From b3d3b36a5c89dd772cf24d61a5d51bcce6eebf3d Mon Sep 17 00:00:00 2001 From: Tommy Date: Mon, 3 Feb 2025 08:42:42 -0700 Subject: [PATCH] Refactor Qubes OS category (#325) * Refactor Qubes OS category --- .../index.md} | 2 +- .../mirageos.png | Bin .../index.md} | 6 ++---- .../qubes/Using IVPN on Qubes OS}/ivpn.png | Bin .../provides-network.png | Bin .../index.md} | 2 +- .../Using Lokinet on Qubes OS}/lokinet.png | Bin .../index.md} | 6 ++---- .../mullvad-vpn.png | Bin .../provides-network.png | Bin 0 -> 33843 bytes .../index.md} | 4 ++-- .../keygrip.png | Bin .../split-gpg-ssh.png | Bin 13 files changed, 8 insertions(+), 12 deletions(-) rename content/posts/qubes/{Firewalling with MirageOS on Qubes OS.md => Firewalling with MirageOS on Qubes OS/index.md} (98%) rename {static/images => content/posts/qubes/Firewalling with MirageOS on Qubes OS}/mirageos.png (100%) rename content/posts/qubes/{Using IVPN on Qubes OS.md => Using IVPN on Qubes OS/index.md} (97%) rename {static/images => content/posts/qubes/Using IVPN on Qubes OS}/ivpn.png (100%) rename {static/images => content/posts/qubes/Using IVPN on Qubes OS}/provides-network.png (100%) rename content/posts/qubes/{Using Lokinet on Qubes OS.md => Using Lokinet on Qubes OS/index.md} (99%) rename {static/images => content/posts/qubes/Using Lokinet on Qubes OS}/lokinet.png (100%) rename content/posts/qubes/{Using Mullvad VPN on Qubes OS.md => Using Mullvad VPN on Qubes OS/index.md} (97%) rename {static/images => content/posts/qubes/Using Mullvad VPN on Qubes OS}/mullvad-vpn.png (100%) create mode 100644 content/posts/qubes/Using Mullvad VPN on Qubes OS/provides-network.png rename content/posts/qubes/{Using Split GPG and Split SSH on Qubes OS.md => Using Split GPG and Split SSH on Qubes OS/index.md} (97%) rename {static/images => content/posts/qubes/Using Split GPG and Split SSH on Qubes OS}/keygrip.png (100%) rename {static/images => content/posts/qubes/Using Split GPG and Split SSH on Qubes OS}/split-gpg-ssh.png (100%) diff --git a/content/posts/qubes/Firewalling with MirageOS on Qubes OS.md b/content/posts/qubes/Firewalling with MirageOS on Qubes OS/index.md similarity index 98% rename from content/posts/qubes/Firewalling with MirageOS on Qubes OS.md rename to content/posts/qubes/Firewalling with MirageOS on Qubes OS/index.md index fa0646a..3f226f5 100644 --- a/content/posts/qubes/Firewalling with MirageOS on Qubes OS.md +++ b/content/posts/qubes/Firewalling with MirageOS on Qubes OS/index.md @@ -5,7 +5,7 @@ tags: ['Operating Systems', 'MirageOS', 'Qubes OS', 'Security'] author: Tommy --- -![MirageOS](/images/mirageos.png) +![MirageOS](mirageos.png) [MirageOS](https://mirage.io/) is a library operating system with which you can create a unikernel for the sole purpose of acting as Qubes OS's firewall. In this post, I will walk you through how to set this up. diff --git a/static/images/mirageos.png b/content/posts/qubes/Firewalling with MirageOS on Qubes OS/mirageos.png similarity index 100% rename from static/images/mirageos.png rename to content/posts/qubes/Firewalling with MirageOS on Qubes OS/mirageos.png diff --git a/content/posts/qubes/Using IVPN on Qubes OS.md b/content/posts/qubes/Using IVPN on Qubes OS/index.md similarity index 97% rename from content/posts/qubes/Using IVPN on Qubes OS.md rename to content/posts/qubes/Using IVPN on Qubes OS/index.md index ae344a4..a2d1af0 100644 --- a/content/posts/qubes/Using IVPN on Qubes OS.md +++ b/content/posts/qubes/Using IVPN on Qubes OS/index.md @@ -5,7 +5,7 @@ tags: ['Applications', 'Qubes OS', 'Privacy'] author: Tommy --- -![IVPN](/images/ivpn.png) +![IVPN](ivpn.png) IVPN is a fairly popular and generally trustworthy VPN provider. In this post, I will walk you through how to use the official IVPN client in a ProxyVM on Qubes OS. We will deviate from the [official guide](https://www.ivpn.net/knowledgebase/linux/ivpn-on-qubes-os/) by using systemd path to handle DNAT. This will provide the same robustness as their approach to modify `/opt/ivpn/etc/firewall.sh`, while avoiding the risk that the modifications will be overwritten by a future app update. We will also be using a TemplateVM for IVPN ProxyVMs instead of using Standalone VMs. @@ -99,7 +99,7 @@ sudo shutdown now Create an AppVM based on the TemplateVM you have just created. Set `sys-firewall` (or whatever FirewallVM you have connected to your `sys-net`) as the net qube. If you do not have such FirewallVM, use `sys-net` as the net qube. Next, go to the advanced tab and tick the `provides network access to other qubes` box. -![Provides Network](/images/provides-network.png) +![Provides