The Ultimate Crypto Fortress: Can we get official Qubes OS + Trezor Suit Guide?

Feedback and suggestions
1

Hi Trezor Team and Community,

I’m writing to request an official, step-by-step tutorial on how to install and safely use Trezor Suite on Qubes OS.

In my opinion, combining a hardware wallet like Trezor with a security-oriented operating system like Qubes OS creates the ultimate setup for crypto security. Qubes’ compartmentalization (VM isolation) paired with Trezor’s offline key storage is a match made in heaven for anyone serious about cold storage and operational security.

However, setting up USB passthrough, dependencies, and AppVM/TemplateVM configurations in Qubes OS can be tricky for many users, and having an official guide from the Trezor team would ensure everyone follows the absolute best practices without compromising security.

A dedicated guide covering:

  • Setting up the Trezor dependencies/rules in a TemplateVM.

  • Configuring USB device passthrough (sys-usb to AppVM) correctly.

  • Recommended AppVM security settings for running Trezor Suite.

…would be an incredible resource for the community!

Is there any chance we could get an official guide or blog post on this in the near future? I’m sure many Qubes OS users in the community would deeply appreciate it!

Thanks for all the great work you do!

P.S. I managed to get the wallet connected, but it seems like one-way communication: Trezor Suite detects the device, but I cannot perform any operations (such as firmware updates, signing, etc.), getting ““Unknown error”..

3 Likes
2

This will also help me

2 Likes
3

Great, that makes two of us :smiley: Anyone else interested?

4

Yes i am interested and this will help me also

2 Likes
5

Anyone was trying to solve the connectivity issue ? Or has any clue how to set Qubes OS to work with Trezor Suite ? :thinking:

6

Ok so after some testing, I was able to run Trezor Suit with full access to USB wallet, all seams to work fine.

Unfortunately to do that I had to install Trezor Suit inside ‘sys-usb’ qube as only this cube has full USB access, and had to enable internet access to this qube [not recommended for long period].

I would highly recommended getting PCI-E expansion card with extra USB ports, and by doing that you should get two USB controllers in you system.

One standard, always used in sys-usb for keyboards, mouse etc
Second PCI-E ones for Trezor only, attached to your custom qube.

I’m aware this is not perfect solution for users using laptops where you can’t expand your hardware much…

Currently testing on Lenovo P3Tiny, ordered USB expansion card, will check it when arrive.

7

I created an account specifically to raise my hand and bring attention to this issue. I would like a working guide for a Trezor / Qubes / Whonix / Trezor Suite setup as well. It seems that Trezor used to have support documents for this, but they were redacted, or deprecated. Please write a guide for a working Trezor Suite / Qubes / Whonix guide Trezor Team! Thanks!

1 Like
9

forum_qubes-os_org/t/ultimate-guide-on-using-trezor-on-qubes/18310/99

10

Ok so I did something different, after fresh install of Qubes OS I made a copy of ‘debian-13-xfce’ TempleteVM and renamed it ‘debian-13-xfce-t’.
Made a copy ‘default-dvm’ and renamed it ‘default-dvm-t’.
Then started ‘debian-13-xfce-t’ with internet access… and installed Trezor Suite with terminal as per official guideline for ubuntu

sudo apt install trezor
sudo apt install libfuse2

Then I downloaded AppImage for Linux

Then I had to move AppImage file to the system-wide skeleton directory so it persists in template used by sys-usb :slight_smile:

sudo mkdir -p /etc/skel/Applications
sudo mv /home/user/Downloads/Trezor-Suite-*.AppImage /etc/skel/Applications/Trezor-Suite.AppImage
sudo chmod +x /etc/skel/Applications/Trezor-Suite.AppImage

Now you can stop ‘debian-13-xfce-t’ qube and disable internet access to it.
Next open setting for ‘default-dvm-t’ in Qubes Manager, and as Template select ‘debian-13-xfce-t’ from drop list.

Last thing is to change sys-usb template to ‘default-dvm-t’, you have to use Dom0 terminal for this command:

qvm-shutdown --wait sys-usb; qvm-prefs -s sys-usb template default-dvm-t; qvm-start sys-usb

So now what you have to do is open File Explorer in sys-usb qube, and double click on the Trezor-Suite app :slight_smile: (file explorer is opening like 10 sec, after that speed is normal, if it’s slow for you try increase memory setting for sys-usb qubes).

Remember to switch-on internet for sys-usb for the time you will use Trezor Suite, everything is working, checking wallet if it’s genuine, updating firmware etc., you don’t have to playing with USB widget to attach wallet to specific qube.

I know it’s not an ideal solution, but it allowed me to fully use the Trezor wallet. The SYS-USB qube is disposable; whatever might find its way in there gets wiped upon restart.

I am a beginner Qubes OS user, so please feel free to share any suggestions or concerns regarding this method.

Thanks