Backing up and restoring Workstations

Qubes OS has a backup utility that allows for backup and restoration of user-specified qubes and templates.

Warning

Backups contain sensitive data, and must be created and stored just as securely as SecureDrop Workstations.

To perform backups, you will need:

• a LUKS-encrypted USB flash or external hard drive (of sufficient size, if backing up additional local data)

• a secure place to store backup credentials (such as a password manager on your primary laptop)

Backup

Back up a Journalist Workstation

When backing up Journalist Workstation, there are four distinct sets of data you can back up:

1. The Submission Secret Key and SecureDrop Workstation config in dom0 (required)

2. The messages and files from SecureDrop Inbox stored in sd-app (optional)

   If you skip this step, all previous messages exchanged between Sources and Journalists, as well as any submitted files you have downloaded, will not be included in the backup. The first time you log in on a restored SecureDrop Workstation, everything will need to be re-downloaded from your SecureDrop server.

   This option is only recommended when performing a migration to a new SecureDrop Workstation installation (not for long-term storage).

3. The KeePassXC database containing Journalist credentials for accessing SecureDrop stored in sd-journalist-vault

4. Other customizations beyond the standard SecureDrop Workstation configuration provided by Freedom of the Press Foundation (optional)

   These may include additional qubes and their templates, custom RPC policies, etc.

   If you have additional customizations you wish to back up, we suggest capturing that as a separate backup without the Submission Secret Key, SecureDrop Workstation config file, or any messages and files from SecureDrop Inbox so that you can avoid proliferating copies of sensitive assets.

Note

Before starting your backup, decide whether you want to back up your data from sd-app, noting the caveats listed above.

Preserve files from dom0 and sd-gpg

Preserve configuration files and secret key material by copying them into dom0.

In a dom0 terminal opened via ▸ ▸ Other Tools ▸ Xfce Terminal:

qvm-run --pass-io sd-gpg 'gpg -a --export-secret-keys' > sd-keys.asc
mv sd-keys.asc ~/.config/securedrop-manage/

If you have made customizations to dom0 (for example, custom RPC policy files):

mkdir ~/etc-qubes && cp -r /etc/qubes ~/etc-qubes
mkdir ~/etc-qubes-rpc && cp -r /etc/qubes-rpc ~/etc-qubes-rpc

Select qubes to back up

Ensure your storage medium is plugged in, attached to sd-devices, and unlocked.

Navigate to ▸ ▸ Qubes Tools ▸ Backup Qubes, and move all qubes from Selected to Available by pressing the << button.

To target a qube for backup, highlight it and move it into the Selected column by pressing the > button. Select:

• dom0

• sd-journalist-vault

• the sd-app qube (optional)

• any customized qubes that you may wish to preserve, and their templates (optional)

If your Journalist Workstation also functions as an Admin Workstation, make sure to also select:

• the sd-admin qube

• the sd-admin-vault qube

You do not need to back up the other sd- qubes.

Perform the backup

Click Next, and in Backup destination, specify the sd-devices qube and directory corresponding to your storage medium’s current mount point.

Set a strong, unique backup encryption passphrase (7-word diceware), and ensure this passphrase is stored securely outside SecureDrop Workstation.

Note

This passphrase protects sensitive components of your SecureDrop instance, including the Submission Secret Key, and unencrypted submissions (if sd-app is backed up). Ensure it is a very strong password and is stored securely.

Uncheck save backup profile, then proceed with the backup.

Back up an Admin Workstation

The process for backing up an Admin Workstation is similar to the process for a Journalist Workstation, although here there are fewer sensitive assets that are copied.

To perform a backup of the Admin Workstation:

Back up the sd-admin qube

Ensure your storage medium is plugged in, attached to sd-devices, and unlocked.

Navigate to ▸ ▸ Qubes Tools ▸ Backup Qubes, and move all qubes from Selected to Available by pressing the << button.

Highlight the sd-admin and sd-admin-vault qubes, then move them into the Selected column by pressing the > button. You do not need to back up the other sd- qubes.

Click Next, then select the backup destination, set the encryption passphrase, and uncheck save backup profile as described previously in Perform the backup, then proceed with the backup.

Backing up a combined Admin + Journalist Workstation

To backup a combined Admin + Journalist Workstation, follow the steps to back up a Journalist Workstation, and include the sd-admin and sd-admin-vault qubes when selecting which qubes to back up.

Verify the backup

Qubes OS recommends verifying the integrity of the backup once the backup completes, and this should be done on the same machine where the backup was created. This can be done by using the Restore Backup GUI tool and selecting Test restore to verify backup integrity (no data actually restored). For details, see the Qubes OS backup documentation.

Warning

Any files or data not mentioned above and not backed up elsewhere are at risk of being lost or destroyed. Ensure that any other data on your system (for example, using KeepassXC in the vault qube, or data stored in other qubes) have been backed up and the integrity of the backup has been verified.

Restore

Reinstall Qubes OS

To restore a SecureDrop Admin, Journalist or combined Workstation, follow our pre-install tasks to provision a Qubes OS system complete with updated base templates, and download the SecureDrop Workstation packages.

