G'day and Good Year.

I have encountered the idea that there might be security benefits from keeping my adventurous Internet browsing and my Internet commercial transactions (e.g. shopping, banking) on separate machines. I wondered if these separate machines could be VMs.

I also read that while it is convenient to access these VMs using VNC, VNC's access is less secure than it might be, and can be improved by a mysterious magic called "SSH tunneling". This would offer some protection against others on my network (guests, neighbours, wardrivers in the street outside, miscreants infiltrating my media player(s) or IoT lightbulbs, etc) possibly reading the unencrypted VNC traffic.

This hypothesis was stated on the Internet, so it must be true. I mean, all Internet statements are true, not so?

So...trying the VM route, I have at my disposal

1) A Linux computer I refer to as my "PC" (it's a bit feeble to be a VM Host)

2) A Linux computer I refer to as my "VM Host"  (Powerful, noisy, clumsy to work with)

3) A number (1 is a number, OK?) of "VM"s which can be run on the "VM Host"

Currently, to set the scene: I sit at my PC, and connect to my VM Host with an SSH tunnel via the incantation:

ssh -L 5901:localhost:5901 -l <VM Host userid> <VM Host IP>

This gives me a terminal on the VM Host, where I spin up a live VM thusly:

qemu-system-x86_64 <..so..many..parameters..> -vnc :1

To access the desktop (and therefore the browser) on this VM, I fire up remmina on the PC, select VNC connection method, and point this at

localhost:5901

This opens up the VM's desktop in the PC's VNC client window and I can browse OR transact. With multiple VMs, I could keep these activities separate.

My question is:

1) Am I benefitting from the magical protection of "SSH tunneling" in my interactions all the way between my PC VNC client and the VM desktop?

or

2) Does this protection only extend to the connection between the PC VNC client and the VM Host, leaving communication between the VM Host and the VM itself protected only by VNC security? Perhaps I need to create another SSH tunnel on the VM host?

My interpretation is that it is the first option. That is: SSH tunneling covers the comms between remmina i.e. the VNC client on my PC, to qemu-system on the VM Host, and that is everything I need, because the VM exists only in qemu-system. There is no unsecured comms between qemu-system and the VM, because the VM does not exist outside qemu-system.

I understand that a lot of other threats are being ignored, but my interest, for now, is in the extent of the SSH tunnel's protection.

I hope I've explained it clearly enough to receive some feedback that I can actually understand, though my powers of understanding are quite feeble.

Greetings, Dev-Ones

I installed Chimaera 64 bit with runit and SLiM, and added a static IP address for eth0 to /etc/network/interfaces. SliM was later swapped out in favour of lightdm. Eth0 seems to be a "Realtek RTL8111/8168/8411"  device with driver "r8169"

My /etc/apt/sources.list starts with

# deb cdrom:[Devuan GNU/Linux 4.0 chimaera amd64 - desktop 20210906]/ chimaera contrib main non-free

so I assume that's the vintage of the beta that was installed.

I noticed occasional errors while webbrowsing "Hmm. We’re having trouble finding that site....We can’t connect to the server" etc

I tried a few pings, and noticed the occasional dropped packet. But pings are like salted snacks, you can't have just one.

To remove the uncertainty associated with pinging unreliable, fly-by-night organisations on the Web (e.g. Facebook) I ping my ADSL router/gateway/DHCP server device by IP number.

Eventually, I noticed that if I use DHCP to assign an address, the percentage of dropped packets is usually 0, never over 1. However, with a static
IP assigned in /etc/network/interfaces, the dropped packets percentage is very often between 5 and 50.

I then removed the static eth0 address from /etc/network/interfaces, and tried to assign the static IP using NetworkManager. The dropping of packets continued.

The issue seems to be that something about static IP (OK, my setup of static IP) makes networking unreliable (not broken, just 5-50% unreliable). This seems consistent whether eth0 is managed by NetworkManager or /etc/network/interfaces

Has anyone else noticed anything like this?  In particular...has anyone solved this with one simple trick? It will have to be simple.

Maybe someone can point me to a foolproof, painstakingly detailed and yet laughably simple guide for assigning static IP via NetworkManager?
Maybe I'm just holding it wrong.

Hi All

Chimaera (64-bit,runit) seems to be working out quite nicely, despite beta status, but there are one or 2 niggles - perhaps I am missing something?

I notice the Switch Users option seems to be greyed out (or grayed out) in the Action Buttons area of my panel. I read somewhere on the Internet (so it must be true) that SLiM does not actually offer User Switching.  I would really like to be able to easily switch between graphical desktops as my partner and I use the same PC with different usernames.  What options are there?

It seems I can use CTRL+ALT+Fx to get to another tty, logon there as a different user, and invoke "startx". This brings up the desktop of the newly-logged-in user. It feels a bit hacky, but that's not too abysmal. Are there any possible pitfalls to using this method in day-to-day sharing-is-caring computer operations?

In a previous life with another distro, and presumably another display manager, I was able to access both a "Switch Users" button, and also to use the "Action Buttons" / "Lock Screen" function which gave me a "New Login" button. This would then allow the other user to enter their credentials. However, in my current dispensation, this gives me the disappointing message

xscreensaver: <time> could not execute "dm-tool": no such file or directory

I assume this below is apt telling me that dm-tool is part of lightdm? (If so, that's a nice feature of apt.)

apt search dm-tool
Sorting... Done
Full Text Search... Done
lightdm/testing 1.26.0-7+devuan3 amd64
  simple display manager

Is there an equivalent available for SLiM?