Debian 9 as a Domain

As described previously, you can install a domain for Debian 9 or the Tor distribution Whonix [13], which further secures Internet browsing and routes all data packets through the Tor network (Figure 6). Switch newly created or cloned AppVMs from Fedora 26 to Debian 9 through their settings. To make this change, the AppVM must be inactive. After restarting the domains, Debian packages and commands will be available in the AppVM (Figure 7).

Figure 6: A red border around the browser window indicates the user is using the Tor network via Whonix.

Figure 7: You can change the template associated with a qube. Here the LinuxUser VM is no longer based on Fedora 26 but on Debian 9.

You can also set up Qubes OS to multiboot with Linux and/or Windows. However, this undertaking is not entirely trivial and requires special attention. The developers actually advise against dual booting in the project documentation [14]. Qubes feels most comfortable as the sole ruler of the hard disk. By the way, the distribution refuses to install in VirtualBox.

Conclusions

Qubes OS in combination with the anonymizing Whonix probably offers the most secure operating system on the market. In combination with a Purism Librem notebook, security is further increased by using coreboot, TPM, and kill switches. For security enthusiasts and other users who take security seriously, Qubes OS is a powerful alternative.

Qubes is not designed for Linux newcomers: The system is still far away from the stated goal of developer Joanna Rutkowska to make the system as easy to use as Ubuntu. At the moment, Linux professionals will still need a few days to familiarize themselves with the system. For Qubes OS 4.1, the team is working on its own GUI domain, which should reduce the size of dom0 and thus further reduce exposure. In addition, the distribution will someday support other hypervisors, such as KVM.