Outdated, Deprecated, Archived Whonix ™ Documentation.

whonixcheck

! scope="row"| Whonix ™ Version and News | Download the Whonix ™ version and Whonix ™ news. Download Whonix ™ News Files with curl through an extra Whonix ™ news SocksPort. This check is designed to be functional:

• If the Whonix ™ repository is down or has changed.
• For users who have disabled Whonix-APT-Repository permanently or only enable it intermittently.

News features:

• The Whonix ™ News Format only reports the most important news for those not following Whonix ™ developments.
• The Whonix ™ version and news file is cryptographically signed by lead Whonix ™ developer Patrick Schleizer.
• Patrick's GPG key is copied to whonix_shared/usr/share/whonix/keys/whonix-keys.d/ at build time.
• A warning appears if the file can not be GPG-verified with Patrick's OpenPGP key. In that instance the version information and news is ignored.
• Messages signed more than one month in the past are rejected and the user is informed the message is no longer valid.

gpg4win Windows GnuPG

Import the Intevation CA Certificate

Before placing Trust in CA certificates understand the risks associated with the Fallible Certificate Authority Model.

The company that hosts GnuPG (Intevation ^[archive]) does not maintain a secure TLS ^[archive] site for gpg4win. To mitigate the threat from attackers using a man-in-the-middle attack to provide users with a forged version of GnuPG, Intevation offers a self-signed certificate. This certificate is itself secured by another certificate signed by GeoTrust ^[archive]; this certificate can be easily downloaded and imported.

1. Download the Intevation CA certificate.

• Browse to https://ssl.intevation.de [archive] → Right-click on "Intevation Root CA 2016" → Right-click OK.

Figure: Download SDK Installer

2. Import the certificate.

• Right-click Intevation-Root-CA-2016 file → Install Certificate → Right-click Open → "check" Local Machine → Right-click Next → "check" Automatically select the certificate store based on the type of certificate → Right-click Next → Right-click Finish.

If successful, the Certificate Import Wizard will show "The import was successful".

3. Click "OK" to exit.

Install YaCy

Security warning: Adding a third party repository allows the vendor to replace any package on your system. Proceed at your own risk! See Foreign Sources for further information. For greater safety, users adding third party repositories should always use Multiple Whonix-Workstation ™ to compartmentalize VMs with additional software.

1. Check the YaCy key fingerprint.

Before adding the repository, fetch the key and verify the fingerprint. Always check the fingerprint for yourself.

2. Add YaCy apt signing key.

sudo apt-key --keyring /etc/apt/trusted.gpg.d/yacy-pubkey.gpg adv --keyserver hkp://ipv4.pool.sks-keyservers.net:80 --recv-keys 8BD752501CB62448A30EA3EA1F968B3903D886E7

sudo apt-key --keyring /etc/apt/trusted.gpg.d/yacy-pubkey.gpg adv --keyserver hkp://ipv4.pool.sks-keyservers.net:80 --recv-keys 8BD752501CB62448A30EA3EA1F968B3903D886E7

3. Add YaCy repository.

echo 'deb http://debian.yacy.net ./' > /etc/apt/sources.list.d/yacy.list

echo 'deb http://debian.yacy.net ./' > /etc/apt/sources.list.d/yacy.list

Update the package lists.

sudo apt-get update

sudo apt-get update

4. Install openjdk-7-jre-headless and yacy -- see footnote.

sudo apt-get install openjdk-7-jre-headless yacy

sudo apt-get install openjdk-7-jre-headless yacy

To read more on managing YaCy, consult the official documentation ^[archive].

Grow Virtual Harddisk

VirtualBox

In case more disk space is required for your virtual hard disk, the good news is that you are still a VirtualBox user. Whonix ™ is nothing special; it is just another VM image. Any suggestions you find for VirtualBox will similarly work for Whonix ™.

This process is moderately difficult because there is no easy upstream solution (such as a GUI). Further, you have a VMDK disk instead of a VDI disk. There is also no better (free, open source) virtualizer with this feature. However, most users can successfully complete this process and it is easier if Whonix ™ is built from source. In case you are using the download version, it is a bit more difficult.

Unfortunately, at the time of writing vboxmanage modifyhd <uuid|filename> --resize <size in mb> does not support VMDK images yet. The situation may have subsequently changed.

1. On the host: Make a clone of all states of your existing virtual machine in case something goes wrong.

2. On the host: Delete all existing snapshots.

3. On the host: Find the folder of your virtual hdd.

vboxmange list hdds

vboxmange list hdds

4. On the host: Switch to that folder.

5. On the host: Convert from VMDK to VDI.

VBoxManage clonehd "Whonix-Workstation-disk1.vmdk" --format vdi "Whonix-Workstation-disk1.vdi"

VBoxManage clonehd "Whonix-Workstation-disk1.vmdk" --format vdi "Whonix-Workstation-disk1.vdi"

6. Check the syntax.

VBoxManage modifyhd

VBoxManage modifyhd

7. On the host: Grow the disk.

VBoxManage modifyhd "Whonix-Workstation-disk1.vdi" --resize 100000

VBoxManage modifyhd "Whonix-Workstation-disk1.vdi" --resize 100000

8. On the host: VirtualBox VM settings → mass storage.

Remove the old .vmdk, add the new .vdi.