Network](provides-network.png) Open the IVPN and select `Settings` → `DNS` → `Force management of DNS using resolv.conf`. @@ -123,5 +123,3 @@ This is not strictly necessary, as I have not observed any leaks with the VPN ki With this current setup, the ProxyVM you have just created will be responsible for handling Firewall rules for the qubes behind it. This is not ideal, as this is still a fairly large VM, and there is a risk that IVPN or some other apps may interfere with its firewall handling. Instead, I highly recommend that you [create a minimal Mirage FirewallVM](/posts/qubes/firewalling-with-mirageos-on-qubes-os/) and use it as a firewall **behind** the IVPN ProxyVM. Other AppVMs then should use the Mirage Firewall as the net qube instead. This way, you can make sure that firewall rules are properly enforced. - -![MirageOS](/images/mirageos.png) diff --git a/static/images/ivpn.png b/content/posts/qubes/Using IVPN on Qubes OS/ivpn.png similarity index 100% rename from static/images/ivpn.png rename to content/posts/qubes/Using IVPN on Qubes OS/ivpn.png diff --git a/static/images/provides-network.png b/content/posts/qubes/Using IVPN on Qubes OS/provides-network.png similarity index 100% rename from static/images/provides-network.png rename to content/posts/qubes/Using IVPN on Qubes OS/provides-network.png diff --git a/content/posts/qubes/Using Lokinet on Qubes OS.md b/content/posts/qubes/Using Lokinet on Qubes OS/index.md similarity index 99% rename from content/posts/qubes/Using Lokinet on Qubes OS.md rename to content/posts/qubes/Using Lokinet on Qubes OS/index.md index c3ea569..5e8fa8c 100644 --- a/content/posts/qubes/Using Lokinet on Qubes OS.md +++ b/content/posts/qubes/Using Lokinet on Qubes OS/index.md @@ -5,7 +5,7 @@ tags: ['Applications', 'Qubes OS', 'Anonymity', 'Privacy'] author: Tommy --- -![Lokinet](/images/lokinet.png) +![Lokinet](lokinet.png) [Lokinet](https://lokinet.org) is an Internet overlay network utilizing onion routing to provide anonymity for its users, similar to Tor network. This post will go over how to set it up on Qubes OS. diff --git a/static/images/lokinet.png b/content/posts/qubes/Using Lokinet on Qubes OS/lokinet.png similarity index 100% rename from static/images/lokinet.png rename to content/posts/qubes/Using Lokinet on Qubes OS/lokinet.png diff --git a/content/posts/qubes/Using Mullvad VPN on Qubes OS.md b/content/posts/qubes/Using Mullvad VPN on Qubes OS/index.md similarity index 97% rename from content/posts/qubes/Using Mullvad VPN on Qubes OS.md rename to content/posts/qubes/Using Mullvad VPN on Qubes OS/index.md index 74933d0..944ef3a 100644 --- a/content/posts/qubes/Using Mullvad VPN on Qubes OS.md +++ b/content/posts/qubes/Using Mullvad VPN on Qubes OS/index.md @@ -5,7 +5,7 @@ tags: ['Applications', 'Qubes OS', 'Privacy'] author: Tommy --- -![Mullvad VPN](/images/mullvad-vpn.png) +![Mullvad VPN](mullvad-vpn.png) Mullvad is a fairly popular and generally trustworthy VPN provider. In this post, I will walk you through how to use the official Mullvad client in a ProxyVM on Qubes OS. This method is a lot more convenient than the [official guide](https://mullvad.net/en/help/qubes-os-4-and-mullvad-vpn/) from Mullvad (which recommends that you manually load in OpenVPN or Wireguard profiles) and will let you seamlessly switch between different location and network setups just as you would on a normal Linux installation. @@ -82,7 +82,7 @@ sudo shutdown now Create an AppVM based on the TemplateVM you have just created. Set `sys-firewall` (or whatever FirewallVM you have connected to your `sys-net`) as the net qube. If you do not have such FirewallVM, use `sys-net` as the net qube. Next, go to the advanced tab and tick the `provides network access to other qubes` box. -![Provides Network](/images/provides-network.png) +![Provides Network](provides-network.png) Open the Mullvad VPN app. Go to `Settings` → `VPN settings` and toggle `Local network sharing`. Due to some strange interaction between qubes services and Mullvad VPN, certain apps will get internet connections while others do not if this toggle is not enabled. This toggle will **not** actually allow AppVMs connected to the ProxyVM to connect to the local network. @@ -104,5 +104,3 @@ This is not strictly necessary, as I have not observed any leaks with the VPN ki With this current setup, the ProxyVM you have just created will be responsible for handling Firewall rules for the qubes behind it. This is not ideal, as this is still a fairly large VM, and there is a risk that Mullvad or some other apps may interfere with its firewall handling. Instead, I