/kali.md

[lorenzog]

Hi all,

I was able to generate a fully working Kali linux template on Qubes OS 3.2. No conflicts with xorg and the like.

Instructions: https://github.com/lorenzog/qubes-doc/blob/master/managing-os/kali.md

[andrewdavidwong]

@lorenzog: Have you considered submitting a PR for those?

[andrewdavidwong]

@lorenzog: Have you considered submitting a PR for those?

[lorenzog]

@andrewdavidwong I will, but I thought to get some feedback in case I missed something first. Let me know if you think I can go ahead and submit it right away

[lorenzog]

@andrewdavidwong I will, but I thought to get some feedback in case I missed something first. Let me know if you think I can go ahead and submit it right away

[andrewdavidwong]

@lorenzog Getting feedback first is a good idea. :)

[andrewdavidwong]

@lorenzog Getting feedback first is a good idea. :)

[Jeeppler]

@lorenzog

1. You decribe only how to create a template, therefor your title is missleading. You also forget to mention that people are able to create a standalone vm with the help of your guide.
2. Instead of getting the GPG Key at the beginning I highly recommend you do insert the section between step 4 and 5 where you actually need the key.
3. "Ideally, verify the fingerprint through other channels" -> name other possible channels or don't mention it.
4. Your Debian installation link does not work
5. Your link to the Reddit page is maybe funny, but unecessary and people do not always get irony
6. Alternative Options -> There is already a guide for PTF and BlackArch

[Jeeppler]

@lorenzog

1. You decribe only how to create a template, therefor your title is missleading. You also forget to mention that people are able to create a standalone vm with the help of your guide.
2. Instead of getting the GPG Key at the beginning I highly recommend you do insert the section between step 4 and 5 where you actually need the key.
3. "Ideally, verify the fingerprint through other channels" -> name other possible channels or don't mention it.
4. Your Debian installation link does not work
5. Your link to the Reddit page is maybe funny, but unecessary and people do not always get irony
6. Alternative Options -> There is already a guide for PTF and BlackArch

[lorenzog]

Hi @Jeeppler, thanks for the comments.

I've incorporated a few of them and ignored others I don't agree with.

You decribe only how to create a template, therefor your title is missleading. You also forget to mention that people are able to create a standalone vm with the help of your guide.

I've added a subsection at the bottom, but item 4 of the first section clearly says "use the template to build AppVMS". Do you think it's clearer now?

Instead of getting the GPG Key at the beginning I highly recommend you do insert the section between step 4 and 5 where you actually need the key.

I disagree, the GPG key should be fetched once and its step is a prerequisite, doesn't belong in the main flow.

"Ideally, verify the fingerprint through other channels" -> name other possible channels or don't mention it.

The Kali installation page suggests this step and I think it's extremely important. However this howto is not the right place to tell people how to do it, so I've added a sentence to my text telling the user to "verify the fingerprint through other channels as recommended on that link."

Your Debian installation link does not work

Thanks, fixed.

Your link to the Reddit page is maybe funny, but unecessary and people do not always get irony

Meh :) You're right, I've removed it.

Alternative Options -> There is already a guide for PTF and BlackArch

Updated, but I don't think it's necessary here.

[lorenzog]

Hi @Jeeppler, thanks for the comments.

I've incorporated a few of them and ignored others I don't agree with.

You decribe only how to create a template, therefor your title is missleading. You also forget to mention that people are able to create a standalone vm with the help of your guide.

I've added a subsection at the bottom, but item 4 of the first section clearly says "use the template to build AppVMS". Do you think it's clearer now?

Instead of getting the GPG Key at the beginning I highly recommend you do insert the section between step 4 and 5 where you actually need the key.

I disagree, the GPG key should be fetched once and its step is a prerequisite, doesn't belong in the main flow.

"Ideally, verify the fingerprint through other channels" -> name other possible channels or don't mention it.

The Kali installation page suggests this step and I think it's extremely important. However this howto is not the right place to tell people how to do it, so I've added a sentence to my text telling the user to "verify the fingerprint through other channels as recommended on that link."

Your Debian installation link does not work

Thanks, fixed.

Your link to the Reddit page is maybe funny, but unecessary and people do not always get irony

Meh :) You're right, I've removed it.

Alternative Options -> There is already a guide for PTF and BlackArch

Updated, but I don't think it's necessary here.

[andrewdavidwong]

People are still reporting problems with only the bottom 10% of the Kali HVM window showing:

• #2761
• https://groups.google.com/d/topic/qubes-users/L-CKlk7auMQ/discussion

I find this puzzling, since I thought this was supposed to have been fixed in #2370 or #260 (or the combination of the two). What's going on? Are people just not following the working instructions that were merged in #260, or is something still broken?

CC @marmarek, @lorenzog, @Jeeppler

[andrewdavidwong]

People are still reporting problems with only the bottom 10% of the Kali HVM window showing:

• #2761
• https://groups.google.com/d/topic/qubes-users/L-CKlk7auMQ/discussion

I find this puzzling, since I thought this was supposed to have been fixed in #2370 or #260 (or the combination of the two). What's going on? Are people just not following the working instructions that were merged in #260, or is something still broken?

CC @marmarek, @lorenzog, @Jeeppler

[lorenzog]

@andrewdavidwong this used to happen to me too so instead of fighting with Linux display drivers like it's 1995 again I went on and made the Kali template instead :) I haven't used Kali in a HVM since.

[lorenzog]

@andrewdavidwong this used to happen to me too so instead of fighting with Linux display drivers like it's 1995 again I went on and made the Kali template instead :) I haven't used Kali in a HVM since.

[Jeeppler]

@andrewdavidwong I had the same reason as @lorenzog to create a Kali template and because I wanted to be able to use the qubes tools (qvm-copy..., qvm-move... etc.)

However, I can understand that people would like to have the well sorted menu from Kali's Gnome Desktop. Adding dozens of tools via "add/remove app shortcut" will take a long time.

[Jeeppler]

@andrewdavidwong I had the same reason as @lorenzog to create a Kali template and because I wanted to be able to use the qubes tools (qvm-copy..., qvm-move... etc.)

However, I can understand that people would like to have the well sorted menu from Kali's Gnome Desktop. Adding dozens of tools via "add/remove app shortcut" will take a long time.

[andrewdavidwong]

@lorenzog, @Jeeppler: Ok, thanks for that info. In that case, it looks like this issue is completed, so I'll close it. I'll also reopen #2761 to track that problem separately.

[andrewdavidwong]

@lorenzog, @Jeeppler: Ok, thanks for that info. In that case, it looks like this issue is completed, so I'll close it. I'll also reopen #2761 to track that problem separately.

[ppiotr3k]

@andrewdavidwong, @lorenzog, @Jeeppler: I've added some polishing to the contributions you've already made on creating a Kali TemplateVM, see QubesOS/qubes-doc#431

For me, one of the essential needed improvements has been adding TemplateVM trimming/compacting in the instructions. In the TemplateVM instructions, a clone/upgrade is performed twice, thus a trimming saves several GB of disk space.

[ppiotr3k]

@andrewdavidwong, @lorenzog, @Jeeppler: I've added some polishing to the contributions you've already made on creating a Kali TemplateVM, see QubesOS/qubes-doc#431

For me, one of the essential needed improvements has been adding TemplateVM trimming/compacting in the instructions. In the TemplateVM instructions, a clone/upgrade is performed twice, thus a trimming saves several GB of disk space.