9. Boot up and check if it is still working.

10. Up to this point only the physical size was increased, but the filesystem has not been changed. Shut down again.

11. Inside VM: You have to boot from a boot cd (Ubuntu Precise *DVD* did work) and use a tool like gparted to grow the filesystem.

Start a terminal.

lxsudo gparted

lxsudo gparted

12. Inside VM: Increase the filesystem. Apply and shut down.

The procedure is complete.

Ethereum Wallet

UNFINISHED

UNFINISHED!

Connection Issues

Ethereum cannot be directly run over Tor yet since it requires UDP. This might change when geth 1.5 is released.

In meanwhile your only option is to Tunnel UDP over Tor.

• Qubes-Whonix ™: The proably easiest way is to Connect to Tor before a VPN using a Separate VPN-Gateway (User → Tor → VPN → Internet).
• Non-Qubes-Whonix ™: Harder, but best is probably Connect to Tor before a VPN (User → Tor → VPN → Internet).

Installation

Check the newest version of Mist before proceeding. If there is a newer version than 0.8.4, these instructions below need to be slightly updated.

curl --location --tlsv1.2 --proto =https https://github.com/ethereum/mist/releases/download/v0.8.4/Mist-linux64-0-8-4.deb > Mist-linux64-0-8-4.deb

sudo dpkg -i Mist-linux64-0-8-4.deb

sha256sum Mist-linux64-0-8-4.deb

sudo apt-get install -f

Now Mist should be installed.

If that does not work...

Install libappindicator1 libdbusmenu-glib4 libdbusmenu-gtk4 libindicator7 libxss1.

1. Update the package lists.

sudo apt-get update

sudo apt-get update

2. Upgrade the system.

sudo apt-get dist-upgrade

sudo apt-get dist-upgrade

3. Install the libappindicator1 libdbusmenu-glib4 libdbusmenu-gtk4 libindicator7 libxss1 package.

Using apt-get command line parameter --no-install-recommends is in most cases optional.

sudo apt-get install --no-install-recommends libappindicator1 libdbusmenu-glib4 libdbusmenu-gtk4 libindicator7 libxss1

sudo apt-get install --no-install-recommends libappindicator1 libdbusmenu-glib4 libdbusmenu-gtk4 libindicator7 libxss1

The procedure of installing libappindicator1 libdbusmenu-glib4 libdbusmenu-gtk4 libindicator7 libxss1 is complete.

sudo dpkg -i Mist-linux64-0-8-4.deb

keepassxc manual installation

Get keepassxc signing key.

gpg --recv-keys C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8

gpg --recv-keys C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8

Download keepassxc.

curl --location --remote-name --tlsv1.2 https://github.com/keepassxreboot/keepassxc/releases/download/2.3.4/KeePassXC-2.3.4-x86_64.AppImage

curl --location --remote-name --tlsv1.2 https://github.com/keepassxreboot/keepassxc/releases/download/2.3.4/KeePassXC-2.3.4-x86_64.AppImage

Download keepassxc signature.

curl --location --remote-name --tlsv1.2 https://github.com/keepassxreboot/keepassxc/releases/download/2.3.4/KeePassXC-2.3.4-x86_64.AppImage.sig

curl --location --remote-name --tlsv1.2 https://github.com/keepassxreboot/keepassxc/releases/download/2.3.4/KeePassXC-2.3.4-x86_64.AppImage.sig

Verify keepassxc signature.

gpg --verify KeePassXC*.sig

gpg --verify KeePassXC*.sig

Should show the following.

gpg: assuming signed data in 'KeePassXC-2.3.4-x86_64.AppImage'
gpg: Signature made Thu 23 Aug 2018 01:31:30 PM EDT
gpg:                using RSA key C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8
gpg: Good signature from "KeePassXC Release <release@keepassxc.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: BF5A 669F 2272 CF43 24C1  FDA8 CFB4 C216 6397 D0D2
     Subkey fingerprint: C1E4 CBA3 AD78 D3AF D894  F9E0 B7A6 6F03 B590 76A8

Make keepassxc executable.

chmod +x KeePassXC*

chmod +x KeePassXC*

Automatically Prepend Tor Browser with Firejail

Starting with Whonix ™ 14, users can automatically prepend the Tor Browser binary with Firejail. This setting can be used in either the TemplateVM or TemplateBasedVM (Qubes-Whonix ™: anon-whonix).

TemplateVM

This is useful in Whonix-Workstation ™ (whonix-ws-15).

Open file /etc/torbrowser.d/50_user.conf in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security ^[archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/torbrowser.d/50_user.conf

sudoedit /etc/torbrowser.d/50_user.conf

Paste.

tb_starter_bin_pre="firejail"

tb_starter_bin_pre="firejail"

Save.

TemplateBasedVM

In Qubes-Whonix ™, this is useful in anon-whonix.