highly recommend that you [create a minimal Mirage FirewallVM](/posts/qubes/firewalling-with-mirageos-on-qubes-os/) and use it as a firewall **behind** the Mullvad ProxyVM. Other AppVMs then should use the Mirage Firewall as the net qube instead. This way, you can make sure that firewall rules are properly enforced. - -![MirageOS](/images/mirageos.png) diff --git a/static/images/mullvad-vpn.png b/content/posts/qubes/Using Mullvad VPN on Qubes OS/mullvad-vpn.png similarity index 100% rename from static/images/mullvad-vpn.png rename to content/posts/qubes/Using Mullvad VPN on Qubes OS/mullvad-vpn.png diff --git a/content/posts/qubes/Using Mullvad VPN on Qubes OS/provides-network.png b/content/posts/qubes/Using Mullvad VPN on Qubes OS/provides-network.png new file mode 100644 index 0000000000000000000000000000000000000000..ff46f337c5828492aad31fd6be70f1552b74c0e7 GIT binary patch literal 33843 zcmbrm1yGe=+b?_*N-9VyjYvo;-6^0nTRNq?yFozyh=71}iF7wegVNo-LAtwZ^DUqA zoipcs<~i@2`Mw!u_RLIOZqt7iV{(&GW=-nGJ759`~xSKcr*$s3^FCecjg*N<7dlotM3+uVH zrg+~1mHs#C<)MSAV21a&gs93$gkoQtOun%chSfMD!@VM3*oAMbvJ?`%Y>Q2VEB(I#NIH(7)ePb;Y0#!u70X-mHouG8N9D<92=s zsT8Q>S9Fq|MSE7~3{(&-`buCAJ$YK6chFrYPe-RG^3=`b!0F;?hO1VSt5B)}n!hy8 zSR^Ii?X|#gw$&7EpZeF*QoV>T&2ATG7fY0XPR>a4RkmwNYsROhT%7fBKl+-c1ao_H zXKy7~(PY5YY3085ViVh~d~uqYs;wg7y3)#o;Syk`4x;)u(`=lR^Ide|d=fS*eZt<^ zS)E=uVF|h4|Bhr~W`;zI)p$5L35W@$7Mrxy)UIJ#2JDF$MxE!odmYB?va&KII`tZA zYFf&A&8}w!QJE5Gk8Q7T$9iTwTEA02j);(>d(RrLs-{A5bqCF82Px5y4}Ga@pZq*J zs%?$w5?VZAoA;Vb;F0c1%4H7=^nG;Gcz3>%@ibRa3I)oTP=e6?eGle6_e*F_=M~Zg z5d-nbCAy)`J4?-*d$bg3X>8fENBHz-dzAKf+p(0*bG9}{LT*dR*4%UUPbfuN9)uCi z&CI0>JKPq^lj4wH%0JJ~h3O9#qu8-%H@mLTxkbiTI-^rVW#7k$W)FMvUQXd%+i_V| zL!w9;<^w#rBiJg2n_psN0$|kBN7P512S-!qG5CJBAI$HSv5=+M{$WGq4}PUYmZ6?o zUjAB$Ya+;oeLp;Oh5plqv0wIxIdk2-a)yDzAp9A&l!@e3xYg8WOf2ZbUZ;HhN6Tt0 z#;9)6HRJ$7Xm#BfT%=Am%%M)lj#58XCiYu`DDE3IsT}=u;X7pH19%-=i&BGma{9YqTSv6nAL{WKQFH8o11;-)b+Krv?8z{Iqff`wtXNXCe&?q&ZxcYTpTq67w|CbK zt~=+QS^u!=HozDZAJ6nuSaaX3Or)c<=A2o@%9u?5JQ8c8zSy5{_C5PtvU@}6`^L6G zddni7HHChtZ>~}ay@{EIrQeyRiU~{RVS>}T))CSlrSQ#&tR*vIH0ZZEd!OvPv zMISbY6R@;v?dTikTCKj_OD2}RnZjEA^k(S8TsBs)c+~h5 zJ}MHln*9^Zhr}FS=jC?%jq~JaWpdr)c5^A7bjt2#Tb4gn*ly`Ln_YTkt^%U*MjB1J z3p{l(9W7UmW3v;5lciV8$G@)9nmj`k6CXm0c8gMv#VCc{KkRL*f`#B#l5pyIhg0KS zo>7(64*#90FG>YfsWnouQ9@*7w3j*8>&S55$Lh=maC8OSvCW@}=pYIpTTC^^;s}I$hoU5|y z_F44b8B!izOi*E@)wk!(u@#!X^7b{6l(bc-dHcfiTbfkn$n`_iO;g{m3B$uw zgkh4<*SKir_&%oIKFEJ)1I0f-kqb-8%jErcY zQ~L{C4b4~r;*Isy@yYR3W0S<>hJF_EMPowbh0cc ztmNQG=CPr&@9gUAT|2&<)_@MrE_hrsa6KI+znB@7;a|nA{3KG2{^S+?NvWhm1xfuP z?$Ow=y|tHL#78CiHxc&8q7s4M1SKrZ-SK345_;E!Z(ekpIJ%QOF=2lOnOCDiN_i@f z`BxdpU&`+|^!tc8L=`K8U8PVXnLDP*tY%gIp3!5JvVtDeyX%!sdTLTqKIF%P%$gE`2oiG{?)|&KDeBku zKU!W7r8PmK&!fJ@#wI3fw~kecx|6)`Fmw4cd zig9g$$|u_|c2i2lUEd#E-@9VDU)${%v7{ zzV__bsHNDKqZ_M{jeqy#y%w4IK+j-7alV7I}RXfpN~$-A;_XFZnjTmb8*zZ{}~X=LkUt$ zlR-pq@X!lv@26Ib!XTx5m6p9Z0Y*+{?_Pq3fts4izT1~01--rJ>RwCpnz1lGcFr$t zAHK!L=`_2S_lTPOEl2H!NB&}g^oq%YhUFxrYlLfrTE#V2DU7k(t<6m|QXvt~L;?m( z)m2sL7FzUSIyzdg<#~9vS?L00$#vDcsJsTZOK-8wX$PZD#ml?eJH8oBmdWA4Y^!1v zNJ&ktK!q_;&eXwx8X_Ph@^nA9_6>+BT0IOv!T;v_e7y(Uz7*G!&~{u_$}xRjMn`bP2gaAAO?m zA3mqK@O-SdD*S;JHz?`*CYpkHVTO{$Q-LSfQ@>h65joe14n$ffGXrU=&!_Ni3M?N< z%bO2z4R*Pmr_Bj+GOd4YEP>I!WQr6?IJ{F5FaEA%;g5p@(BY|D3{|X;j*73IhI*b7 zw`Hgli*lY4g1X@5XI|An9>yNuiuI#s>_=bl0kUlAJwf{mEjRVi)5*Xq`ZFXHdhj8} zsMsk0Vt#${%KkZcTdK7+^zUGR?JwIU&3-U~YxyM2;eQ|cZ~yMU9Sm3)A$M1Z_EeU3 zTdHQS{o~?H489BL)(3?i(wKAI+hlE|n}}T_hd%&UqWDLN<^Ozr|LylIEt2x)Dx|X; ztye|tciGZT^G#?HTd~{{o4NF)kkq;;+E>XpFgvHH2%sXIX*ttFT)vl^z^BYs;bL@t%~{d zCe{X+wKFzKNt1u^rghVeTI= z8%W*S+!8+%(EIkPi!s^8S@Sy(n&_=aX?LZ!^U#mABhxISm2$AK=9 z5%V5SDGdT+c`6xiPfzysWn^W+N>`MZBP=e4pjOk$#RSd_MSVXGjv(x_BUP3 z-cD_aV`dYUToCHR2kjjT^ynYOv!$dv_U}B>r81wrHoRQ!2%9X@EQK*5we~e!oZBoC z5)o->Y8PvrIdrak>Ft$4L%YfDiznmrJ{2>>3zl(lbw!09#?&3(tG#&f0#S2M6{w(J zW{=1^eAg98&a;%j>}A%o*3DFF3oqZ9wCSm+CBWu0xMEbKE9 zIHebwoDNoSgnj(hZhCt1`{LP*DiRhr+dWRr%#{8zl{f=NOW(twTWS1g!0Ysp^Ckr6Yd`B zqscWhHGWBeX-8=X{lU5vnx8i`GC~q%Cdz%0%MdFQF6DH#%|((rS!^|xE6I+9g@yDz zr#`2m;#b=U67&$8O3q^1pn;rXzw^TiQ>y|Q!h!z|^5s6Um@i!Sh;S$RTNL`q&k5i%6@_Jxdh zG#kgUp|SZiLxU~+_ylX5ge$%4U^Lsx!otEta_osN>r{oJ{yjjlT$eeGE`T-IPd zUws+ldA{9aSXo6<9EveFKTifJkc$W*!X5h5m`#$)V(=(Z1UT`eo2wGFO%&!wjK_NW7!;st^z)Vf9Q-w}!;>2vT&KZIr{C4l89~z28*TOM zDX#s|GOgn>IOyt~%i+y?0{JSKP;#xe7}Do}94jlUV(X%01p*97!=q0w`kaZZL=&1C z+iso9e8f-x-j=f;64j1%jU^>|3{>oTA!4O7a-y`LCg+oQhKBZB<6A%RhoAll`tit$$M0JL?GR{3sOMS0=(|$yZKD2y1Fsx`n*=>*zezut*#O{ zJ`ef*1XI#@9Q!c_J7A0Rr%eqbzP`dfHy41*V$)TIG>}4BxjAE7r$_jml{3tk!M|3H z8k?FRDi)U1p^b}ec#O4qtN$NjP0PRAZ2)VL>`k^3xI^LFe?A@BT= zV4+|aKc@JA;9Nc3o6G%PR#uav#%QC&7(1KG(-7UhT)&#N%6DRVaO2YQmI0KeNxUG0 zyXl-y#^^`nKwF&_RC|P79Q&AW&=tv6TlHz=>dCzwaM`^ku;mNOTJHKpMRx{GlatSa= zXDIDnx^A=|@~D++4j5Ln8;;!F99dXwu_szzl%&%shN5F(#q#v7;N#t#?aU!)CDEzJ zl^MiPx@v^fnVefz#x1!F9dt(nSKres7Jg$45G^x566a2aPv^Z=^y0NY^v?