Rename or delete redundant app qubes

By default, Qubes OS will create the app qubes personal, work, untrusted and vault as part of the installation process. Rename or delete any of these newly created app qubes whose names conflict with the app qubes you intend to restore from a backup.

Example: If you wish to restore the vault qube, rename or delete the existing vault qube prior to restoring the backup. You can do so in ▸ Apps ▸ vault ▸ Settings (the qube must not be running).

Restore backup (SecureDrop components)

Note

If you are migrating from one machine to another or from one version of Qubes OS to another, we suggest you wipe (reformat) or destroy the drive after you have successfully restored it onto the new machine (which should ideally happen the same day). In all cases, follow your organization’s internal policies on handling sensitive assets and information.

Plug in your backup medium, attach it to the sys-usb qube, and unlock it using the same process as during the backup.

Navigate to ▸ ▸ Qubes Tools ▸ Restore Backup, and enter the location of the backup file. You do not need to adjust the default Restore options, unless you have made customizations to the backup. Enter the decryption/verification passphrase, and proceed to restoring the available qubes.

If you are restoring a Journalist Workstation, you should ensure you restore:

• dom0

• sd-journalist-vault

• sd-app (optional)

If you are restoring an Admin Workstation, you should ensure you restore:

• sd-admin

• sd--admin-vault

If you are using a combination Journalist and Admin Workstation, restore all items listed above.

We suggest restoring only those qubes, provisioning SecureDrop, and then restoring any customized qubes you may have had once that process is complete. This way SecureDrop is provisioned on a clean system and can implement the security measures it requires before any additional qubes are configured.

Note

When migrating to a newer version of Qubes OS (for example, Qubes 4.1 to Qubes 4.2), you may notice that the original templates for certain qubes are not present on your new machine. For the purposes of this guide (optional sd-app backup), this is not a problem. Allow the qube to be restored with the default template suggested by the operating system (the current Fedora base template). Do not start the qube. Continue through the reinstallation process. The correct template will be configured as you follow the rest of these instructions.

If you are restoring your own customized qubes and templates, you will need to take additional steps. You may decide to create new templates for your custom qubes and provision them with the necessary applications/customizations (recommended), or you may upgrade your existing templates following the upstream documentation (Fedora templates, Debian templates), then upgrade their package repositories to the Qubes 4.2 repositories using:

sudo qubes-dom0-update -y qubes-dist-upgrade qubes-dist-upgrade --template-standalone --upgrade

More information can be found in the upstream documentation. Contact Support with any questions.

Re-apply Journalist Workstation installation

If you are restoring a Journalist Workstation, or a combined Admin + Journalist Workstation, you need to reinstall the additional Journalist Workstation components.

Retrieve the previous SecureDrop Workstation configuration from the backup folder on dom0. From the dom0 home directory:

ls -d */*/* | grep home-restore

You should see a directory called home-restore-$YYYY-MM-DD-HHMMSS/dom0-home/$USERNAME. We will call this $RESTORE_DIR in the instructions below.

cp ~/$RESTORE_DIR/securedrop-workstation-dom0-config/{sd-journalist.sec,config.json,sd-keys.asc} ~/.config/securedrop-manage/

Optionally, inspect each file before proceeding. The first file should be an ASCII-armored GPG secret key file. The second file should follow the format of the example configuration file, with values for its fields (e.g., hostname, submission_key_fpr) specific to your configuration. The file may be formatted in a single line without whitespace. The third file is a backup of key material from sd-gpg and will be moved into that qube when you have reprovisioned the system.

Verify that the configuration is valid:

securedrop-manage validate --target journalist

If the above command prints OK, the configuration is valid.

Reinstall SecureDrop:

securedrop-manage apply --target journalist

Restore additional keys to sd-gpg

If you are using a Journalist Workstation and have multiple Submission Keys, perform the following commands from a dom0 terminal:

qvm-copy-to-vm sd-gpg $RESTORE_DIR/securedrop-workstation-dom0-config/sd-keys.asc
qvm-run sd-gpg 'gpg --import /home/user/QubesIncoming/dom0/sd-keys.asc'

Re-apply Admin Workstation installation

If you are restoring an Admin Workstation, or a combined Admin + Journalist Workstation, you need to reinstall the additional Admin Workstation components.

securedrop-manage apply --target admin

Restore customized qubes, RPC policies

At this stage, you should have a functional Workstation of the desired type. You may restore any additional customizations or additional qubes, being mindful that you are responsible for the security implications of customizing this system.

Customizations in dom0 must be restored manually, meaning that any RPC policies you have added will need to be moved into place from the $RESTORE_DIR.

Once you are finished with the $RESTORE_DIR and have verified that your system works (download, decrypt, sync), you may delete the $RESTORE_DIR.

(Post-migration instructions) Destroy backup medium

Wipe (reformat) the LUKS-encrypted storage device that you used to store the SecureDrop configuration material.

The USB flash drives used for SecureDrop are all encrypted, either with LUKS or Veracrypt. To securely wipe this kind of storage media, it is necessary to re-format and re-encrypt the drive, following the same steps used in their initial creation. This will destroy the encryption headers, making any data on the drives unrecoverable.

You may also choose to destroy the drives by physical means, such as using a hammer or purpose-built shredder to pulverize the drive.