Running Tails as a VM with persistence on Proxmox

In this guide I’ll explain how you can run Tails as a VM in Proxmox while retaining the persistence feature, and keeping support for Proxmox backups and snapshots.

Firstly, note that running Tails as a VM defeats a lot of the security features it offers, since you now need to trust the hypervisor to be secure. The VM’s memory could be swapped to disk in the host’s swapfile or persisted in a guest snapshot (if the “include RAM” option is ticked), which will leak the contents of the guest onto the host’s persistent storage, including secret encryption key material.

Consider your threat model carefully. If you don’t mind if the guest’s secrets are leaked to the host, and you just want to use Tails for its secure Tor browser environment, running it as a VM may be a reasonable choice. For me I consider this setup to be useful for e.g. submitting anonymous bug reports to companies that may not be thankful for them.

Create the VM

Create a new VM. During creation, attach no CD drive image to it. Set the BIOS to OVMF (UEFI) and the Machine to Q35 (this is just my preference), and add an EFI disk. Set SCSI Controller to VirtIO SCSI.

Once the VM is created, detach and delete its empty root disk, since we’ll be replacing it with a Tails USB image.

From the Tails website, download a USB stick image (e.g. using wget):

https://tails.boum.org/install/download/index.en.html

Expand the size of that image to suit your needs, but at least 8GB:

truncate -s 16384M tails-amd64-4.14.img

Now import it as a disk to your VM:

# Like so:
qm importdisk <vmid> tails-amd64-*.img <storage name>

# e.g.:
qm importdisk 108 tails-amd64-4.14.img local-lvm

This will add it to your VM’s “hardware” tab as an “unused disk”. Click that unused disk and then click the “Edit” button at the top of the page. Set it to be attached to SCSI 0:

Tails only wants to boot from a USB flash drive, so we need to replace this SCSI drive with a USB flash drive. Since Proxmox doesn’t support this natively, we need to do it using the VM “args” instead.

Run qm showcmd 1xx --pretty (replace 1xx with your VM ID) to see the command Proxmox will use to launch the VM. In that output, find the definition Proxmox created for the SCSI drive, specifically these two lines:

qm showcmd 108 --pretty
...
   -drive 'file=/dev/zvol/rpool/vms/vm-108-disk-0,if=none,id=drive-scsi0,format=raw,cache=none,aio=native,detect-zeroes=on' \
   -device 'scsi-hd,bus=scsihw0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0,id=scsi0' \

Now edit your VM’s config file (in /etc/pve/qemu-server/1xx.conf), and add a new “args:” line to it.

Firstly we’ll mark the original SCSI disk as read-only so the guest doesn’t accidentally try to modify it simultaneously with the USB version of the same backing file:

-set drive.drive-scsi0.readonly=on

Now we’ll add a -drive argument that mimics the original -drive argument we got from showcmd. We just need to change the “id” argument of the original to “drive-usb0”:

-drive 'file=/dev/zvol/rpool/vms/vm-108-disk-0,if=none,id=drive-usb0,format=raw,cache=none,aio=native,detect-zeroes=on'

Finally, we attach this drive as a new “usb-storage” removable flash drive. This has “bootindex” set to 1 so it’ll become the new default boot drive:

 -device 'usb-storage,drive=drive-usb0,bootindex=1,removable=on'

Put those all together on one line like so:

args: -set drive.drive-scsi0.readonly=on -drive 'file=/dev/zvol/rpool/vms/vm-108-disk-0,if=none,id=drive-usb0,format=raw,cache=none,aio=native,detect-zeroes=on' -device 'usb-storage,drive=drive-usb0,bootindex=1,removable=on'

Tails should now boot successfully!

Enabling persistence

The partition table of the root disk needs to be extended to fill the disk before Tails will be able to set up the persistent volume. When booting Tails, choose the Additional Setting to set an administration password:

Then once Tails boots, go to Applications > System Tools > Root Terminal.

Run ” gdisk /dev/sdb “, then type “w” and press enter, and answer “Y” when it asks you “Secondary header is placed too early on the disk! Do you want to correct this problem?”, and “Y” again to confirm:

Now you can use the wizard in Applications > Tails > Configure Persistent Volume to set up persistence.

10 thoughts on “Running Tails as a VM with persistence on Proxmox”

  1. Hello,

    First, thanks !

    Doesn’t works here, when i import with qm importdisk :

    importing disk ‘tails-amd64-4.14.img’ to VM 107 …
    Rounding up size to full physical extent 4.00 MiB

    4.00 MiB… why ? 😐

  2. It works but can’t setup the persistence into Tails

    “Error creatig partition on /dev/sdb: Failed add parition to device /dev/sdb (Unable to satisfy all constraints on the partition)”

    1. Sorry about that, I must have been testing with a disk image that was already partitioned. I’ve added a new section to the end of the blog now that should fix that issue up.

  3. Tested and get the same error:

    β€œError creatig partition on /dev/sdb: Failed add parition to device /dev/sdb (Unable to satisfy all constraints on the partition)”

  4. I wish this guide was a little more simple to understand. im having a hard time following it. Can you make a youtube video please?

    1. Sorry, it takes too much time to keep a video tutorial up to date as the software gets updated, so I avoid producing those.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.