{5%+AS@ zl6#DUjrk|R@f)V9r|0$3Vk9F$__fHpscZ|{(E!GS+W>AHJsfR;Ywm%3M>QKSyf3(4)u86eg7tS-&iU?Y!}nY;S^SX+B8 zV!vBt@&3+jtyK&~pq@CdNpHF9>USi9_$k5R@|pACx?a93Z3Xw|*y@SA5gH*OA!Zhq zHAfE*&5l$7x9AvHS}C`e*G;7G6$AEQ&5E!Oz#TvwA86k6#u)~IK_qffq-#hu0P zQk<0C7N}3Y_vW#iFDNM5-PCJzyubT%mynmRxtS2L|5o}}>|sUYYU|eadcE}(9$ien zTA{3r3_8owpG{mmyyN+RO1^T9#hhb=mEB;liB^SIVW_uBz@o4-(BTq zU$&}++1;kfoj4#Ul5tAzTW@zwE4v%#0Ky>vICH(1zdn(!SSRW&tF z4-ffNZa#kg*{-RnZ@+s62l+f#8Lo67gn8>4*i@NBVcKWwr-L-7MG zI!^lL^75|_uX=m?To10_vBr=#ke?|td_zJ(!=_;Wr)#6vd;1G4S=m_FOm3;4k?hG9r0p{9i&sbfZhp|IItY|iD&SfVlHrD5Qe5R~yB%lq6&N^l}IvUi(_}IAW zme~87gWk)V(2M3qnmzO^S8uD|KLiMBy{WEpUHWOrV8WQp8yF{Q`4B-ATM`!sCA|5S*~KLg}FK8@3J#RCg6HI z@*C)Z1{R2pobYt-(|i?1n+hFz#gx%%@l54hxzydA9iXilv(I#d#V;SwS51~Qctsxm z6AENmq&Fs#YqfK(a+vAnc6K}l%a_WT(s8lz_l+CzljpZMBG>wsmRdL$6z~SO(vp(d zmIME$Cio@B3NP7Mdr**(v?6DupR22DOzxZMxw)Rz-&= z+~G(g%j>;Ka>H^B^{mw7oN97d$j}CxF2YsDaW?pbSWEl)om6rWDpXdr3NXR=z(BQ{ zhS%<940*#qxB@2TV{9xeE-o&g1cXxYNZv$2rgX%~)h$@2#`^_7RYood9Iy1wa+^8f z$vw~2kP9ys^exO5i)(Vu0eo6T%nz>f$AWF2nnLd3O#!{p`|=`_4$AvhFrT6WzOpP! ziNV3)V(k$-8zq~fVq|UHt=Zjdc)f0be~y>2yu6K}x8Wkf2Z@T2Q7c=8kT`yGNHlv? zt-1C`vM!H7@hfWTa!?qSXg<}Q+25=e7T4c-ZI-oN>`S8f=jL`bdN`?pRTxT3)B5=K?WHUkGNfzMMjhbgde3ZSt^q)Pdno?-fd~ZQg|6npMW)8b zwY0U_H0w2(i544===oYA(}&LOT4Kg!ug?y6{MzP+)Jtj6pIgi2Y2(zg@%YikzFkb< zZJV5|?>M`fH*xd5xU1RI1}{Q0$4$kRZ&)MV8^C=yS83><*nEL z?U0SfE}x;)m_1Rq!S%uanSxB&sehm~_iLj|ZFD(_L$s(c%D0#{`h(up@ETXqq#5{ad(Jfd4a&8mA|Ba>}eOnMEJ{)U6*n7Fta-#e*n@wL_6 zyb1GkBZ2KHKKJhL%9&F8@P<;Vme%oc6{-3za-HG?iezJM36ym1{Xf zfQanv}RIbFvuk=YLd3TP3nFUf)6Y<`oiD?H*4a`TJ}li*Hs6*4(rk4hRg-H6bLY?#I1paNvSeyT~VPJE}_OLXBaUiiTO&)4tzzKH4{ zKMZH9^6grhcB7QAbSnC~~RYJ&u_DbC)lotf?-yWi&vFJ7%?PWn16jRL+~kJLJtDncggY8K{k;4i|Jgc$3QOdi*CK z@Gr0LCIW~>omqco^&f1ge?Wd`XZ!4;hK^PDAA(6tQc}VZ<<}8|3ajl|S*zRIBp;~? z3JPo&n|GGBN|HtR89$M&$ScZkIMxxx5ka`P!}q{?3H!{| z3Gp@Bxy@+16R~xSc*f7O4I4=5rE20c&4|GW=+EAYs=B`0!M>1qAqyK*WIeITchc)d z??!XZ+5Gorq-)_?#dIQUKqd4)np0lW=cm^ zX$=7Vrl;p6HFewSZCzd6yU=%xvHWy&aXlY^W}&7&#mUXMyt0y-Lgq5j2{enjf!^K{ zhSJlE3));WvyIIkvP$;Du}tbrOiUA&F2<`S;Zi#*D>f=jFRG;m)*NjbrjbQeRS7+0 z+lCD!p0i2Defx%s8kLro7L&TNvon_ULC)D4JYK6}PK&-iZ=NgL+EPRgIbGO`xExo> z(Z%!_=PINe?QXTL9AVp;->qHCE{>CMhuPTKNoS6{IE(&#+&ei-YgSWTy>{ddX3fS{ zdc|jGiM*g2BruN@>MJA%|m$q9Aezn9n_+OsIB^hh*I zIXhFdT`McEp~ERW1J0Y2T-tb314m%bxI8Bh4_nAFofGWk-lL6GGpTIYl*$w&>fzB5 zv(;!;n-Z1T=IB9l#g;t4u9Wd+6rAB=88Gdz)aN5HM?}G}9#f(G#nKnJ|1%3vpkAs6 z$Y3oVIs*Y_U=J>)Wc^h(?B$hsJ`4#;?kEZ5mt|EyJ$08UR-2lt_QvWD`(~p!^Z=O& z(r7l!x234oGBGgFgXuJ0#OsG(KNB=sKLuJKQ>qem2R>$ujxr za7A@y2$1b_V$SV_l7|+7`#XyHDp3+SIwjd<=Q9P9#pgr~8T!foY(OuxXbugBNBHHx zZ!Ik;u!K=Zb`1>ljooR#*WFpYT@@%V*?;HokxIp~TH|(AKU*9q7cP?9+vzroz(`?@ zlx?1*yjXFp<5EO(NB@{dIO$j?n5jjbDsa-30FJ1pGfJZ5*yt3;{dtc%IaXZs&Tvuz zerEzcoUoqfT>)nkp*s{p-UMU>&Ra0!L;vr2ULyb|9ix97PUZP3w0it=mFwf=CR==S zd(ay!tP=ozxNB-OH8nQ|5z5MXGlmV&;YnKh@6Jy?r#)!wiGp-=>$9;t@|IRMLw@z6 z?TS;;;=uR&-3NVFVbq|LZxM1A?3>lfu-z!i&mXa&K?y_Io8x@w+8vcCWo&9H?E7sb zjh0>Xv?}DY6s;iq?*sKO*~ko~pn6Y0tY{=zUW4Yvl&V+KjRQ41u!3<&aQ99pvPZn^eKle$^` z0+I$j3DC*x{hSXx;&IQty$JSblXi4nZ_Ki5qha!(Pc`_DH%v?B8V`b38R(;S6&%fW3 zlaZBIl$FmNF%Jkp3L|2>UR_bGexC7`nXZ(IWEk<0b5{SM(cFxgkD&v({^2h6ry;-d zdJmpe_PTwzmO*i=jA(|^>5ya^IO7Y834s7=W@56VND$hN93Xm8+A2duRDCT!``pT^ z(5$q$h@C>@>c_agCIF38e>RMPt-?Tnq)$aeim6Z>^|yYc34>Z9+N%H4d}(udWMeP| ze5hW%eSVMR>H0oAEa|n8mZQw)rY0f2LmIp=uwf#*Xj;%v)sP`7VsH|VS|~Pq0896D z$HIo53VnG!9B{kKu^=OMhfz|e^}#Cur8>1G3IuZ<>8jie)X9xKi2JV!CIxSp*X z=~(6uSfE#+`lGI{jskfsqNKJ_l{zFPC2q&#ZQgzUWY^)B5;X$QYH~cE3P`B<0!Eju zf?0%GC~|+=a(~luaeuQwoXq{{Q!p|VeEs6wo|o=A^BJV1p@IteTwg0>j@XKI{(u1{&}~oG=E~^vo(`7=y1Q+&2%uW+;~eHQqoaLfsdL;3bV$OQoIhu zp12MYH&|U`0xX4+)16Ac)r>t6%z06#%Kvt{_MZ+@<@|5a(XfwHykvv^NYpk(bpAI- z7=I6&RjpC;Dh#_XxnmYKM6U~qq%y$`;8zN&-OA>wapw|Rw?E$l z2pFraYD-WaK7KX)=xu^yj>IZiViPle06GqUXHlPtC0k z$JDM!3Y1m=uHVC8J(W&TO2DKhd`&waWb|vv{yCjue|Pr_MIL}n8hsl7>hcj!`5J|M zoOYJh|9nu)fDwkv)HN#KoOb@Rz6Z;%@^6J6he+VQ@$qSrDx@aPYHrqZGsvqJy602V z^3>uF>i}*vYPeKodHFLTPvfenPJjWj2XPVaj>(!E~OAJll@DJ`s&$+Juk{bME0CmTL4HO5Ma{2criUYn>3$3 zR~PBR$ab~Cps6{N%;P6yIgXBl;|8)Hol+h^IG1zAhRFDwojd!t063fER&%pk9HZ=L zcG`((YSKMeXu7+(?C9()pSC7VroU+HHaX@n8w@Aot1v4CNs$W~1(}j5fh_Rg2-F;q zad40K^%eTvBU}uR29o{sLK|n-17d@NuMVI5wq2|rTV1Du{%Lftt7vrGETfM3MQ@2= z<6`1sZJqL#A#3aziyAH7=fM==o59a(k6`&atcvoo2k^q&rAeS>EZNHmBUUAj2d8I~ zW+z#L1l?vt2Gi2{ocLpU8htkQ&kE&33Y;I43zBiuIj{8+ny#BxJk)e`Rj{;VOl^D0 zV{0AHs#_JL_5yG3ZcW|s?T4;f0s2oZ<(>nUL@~5PVf%}bcE=BFti|pW^aTBs?-#qn z;^%Y-|D~e}z0Z+Pdn%mKSOw0M$)Tw!Q66XD)eMp^hDZmMYF_ZAO0lsp%~jsyZcIm9 zgPBU;wu49Lr%p+cnCn_EfcDGtDf1F7lo1JdZ7WWa)jv?se22zJ>ue&u+6lS_bUY;2sy z?-7*ZyA&Dbv@xW2w$+7~&&fs0@~Ui)vO_x|IWkc=ysvgVkBhd0HUx+K^)LX{KEG(_ zMlGBZbzDz6i@$UwLiTsp12ayhpMp^1zkTzqH8KnHLO2z1Cd!@P4eG|wE0PFVX6dlD zP!jvCcotIfWLDKl^cq(jwA?I#4AZodqC}3z=BHiMgvwz0t@O#~|UIJS2qxm)cbPe9?S=y*sCQ| zV3hR^gYs5wZMEG1;Wdk9jy4Z?fEu0WM?jYmV31e%(>n*{@Mh5VpWo%@GMKKfg_4gMw7X2`~ z3Dj#Z?DGolf^AZ6(V`7b;ytX6OUMstm?OnsEUPXb!JADv^<^Y`0%E$zJE9Wam2D zA{%RA-MgNo39D{1e;`v1O%*jeu31{k>4eSXV4Klcj^qtTQMa`<_|CsqSHJkHp{4Oo zl=_K0?s~&qGPWjfRnB6kf6((}$!e+y&Hwevug(baN&|RjL4hSuuVW92FE;}t&p5<@ z^TPA`HQ(ut0p#wshDoZuGf^mv<`0Cbv)!2(xeKvO7|12y;o^Q*Vg!{#p#&z26{hKA z#?Q|`y7lGr@$p#h(E7&O$)zBQKTYM-F6pnok5#SSG(QmG*k-FR*p}E7Hlaq=$rRo`JOY2+tYn}6Th$7SZ2vSVVc6!2- z&d4IRqD}0=$$8G_XGFC6D92|{f45Mkaapa`SCi@)XA9})&_hqj`75ev&yM$-eCFJO zgM-y3)e6;oQjT~tD=J{>K=E@JT@8in*2hF{;XHoaJ2+^8$K}Gv$XM%rHKDHWH}e8c z1*xd3uC1>>eE1;xWt`{frh%y~g6cI!8q=H#KG0`pzq~v@ch#=7jhA_0yuhhW9KSbL zW5qd}SZTI-oKrom=4wh5IYgUox4X2Ytg5=VbhT<{t6&>*+mo26IhL#VSDXW;2~~Vg zy>oRjAnu2U-Tm&zs~SLzp$Umh6Y`ntm~fdnuI*8k$$({M8eSk86*EV^Jbmqbv@B^g zSwxH>`Ox)C!^MvUU$3J?4l`95LMR9uJtFioHTo}6&x&&fMh1SreQ^niz>ts|Z96tr zCKe_}&*OG%-32C)O}MU9#Lf-p_zzhG=SXAA4Q`v}aIL;aAxdWF*Ch@$2?;NGcz~KG znmGarx-9W?q51T+ftSpT5n&CAxNpRK#Q;WAvLD-U6q05qLBU8keIlA7?4kzv^2CIs zULzR+8G7*s4tt9F<^v(O9C{Slq{OIqrn3e4CHX}~_V&)hYEhFy8j}K~ZaP#mimiy2rrbIj6T|Z)9&(6(> z@fg#xDlAu4R?z_K-ey?7ySrPWSGPSgh7Sn}&2w-hr8R6AZ)j*}Y0XXltg8d*V-ZmF z$Hro$GV9Om2fUNWpR@5C`06yuWDoXtGqd?s$bfjFjN@lm{KaOe1V&y-BO%NFQem?w+OoUFe?9PSab`6|&vEEo^@1RRU03 z-aW>hm=qT1dx9A}Foq`lKUNqqsv0Wi#=t`G83au?ojt9t0(A@?jW~?LWU9n0fD<`Jr?T6{{Aloz1ywd{Q(2XhH1i% zR}UkvZbf+%hSRDXbka;*CMs1LCb$&!YDEGyPHe`tYetU-sH<2~6;7ppHz5#L~NH@e1uC1cDX!mhTJ|3=)3xB(q*%gU}g}LD4 zb`>eI%gW07dKd{Mv6!8M9qkc`lDc|&RMg8@8LQyx-yt|Q*4E5SR!h@NAnf#eOoHkU zrI2@HeZA*oiY6e1Gl?^w4sxCe*viGT*38xVNK>%eE*w92z%V=+@r0C=$M+Wqhg+i{ zBS%p1T^oyOy;IClV%Yp*R)>~kc7p@~X$~Cc`}1`%a)`!F5xeb;?lBfIuhGs>Nf)BH zA(-Gc-V~|EkPZ7+@Q^C((Be#xB)|IS_mYZ=8i@8V#&R3B>#w^xI_^>qM~Y|g^6@=* z_^`dBgXiU3nla~@%NcOVzU6K>?a8&iLF#RPhyM(_K0CN0p*&;teU0|N>i0E&XnrC{ ztW`p<9LLdz(kKR!!@}zpTl_@q?AYjHEPAR_xNT(QU0n3^gd0V3a*5@*2z}T*rwtxx%( zjmlDKFK1_F&bHx>z47N+;j*%_8z)!BkH{XIwT{W+J)Cq(22~af0t6M1*jGwK84<_P zL%iYgPn}P@%l~=#1X#hK@L*uzAP1%mq<>3U-r9QYvi+^IvonmChB8OQ8df9JV-B>= zyIb#;`Qrz%;&;vyW?->j;DrWPb6HLLDCCaC#6+{{HKKw7Y-!^O*x=pIn?ezN$;{F7 zy}A2KWhwi&N`|*6>^)J4SjyaimdbX*&2a&O* znBQ2Km`sd}b7>7OAVqcc-~l`}6@NLM{Guw(rdO2v$NGL(2NOXrt?c5p%K_r!?Z-(| zt74XLshF6UmDN=hEf_NN?AbFKsmDXz*7X)|A3O*aRjR0T>h3}|GdAYs=QkE?;>hFr z_bkjL{KJHImpSZk0iFj8LXWHC%3b&3YiaIGEO<7Lw|&v&K#OsPmYS=sxG zH}d_DLJ+QpJz{zJY}__ku%+Px>7J$KjT-wAWVX@;o)S3o%h%3WIHTpYwSM<4Ojee` zz+)UA@$v9^#Y1*I*Y;oO0Q-Lo-u}12)_)u1*ZngOGAg%Wen+MIY~p#9TRKAp@T=bu zgnjDGX*Iapw}rXWq!C?g}ZiOrphtua+^QXQtB^>NqsEKG?|u%0jb2~qCuN0Ud^W|BBfh5v1F^~&%X zMbI-8He<0TNWQBwtr9-VId5iZE+mcBsyHoP&}%{x%~nwZ#!Q_z%T`<1da$CRtWk2A zepz(W5kFL!WJflPhDDm2y*3tl2@guIja|fl1qNenxNKP#iqMCfIuC)}!9ih0qP=|pa-=YZ zZy?no(&e=Kp%fWJpT{wpW;qm!VG0=>3@ZE(uBGJGM5)PIO(0%_@VWin`DGpJ@)wDL@#@-Y76E2# zy}|EUz`<$hv%jA8r*VYIWK#$p-Td2RaNzR%xo}iq%xO2*rvLE_4``iRYV8E*!I5gX3KAbJwFzxL&fCi#8 zURQPiv#WKHp?SDhkhB~DdJ#GmBNJl_ye5zeU2x?M*h|3y?=!y=r6B$>HQeG|e~%fi z=XhqNIU`Y@-)b;#nIjob6jtSqW3bqa;3NV1Q?!*u5AmU@>ui#lyJ={H2R8_s)>!l?n1^D=t^2UFCeEvA(WU!$RsBI@JI1NQbsIqY^BL&re zy|un``-Aec1IE4?eiA^VgmsbOb0?5)v)7>%uCrZRe50VHHG6$V8jBel zQ<hGRa(&D!Ah;o&N;t>Zj5g|NTMh5draXpoE#tD z-Tqw@V$!kmS2wL<)PE%d9T*82S(WoubhQ=tTiR$MHw=Sfdr;%i}Os8-}{ZY|yFUC$xh77<0bLV`XZtMlKD{;kbP(df5=P z*^Ez>!l}&AF&}$=O*jQ)yIAey)t!N(qYTJ8KM^OZy z?47ja0@*v6;N#x4Ld)v_ea?MzukDAyeCnq0FH&=R$qx$FN zndhs>;J%TPS_js~ywE(z?01DpWv24G)F?0HO;{eE91~(nhT(^6$y!!_8Zexjn;S9b zeAfh8D=Mnx71 zL!;%-pFd+1bMrIS=j3!QE)r`k(vDk(7ZM0BmJudi(_0H*BX=!)uJ zP_X^+<1a+OU8#P<69R&#r1-MFXj}FkaTBT&^?rp`X^lkaMbL+<&)N00$ab*90+0E2L_0C#p=KWeSa&N23Ug1P0 zm>XFo$HuyV7MM>)xl6P*_k#SuMUTx?Vw_=)3qZt_cDS&-k%#^`vT(3hI^R!DVm@LH zRtR6P{zXDPGc@TMntpLh28s~~Pk-%Mef|3NREZAS-;(*>vwDhmE9bW4w>r_?5ucd( zo`eV|8P`&2*OW|bMRUm(MvO1||K?))Ub8$S#peM@Re*+VZCTN95DQs&<#~g@Ms+Sq zgM%MjiEA*S`U6i@Q(b>C>#dfhrFX zjU~UyY@8S5wh`m1`JY*UWFhCxuZ_2Y02d$e{+{bMoJn zDrq11w@?ta{ySN;7%c&EZ+8@p+y4B!hh>uY9x;vCd1@L=Wq6xO?xR<6bR-RNwhNah zz!e2I1fRa?wb_1(UGr>#{+q%(*@H)H`AZ&2Dib6qcOfnNAFkV%`H}8tN^?<>eO+9* zAkgmtedl<(%BAq0mJ2r+;T z-_ivkB>&$_*zWwpz-9$LgP_wnHbuI0^V-1y2$vKU7YllMzIy5$E=3b11EC+o^u6Yr zUA*Rl9Dou}fEnCo{PWDdvZ4mrA0!hYGH!BO7z`yu3VA z|I;dGqA)JQadeV!QzIh|AO&r1#@Wfz!JF`1*8A($nBrXAwiZ@dBK`-Jv!9!piDE*6 zM&FNNd`uvC9W?+v)vA3~IB2l_S3vMnSQjXlCfNI+(O z@CUf=;^H5Ri;H7o-hYqP{V0?D0QI3gFWE<`?VTMitw($nAKfPY0?UX+2lk)vS-xE5 zuBke{x)5Ixve&d9yEZ;sN}@f!O}lVjtx+CHNcl#F`?TzSYB7lz;J*g9J5CRoH=t## zQJEtB>vXBU{&BGc8cs+!hHjl>aAI9zkyu=6YD`j+jM*!Y+L+6hC1%MW41MF}cctpa zp`5(GP?xKgZ#Iw2h z#g$_gE=&1$4n0c}(n)S-k(C=}gDHc?>>w!Qb#&Xo9Y5YWJ6yVbJ)x$q9CpXkC|p_T z2>yoyhu@M;1P1-xQfAO4DqI^4hvKj6@ijvt3--?QTEfoG4z3M!v|PFHvdROxq9^+c z)gg_j3$v^vwRY(so#ITQOBWAsbO;j+`o*CT#Gf&E)-BZdBM?E9qmVA135%rQLllty zQbZLm)eI4GETz8sSyR51oljTgs4Q_DN{4?Wfc(F>lSDP3Q_D6ug%`ZQTMB2Um= z#8a2+4EdSjN?#m&YHhi!<+vvobRQm}>C%_be#-S^JLpvu*WaejHzB$!fB)$RBLBa3 zWd0lX`~N-YP8(V@!3a!f8;#e){7;e!r=)(@|)FAmJyJp_hw#t%XxBi*J-bg}#U zH;!&DcILe65qh%j`pz3X1mCDlthZiQ@E(`P!p=XG*=N*brj zX8`)BsH(dm)@U(;e|`SkJGEF+7$ysx66@Xnr@gm~sxo@NMG+9Ug1G7KmTqa;goJ=J z(%qfXN_RJG5EYQ_ZYhyY>F(~1v;6(`oXDmjc`*|{QHQXKN2WB!D_PY+yKk}J@^Nh%n^pG zt<(h?ZPEC3WX%f;t$?NsEJ6rveY1e7W-NFu8zu`z+g*?aF0amz*hQ1G|A=X)TOZum zsQG;2C8Ogl+$=eT5(>B{OMR z4FtD?gHg1!w3dktMNLgbz$GZ=Lyg-%6Rhoc_qy-u}h?`e_Z%Bo{w3GYx!Dzpl=imwWx^MB1N%KXEHS z>hjwq1r9f|v+FS|-|bxKFS7Q0cFR)31I&jSDswB_vBkxa{{BM#gFuM~9zdw3BY%3= z!NH2Pfq^_!+@_eV_3PWh5f6_B#>AbbraZ=;?irxT6sCx^vRGbTpgQnDtY;vB6C)!E z`wxO;e0sVbGZdLVp+v{J(PjUSF*^|v(do&Hot?BGVwUJar2;}CqF!HSW@ca)k$XS& z_N|V$x266bugLj$;l$YTG@2zBejM+TS?72BPzboZ)q%w)Ler?f31PC6C z+a91U@6&+JIGi(nZ@FH_pK#6lz-Q$-1n+)A%55&*4rFiBP$D(ni zrEc)L!ST6>E@NCAobWCe7M4NaXF-65?w*{S_8I|64VgjlZ$B#o1KZ=reUMj#ZSwHu z$jsF2mUdPN@*`Fk0wqtNo_d=`kNn{YYS+nx!2J$fWT+DU@)n-AxeeFzv{O-hyA63R zEd|+*Jgb>r*zG^PHTs3A%<~cQJa%aIuPn!q;AubS&|tsWW~!O#zN?m;99*0-Dk5x2 zNxNE8M{jXBj}Te9^L-}q50x0|p4DTn+A3$a!e>RK09QswuRGN5DSpuN<$2AIdCo65 zJIh~Dv4MjFubJK7`!Wnfl!-6GzC}nX-%nTW?Ps>NeV&@a|MFJ9a=MD&+gwUYQSn%x zth{HnT%*`A@Y`waK2qE7hB+iUMmF-Ysv$#x$G8bgpv4zf4}`*ya2KX0664}JyPpSq z0OdtNA&~(w4$it`{VD1Tb{OnQR<1?i#Ov4)Ak>$WBhmT_QXk~xO7io^cAP1**|@p8 z)?F>eL5n|n2qFXf82A01`B$>+J%`(Sw@A|V+W8NPm97$Iq7Z~p=2)l{Gr2&I&E{4#feb{T(V&}RHaIbJY9t!8t zAJVF-6KaL36zV^IP~&8=IPhmQTdvZ}yj^?`on0SeM4obd;229Djp9go(kx_+U%q{GjILt#x+I z7l#>GT5{Yb8n#8Jm{e;bQDZ{Vm*NP?bgFIk_xJuPz~$+lCy)nBp?*aO4fsYMWXgnl z`We;LC4VZN-osziZdlf&gRoOTe;LTG_g$YcBtj^%KS1%x6UU zgN*<#l+Bp%BFI#8W`?a}%DSee=3@AH_JTDtb1_SD-@dC=m1ab0R1`~)sj~;XZyz^Y z!ut=}%a_|~h1208)tW{e=~K=*N?)Lsww9*&-C*AG)&>M1Qw5-*P|1zS1R_!ZO-0U^ zFV5@K>(oPzkmy@GPn|R(UvedKL=+J~RXMi%xpVyZ&VM&nIj$d0-jYZ9X8G4)CdlE}P zH9j@f$u_m_Sj|-%6cBXwakA%O)xV%HJu(e+^JwFFxVSt7NdYDw9;T0%zV>>kmpiD@ zU_u)JYt2(cQ8APQh*|6WaXG}WHr2W3lPQmi?H#)KuU zJX&~oWc740GqVjpyyejki!LxQDBy!Oiy>QA&Q$z)3<_gYp)w93;plvECX}$?FVR$` zlCrXsv9Y*}BW7^Nh-I~$9P_>1ECd-=uEFKBf#w=V9((!i&%Udt02)D>Ydw6S6+_hi z4R!|_yT`BfosR)St9%*qhc1~N2A7${7_b8;47e%2S!s)0km(!a#b?1F@1b4)NS=Ri zLalA{v`+9ah&+JJpAS3uVt9UjXLwjYQWA?0(~v8bxV71G?eyBZY40z`9jNDzj_h6I z#Nv2l7aN_cdd57(0$`#l&I#hwv~Q?kA=J`wViofUMNdS87b91>r_ecnqXqbAHR+**?}I?!ym7$CU}Cpp_2Lt6swqBc z*5AfBro%;Hbl(7N zhVJ<&AW4OEX`L{(zJmHGgnSAs<}LY__vmr>*!G%(`+_uS@~$%<1`IuUY}*+JzU#GH ztTjPGnmM?73ecUFrsgeP2n0rs&F|sTKp6n~gR-*Wn#IS81VAc^jlBj3`8#Y|k=5KT zXdNNq-v~H!v3?%*%sj3V$**2b8KBHH{QeDzl>$Wcpze>s)OgV)Q8zZS)Ozi(j^#4X z($7O~jq@o69+$?tYY$^%pxy#g5OVw!ah$Q}rm(sBdvmk@x1U>EKLf6=IL&096=q(x zT-8gr{ssG&hi~il{pII(^e`zVTnnz`uCIni0zASEmbX|hkU3HlsGmoa_pM7J-|Ev} zd=f-d9Evxk!Iaduj;H(v2HdRXE;9iEp90F|7o9|N(UeY}dIiMH?i=8z z4Q#vCBO`vfteTyez#%3E+dn3TNu2ynG`u_{+TLXkxwfqq9v(mHtj z->MrM1wcnuNFlV#5adhP;&}LpD=Nl<-4FvgYe=2mLv!N5KBYhDs!oHYYvRn47)(+N zmxj7JeBrEM2#g*Z5`Y-+!OZNPu?qDp>pMp&;JVzpB+gtgUpoGT=%c_dp~%x1X@KuX zPAiu-)p~;D> zfrxxwpE;L&RA?@J*tef4DfG?l_6B+dKR~P$r6jWGSXJ=B^eh9IC;gzlnuFW!|LgfJse&gTsIs#`a4-ud<*Z z=>FHj_&6~ckt}Tt9IgYFY>s?qNsorv{fb!<{^kQp)OQdU7uOs)IV&5RQy*V+sH`Ea zLM}bJ*qDcZd2#hiit%DK#>B9CCk}}C8Xm4D(_~m!!Ox!|bypezG4r-|Ha0}ZJjb5| zP1bSP*+-U_9ZDWh* zGBgN&cOmI%u3G!r87AfAgbLfT_U>3q*(xi0j&D@0i8XT=wWLqB7!&zj&B|+!?Y_38 zI)|BpokhqyE!gzTquFil@Uxe(E5D9>u+d~uDz&I(Rocd6%imqR)<+ffzulm~&+iF{*MGtkL)o2u-pPPBB3|UqeG)!=s{lG$2R8}thOLRk=DONJL zdJH5FUET6PS6ZQI^IDZx;J1ER^c(6oQ~GRI59A1SpE~FEOj?{$XufsVBoC+`Dw#jN#|*%CEGPYlYcjEq4l zEL}JzI!fg zo560&YZb`yGI^K>mhC}(_zF&hz=qlRBrc%yQyjStshgEnBO%Je=f1X2%{_cKMQT>I z2fgJbPZ89UY9?!HWZB3OK8LgGzMJ@$fNF$@NC#e)oB?p{w5NMt`eD2?OjkGR@zIlSLz}5}r zeu6LT_m;{>59$AVY2CqtH5=t6h%oRraNVtMmzwN-J=U`KuBVN3P!T+&I#+yKu08bi zKSv89wk&0O^0uChp8DRLKHg{vOFKSXZ|qV~P;~S*?FG?*sGf5-obMaHWH(}_lY#-m zouLN4-gl1X+|5U=KmmU|Ta#9(S0bJ$p%sY7`9FM}#yzSQ%&pn;ipg%O!JPUmHL z30D*%AzYcLb)#i}I9gL4G7PFuag2+{veWTAtsJr@urE=0J@6;3c0Dke)fDGD_*Yq} zoR|oA-`grR(!pc1jj&&8dVKXbHZ^>;(^slhj0gu@$ZIlb}nmk3*8`5@|b zCp;oe>`#B1x}u^*tpLlmrlgFh&+-m8Un{8q`e6b>2Upw|WhUHb&z^bT9Ot3iPD7eM>5A#nr_X=(8)!vtxDC)zmi5!%OkP#n*8Xs{jtHYrVb^ z2#5gzGS#$nJf<9x4i?hegCvdGC5wXX9h;|*58YOcuKV(`vLGnKH2!+Gw8emtDOO6Y zv{(B5dvOTp5!)@+bXZp3NIlc<2kN9b$G)_bDg5xR3g1UjJAP59v2IsKBU*nKG7?hAv7gJ)j(tH2Mm<5rfH?-<+4*{| zutp0XxOzfioTGWH+Equ@>W>G^+APVXI&M~<#qZXXeI+2?m-~|q4L1wbX=zCwOG^e9 zhXTBFw$&OnHnY9*gMU)$t*2M;GJW}IXxt}u65mA=Yn2`GlV*9YT=h}~N6j@{Y;<;h zg6lq>t1p68_iS22IP39Gp_c360;h=#M{*x$I`g9UZF9T6I3$!NE+dhbmYSA4z_P#! zP^9gamDf^-#h~tfPm7A0K0GqwK0*e;r;){DHMg}WEGpQBrzBvL5nw#@J#-{{>{AiE zDOR%rF(W(Ng;B)9fV(PCvzj^^>&l~|`sL|1!Sb=;jnPGs+vB}nv09_~$oVVbtKiMd z*_ATzB`c5RHl0tl4ozlBK!Dh04vS92>(MAJ7mum#Ak*`}VSDE~(XWMjHP7Ic-xi1-=)O;@Y-R=tsi3G0o>{{f; z`a#>_u*L0kQO^^JqRQeFC9kgs-tqi9I@6fwDH zw(i)~&O>c-&Z@L=nTV|n)SHPyI47`nWp7)=TJIe zDJK=uxO*T6CxI6i+lZB@l>YTSJ+G}TX}<1aEto0>)A@7sOXK?AmiNVCoV$_ zMkh7B{c=h62A_a{kAg|1B!-Tf)_S&K-n4Ssy2fVlP)bHVp>N$kC)&L7i9H4O3wJNC zxe|Dz4omWc;kEms&tcKEy2;^eZEJHgl99HeqI*qCyJyIGQgX6gwFX-^H@6EQ7oI^1L{4bZXsbVpfv1kMS1+)fSfh4+V8`t!K8mFFv&L7CB+B_N_ zj~x5xc^cFWS2oYSZ#ef7B+9@u5}+hFq0q1ph=R2AxOo+gnan$beJZc$G1JQZ=}I>c zc!~{_^xUg8vyzNymo370(Lz(&=M|u1o>gxqY|iix_$B| z*LQFh~m%Q z`qkW7vRk_#xye&7^DZ7l7PF>dvje?&hG=X3t}PpWf{cVW2@HaPoUKCtGAI+?=+*hoY{ z9V-<;ncc2$&#!|l`g`5+;-?x40|pGG`3Z*k5?DymM$DHS8L~gLp?5roym=%Klh0eM z-P~LmqY=hckdv#oZLfZGzZ7z1`qeGxR?(9@yA6XVVs|a9VoP`4C!3&v-uSkC5^ouH_f?*MkCGt&qF*Ye+K* z+Y8BxLg08S)`SD*kYWiH878WxW@;Z(QJ(#r!k8n?&(9B1Vdg@okf~jDbrTb#j~-n4 zX`2$gYui`#5AM&g?dhL9gwi z<@1naV^tLclA23zoWz$=1QrliZfWA=6kbrMRXX-}aV|LM<|^_`&oF3p7dYO?vGu5M-w{vjL~*#J*c zTcSgS8!9uDpmT*n6#&(&G8fg?M@a6`DnIE?N>WQK&?@~43<{fTbJW-`0w|Zm68o$y zchEdK^tZiVM1+U46TXDQ?fsqZ92)1ZuLB7qFT`zI#?dNq8ns@owl+}^_aMeZz9J*Rsw*q#LJ+{*$ z*#B=XK;Wot}h!U-CbbTmu7=u%0|7`kp;_SeFE77s- z+;TottG+gOHqNPV?C#|+s`uf;8-1z4zCPcp<;Ry0h_$8V!;ydVRQ3xp-?M43jc5AY zNc+77YTelyp8-=+CX&zWm(yl?|LTf&4~rc<>F4jIr_atTtZzbB>q%=p=Wn#u9r^Yh zfIMq|uD)@oA}?GPFuV^ZQ&hO&a`Qk^TXZsbvr}j{Su|L`Q(zt5rKG5snwBIB+bpm+t%Jv^74s1jw8KV zAR~WnZfkqJwmLNJe_1)y(%<{>_zEi;12Qo_elT@?Uw=XHrn#2Si6e?6&`hzLv9ZH} zlGisuU8a9PcS9g}`o}BumqhRx?UZL^9w2o7?kJn8qqko;>ZE^c$lb0Afi3E%D%@aM z(MTseo4L{8xinPdq0SAt&zS6;JNVwt8ZdTGo};FNu_h^PzCn>2qf(`{0|d*;#e(7VnH83BQf-{%#;I@)~Qvg*tT$*;Bw zo&wC#jrkvV<43N4M~Bc6%uWe0H0}#%d*1fx*ZN73DOIODLJ*RXH8&AGshx2+NhvVQ z)Nx4vPzoP0XHO@0MP#G)Bc~^2CI7%*(FI#V))!okA+{*JltV<2Bm=PM{}hxxg&;%_ zp$Ge4)WKPviE%>O)BW3U0?GNPv*^k`GCwc}6QFoPyR)&rzbknC4`cC~N6&6oh0{C{ z%+&8()Oy*rj%Kvy%x7a7uP5RZ%FeSjF6qxFOf$AmT%KhU1a7Zx*_lrw?yayM+a%5t z{VEJ(uxdd>1T-OjF$}Od+o9iTCN)pa9)bN zVy=t3o_f6YTDaR|YSHJqG5QY%#b10w%;B^!7c;!n@9qS=?>V|8V1yA6R`ErloMyS< z;=ja#qh37q1F$@~K?~&{9Q^FSM8nO;#Iz@VAl;91Q-f4OLT9=kc*PBs4;2S!iB?S6mbq9An5%R^$caeG*k)}M>2 zWw(={0%*B)HLLN~JIAj-%YF+a_vO?yo%wYfe7Z>8WIrGnXwqMH0X2CBzv|s~PgVs3 zvb6ByFHVlsJu=@%Gi4*?ELAC!QBb=H-S(g2eP|wWV~=!aPh!zhQdPX~c-8pMy;)fB zWGm}behv8RUcULLt40frS~K^{@|n49L-GZ(;EPX^pOEij)QWZMjcx}~wRo7Uf2pbu zJjo$e-FB$p@xq9th&bkYNQzo1`f&}f<)2X$-LvZ89w#9l)L*cq2c# zl}D924cR>_q=0l}3NFQCe?5I#+1K}HpXc`JUwbYcV-fN?axq*(POKixlM{mAzwlTIE>ZWA&29)G5FhY;t$LD%3uWP6JHd& zc9M!b)3??sXzTqiB&*fB$irxqBt^}I9|5?49Np4)ko)b};1{T2z+W`E*dqLa(tTq( z4+Ey>doJhg-JxaITE2drtnymb3pOXmX#3*ja|1SIJ>LuPof5v3T(s(haH8$o4+p;@ ztG8H}TgF&kXiJ5|KdNY8L-9d(d|JR>vuJWMX>!_$1D%ZD4+=k8>< zHNKBe4%ZrHC&BmtH%0u&RUhj!`Hl6<-mDmCR;6X25!~&Zab@w(b;M zpOy{+zSy<#-r1qI1THenH8A)>2}S5`Gnh6|VcfE6(YFy;UxS2klNzi9D?l2X zRJO_%S3|SsWnzY~KQxWQ^%>~^={(iB zxs$WmnDj3-8f|T~t(mmU?0EdhD=I2WT5evaYUhH3O{N~iY;5*H)PP;XHf_21U4Nwl z=!1Emwf7($sDO}&dc4f*(~jt}==h-wKBME&E>;`&X{|bKibJOlpeUQRxtOe(WU#OR zOasXP%9Ewh`YQE|a&~sRmSb8u&RturM#C z#xBM=TLZ{pi{;a&yLNiDuJg=?_nY?yCC)by+r;S8#XF{S9lvPbN2NB|>_&kOs^>wo z?CV6r$W5c8(77gVD>X72l4WOK zUU;m}``-LLC#U+760C)@3qrRijtX(qbo~5bazNtjKej$|@=F$y{WASvs?MTA;L)dc zr~zf}LOD;qShJdggTqg!FN3d=XpqNzJZ*XW2XE!{o$sT!-uDp@aJK07D1_p_Jlx)~ zSG0GX3QG9q$(jrI(~X74p4&|Cji=$$dpa?Ft3qda&lKRVZ_eU}>anW zxDeQS@n_f9dxiDcE8^EoZvy{4Nnx;jdr!gArZYkqJrB>u;LF<9$Aw@}di63$U(R{{ z)#|P#A|k|qan!41$A~=6p#p!Pug}_YXJ-JwoFGe?4m`X%;7Li=^QsD?lucAMHVOC zLR_k9&5Zkr_o(W`DJg#`WU(B}+fLO1XRP4)+Ttg{g^flY_c5S~W7eo!@_)Q7193at z+~=9M2Oig5>Zc00Q#KbFs*KIgzUv7jsz3UtO^hsHU=Rqyh+ec!HCFliqZ7aR?K+&8 zob>L3zY=X5%+B0y+B8#e{6!|&B`qyATK(^)dM8~E_r6`bCg4zk1C~k$(E90_iSUW( z>4~{HZCyo+3XKhu!Tn|x8#!hP2SY={je&G!CCBb<{5m={dQ1%D5zm8Ata{w=r$*X3 zI?5kErp8Rw29drZAtZdA+(!^(Yi{0#--mM&&=~-1tFzWT0JiVnl7PAESnu^__Ml7v zK!8CwFCK+Bi09y|Jatq+ucU2;3+sGSvtsL>pPzph{g9U8EPUGAbO&%jKU+PWBR8R( z$4%7&s=QpfA9SX9_g!tDN#(Tb;RCzT;Ba|6*ng&cW9~fmJrHTH8j zI^At8EMH10WU<92xNp5egUR#q;M}xvW2W#DG?*qQgV@1YAEl**Sv)qDkE3@p`9W*; zZzR5r*g_Fl;If`w7UgGWVhwY)PZp!q0|NsBm|C}kLXPaiWGMpb{&mTB$JnRdDUNJ| z^w99GIIyrv_x1up_zQI9q^{D;Y;V5t6-59+E_o?Ar_;jFtbvQ03 z^S$cT51h5(iD1_wKg-qjoae4I8;V0lX5*qt3gITS$&y&`J-i2xwBW_ncb;@1Ak%#u zdbY;F*RA1pApfc{P)0<^-INnma-=xwF(Lk$$aUoC98#{V-m`pi4&YYiu z(W-p8+33q{X`|vyeOp_v&Xe3{!AAIBTn6gg!Qve$?6F4mwLcW*>viN~2S$Sgf9rB< z_`wtKsDMvd2)BbDcrl)rqNKAxk8E($TMJvHT+`vKTYR0yN~yE^#|!fx+^m|W6J*w3 z@-k^vU3s|14XwIWxt*~Nl)^2g5T7iX67Bz6dhQwewW~}ZK!N0*fa@39p}`D2XgTbCr|9S zc=#^|Zt4;j9X)Yx{YoBi=HaiDFWA~ZZt`eDmiu5cyD%9Az4%e}3zg&N$uq-v|+IM%ReQ@gq!0Azdp^ z(1E~sJZHzTQJcE=W7!gaYgn~r@v}=ZO`kExxHS;(i;I`#xfUXUOrk_ zD0|gvkkKh@3`r>{$jDGjanR71+??evESR=}-9_^I@!58qOKou?;~In_Rw^M=818+V z)NB0W`O9OL1v5t}e)s`c*E2HG>jX13m~>q`Fv%wL&1h(7l9Cd1+j4axMmbGFrJq{| zj9ItVu zO3Q~k>$F_3DU%*edyz#E^Lgz1StTu$eRAwyJJfTZHx?B6y$)iRUkQF{eSeYe^Ltq^ z-u~|IYP85T{w;IMmI~NreqkvH+45+O&+mktggsmXWq53*<_=CtuabJ5tg*KU?w>F@gOe6!4z(<>DJmakujODmVBZz}bCjwcGZ z3)fzx>J~okRk9Ki-k{HszHmd z0qK@+^SNtQ?{d+>YP9f2Ury*I18_t>lJ*{|P^I)4#3y6RBNRSP)$?+S{- zt_9$bm6If`Np0_e3Ec4drY1_DJ{YR-M&AKJ4-pX`flPlUe0T5ZQU&b4Q#6;m!D7BW zNsDzE)FFL4+dgc63|9>gZ#$Z!AFj*WIjmbel_lII9(rX@n8GCIaj*pq%IZUNj zchK3@O)PX%2o9W*$@!}tKR-OIqUPF?XWWUjso@Ix$}GsppoO^0Oqo5r?g)+_JDe-G zDzZXGcvD*OO@;~6)C5SP8B=)OKu$6X>#57w&PqED9l|P#HefHv(Sw^TeQIF&!`o+o z>%44%MslyHXB<@;{$qZ4(@Y&t)o%tzis3o{Og2MA$NcJZI<@rs`(fG%bHsO zc!^$g7Czjv?LQydOQFM}S89p4bUCnoc6*u6_ArpHA&LBtLV78zpwFESN52ipf*{oO z8$^)EH%=Im^6%OuSA6WpPUfvh{8FL`-iO|`jv6yy$(}9;5#2*p$M)-3K6(nPE*Oh8 zf%wrup9RX3P8a+eyE$<13FLVvW~-j=tG2`Lr+bePJ^h~~E6|5kQNi{9Z*}?q&-DTS z|6l%J$t(V^hwp1pymawS)A%{~$`QH)vysf+e)YoM`KOnNK>c5N5)3q=zat>D9inuw z$p=rYW@G#^(n)3)|A5_v7ba!6)JOMf-(iXgUr$s{9Ftm)Dff4F2PJr*+Y-B$%U%Q; zN`Flt4=FF{OKHc~dXEx3Pm3*$(!W&p5%C8{?3<+*7Bms%1C|x|aw?ylfA{~pp1O)* z(wi62X%GrOa_TRR;5a-Dl!)U*EN;+u5Dn>6LgDP_Mf-w}5{M2ZLuNqh=w=iRREo$`{I;eTJkXVzZkb0?z0Tvk0{c81WK z+r@MkZCdA(y`o+?vwBu%u~50)29Vi}8#d(DIB&-*{3Ig$xi8>4 zR6i*AyAK(mPb`!^nj|~(5<|Mn?>h}MOOU-sOgt^_`{=jkUfOjXLVza4#}g)PwW=>b@;9{L9Iqti`G?(*&jIKO|2p1DpE0&f~YFVQ!Vj74z zd8huGX-uF0JeR9yS;snUk90Kezp*=_;dRh#ui2;P!fw-h zw`Sr=FCPoN^74pDZb1xy1XHKs2}g=%WFkkfb)!j=qKu%OuptkS`;Q3bCY~XAjRMt? ztgQK`bhXm_0?GhbxA6-&KR1jb>sta1t7fOO3q^ztuIvHtB58)OU6Iv{(ez8%gE{+K zjlbWX(Z0dGP6+9=@SSfu^P>EPPl1BP<*&`fp+z!fA|HuP*x_;W6tK<+ZP2K^e#mr# z3urP^Ri;{4X?=S14*7O8T{&fJsHFU=G0V! zG%8B7$ym|Z89TT`5uA=lDx~}2QyAQ3s5#w*|GuUe=q$8ZE&;W`hg6D8I-qN{zdiZLnlK0jmjMMm;)5>hb?CR(5~CU zL$rKea<4H#rCBaD9Zsge`D06cJx4lF{GB@~8+PpQGmm}CIlMc^4HL%>UUGl}(S!1j zn4!dwE95U#l0Y5}u+nmp|EeFz6 z^W<^tW^3Z%dj|&(+da*D>0_0ZoPe(KGL9o+b$qI{DoJ+GPMfzete5 zfX&v}h-fW-hJx;i?#A5S9#cJRr;P7{>`j6vWwcy|h=?o*7UJ3=bG-*PDG?cF4(vvI z%p>0>>JT3;NY^OIo;Y=f$)!NO_Fqa_1}k$hX)rIgQYEZ-96FG5lsK?cnS5(@UO9Y za0@V?!eo3MGe1~W8&5$Y2`?%5xwUj>g2eJq0gFw1cK&zqLfVY1t4xE5%*S>Y)0s&gn>SmaDUK?hk6a7S9e)@??)~vzi#8g-fJSgV?}k>b@1@v~gFAXmY7I za!;Sg!1feVsI>m8FH&hFbmAX~N4GCNbY3$KJ|Q{+?CeZ+Eof70Wd0U|1O^2O-W~bp zDJ1XB)O&LIIuW5fdjb}>N=w->TI3uS&CY}*%0?20`Vi{!9;!H*KnUvG;FIJyDQXCX zzroV24Gm2WVKs`;-2D9gZaLQT=f?{l=}uqto1(&gek)RNQjF=knjBN zevL$=K}vuQuq`+xDhaJn`1DmYhlE5*E}zpTKNGH~V}<9Tu1slG#V2W5pOMe27RGb^2;%$DB+bR?p10UbK`T~uL-=*O9>c!phm)ixfM(ibr zjy(CdfuYdy5|r?1`RwbFN|=~9o6*@Ful(`8EdU3y-Sm)R^>mF$NI3K*$q74ZSd3fb zgbDW*Ojt&0axxmJiHRv6I{T3az?OB~>_B|D0^{ofwrO+`6ecX~GR00z__^VVWMeM+`#ooB@ zjk2PZQ+S)Just};5*+K!Xe4Q5^qrU88?;+j##R1$D7)^@>^t%uKCU(&wq7cViBS>a z{M)4U^__P5%u4G*51ku!cj{1aofDGrHrKP{`(kY8YmUB%j7CQO%%(6}ml+tG7uaOp zYrO)I>|hbB>|6iSCzL-%WUREk$5+{)x^r_=2{3l8n<2p1BjETK{Ip}8_|+aKJZ8<| zk?HBtIZDiM9LJAVR*Tnr@wxh%J_V*j3#76(v@y3G%^Az_%X#@nMMrm_Ww=V>2~cT2Okx97UT2T(df z4{IN|+`g#N%L^P=Hq@xartL5=!|NPP)|NXk=J$&!;%}IAm6b0`YZpFNnJ+&IpS=U_ znz8LaeZXK^P>kCL)Q>VV)VfC00K`%Fv7{dlt*kgt5&dQ*^{TjDsWiod#Gu#{!jBCOHt>v1(QGWEGU$de7< zsHCOa_Af?-adM#CD^cCSt<>eCCoL2J#mSS~gK=$XjG-N|bo&ZlOGvaH*4#rocV-tS!D>tW`!!T}$LI z9)wV=kT!e_;%EXaArTTu=pN2yz3h-va+Z*h5o^^Z3Xh*@ Ra^SxR(h~CGB`|%z{{|73AF2QV literal 0 HcmV?d00001 diff --git a/content/posts/qubes/Using Split GPG and Split SSH on Qubes OS.md b/content/posts/qubes/Using Split GPG and Split SSH on Qubes OS/index.md similarity index 97% rename from content/posts/qubes/Using Split GPG and Split SSH on Qubes OS.md rename to content/posts/qubes/Using Split GPG and Split SSH on Qubes OS/index.md index 0150dab..f286114 100644 --- a/content/posts/qubes/Using Split GPG and Split SSH on Qubes OS.md +++ b/content/posts/qubes/Using Split GPG and Split SSH on Qubes OS/index.md @@ -5,7 +5,7 @@ tags: ['Operating Systems', 'Qubes OS', 'Security'] author: Tommy --- -![Split GPG & SSH](/images/split-gpg-ssh.png) +![Split GPG & SSH](split-gpg-ssh.png) This post will go over setting up Split GPG, then setting up Split SSH with the same PGP keys. Effectively, we are emulating what you can do with a PGP smartcard on Qubes OS. @@ -28,7 +28,7 @@ This part is based on the Qubes Community's [guide](https://forum.qubes-os.org/t - Get your keygrip with `gpg --with-keygrip -k` - Add your keygrip to the end of `~/.gnupg/sshcontrol` -![PGP Keygrip](/images/keygrip.png) +![PGP Keygrip](keygrip.png) ### In `vault`'s TemplateVM diff --git a/static/images/keygrip.png b/content/posts/qubes/Using Split GPG and Split SSH on Qubes OS/keygrip.png similarity index 100% rename from static/images/keygrip.png rename to content/posts/qubes/Using Split GPG and Split SSH on Qubes OS/keygrip.png diff --git a/static/images/split-gpg-ssh.png b/content/posts/qubes/Using Split GPG and Split SSH on Qubes OS/split-gpg-ssh.png similarity index 100% rename from static/images/split-gpg-ssh.png rename to content/posts/qubes/Using Split GPG and Split SSH on Qubes OS/split-gpg-ssh.png