Open file /rw/config/torbrowser.d/50_user.conf in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security ^[archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /rw/config/torbrowser.d/50_user.conf

sudoedit /rw/config/torbrowser.d/50_user.conf

Paste.

tb_starter_bin_pre="firejail"

tb_starter_bin_pre="firejail"

Save.

Debug

To debug any problems, run.

bash -x torbrowser

bash -x torbrowser

VirtualBox Troubleshooting

PAE Crash

1. Modify this setting in Whonix-Gateway ™: Virtual Box → Right-click on Whonix-Gateway ™ → Settings → System → Processor → Uncheck the Enable PAE/NX Box → OK
2. Afterwards, repeat these steps in Whonix-Workstation ™.

VERR_VMX_MSR_VMXON_DISABLED

1. Modify this setting in Whonix-Gateway ™: Virtual Box → Right-click on Whonix-Gateway ™ → Settings → System → Acceleration → Uncheck the "Enable VT-x/AMD-V" Box → OK
2. Afterwards, repeat these steps in Whonix-Workstation ™.

If it still doesn't work, change the following setting:
Virtual Box → Right-click on Whonix-Gateway ™ → Settings → System → Acceleration → Uncheck the "Enable Nested Paging" Box → OK

Kernel Panic

Kernel panics are often caused by similar issues that result in the PAE crash and VERR_SSM_FIELD_NOT_CONSECUTIVE errors discussed above.

If possible, enable VT-x in BIOS settings.

If this option is unavailable, then disable PAE/NX in VirtualBox; see PAE crash above for instructions.

SecBrowser Qubes Stub

SecBrowser is a security-focused browser that provides vulnerability surface reduction for users that need high security, thereby reducing the risk of infection from malicious, arbitrary code. A built-in security slider provides enhanced usability, as website features which have historically been used as attack vectors (like JavaScript) can be easily disabled. Without any customization, SecBrowser’s default configuration offers better security than Firefox, Google Chrome or Microsoft Edge. It also provides better protections from online tracking, fingerprinting ^[archive] and the linkability ^[archive] of activities across different websites.

SecBrowser is a derivative of the Tor Browser Bundle, but without Tor. This means unlike Tor Browser, SecBrowser does not route traffic over the Tor network. Even without the aid of the Tor network, SecBrowser still benefits from the numerous patches ^[archive] that Tor developers have merged into the code base. Even with developer skills, these enhancements would be arduous and time-consuming to duplicate in other browsers, with the outcome unlikely to match SecBrowser's many security benefits. While browser extensions can be installed to mitigate specific attack vectors, this ad hoc approach is insufficient. SecBrowser leverages the combines experience and knowledge of the Tor Project developers, Whonix developers and the battle-tested Tor Browser.

SecBrowser Security Enhancements

Features	Description
HTTPS Everywhere	This browser extension encrypts communications with many major websites, making your browsing more secure.
NoScript	NoScript can provide significant protection with the correct configuration. NoScript blocks active (executable) web content and protects against cross-site scripting [archive] (XSS). "The add-on also offers specific countermeasures against security exploits".
DNS and Proxy Configuration Obedience	Proxy obedience is achieved through custom patches, Firefox proxy settings, and build flags. Plugins which can bypass proxy setting are disabled.
Reproducible Builds	Build security is achieved through a reproducible build process that enables anyone to produce byte-for-byte identical binaries to the ones the Tor Project releases.
Slider Security	Enables improved security by disabling certain web features that can be used as attack vectors.
WebRTC Disabled by Default	WebRTC can compromise the security of VPN tunnels, by exposing the external (real) IP address of a user.

Settings

While SecBrowser has numerous security enhancements they can come at a cost of decreased usability. Since it is also highly configurable, security settings and behavior can be customized according to personal requirements.

• Private Browsing Mode: In the default configuration Tor Browser has private browsing mode enabled. This setting prevents browsing and download history as well as cookies from remaining persistent across browser restarts. While private browsing mode increases security, usability can be affected to the point that some websites will not function properly or not at all. To enhance usability SecBrowser comes packaged with a custom user_pref that disables private browsing mode. If privacy is paramount users can enable private browsing mode by commenting out the corresponding user preference.

• Security Slider: By default the security slider is set to "Safest" which is the highest security setting.This will prevent some web pages from functioning properly, so security needs must be weighed against the degree of usability that is required.

• Persistent NoScript Settings: SecBrowser includes a user_pref that allows custom NoScript settings to persist across browser sessions.This is a security vs usability trade-off.

• Remember Logins and Passwords for Sites: To increase usability, users have the option to save site login information such as user names or passwords.

Privacy and Fingerprinting Resistance

Research from a pool of 500,000 Internet users has shown that the vast majority (84%) have unique browser configurations and version information which makes them trackable across the Internet. When Java or Flash is installed, this figures rises to 94%. SecBrowser shares the fingerprint with around three million ^[archive] other Tor Browser users, which allows people who use SecBrowser to "blend in" with the larger population and better protect their privacy.

The EFF has found ^[archive] that while most browsers are uniquely fingerprintable, resistance is afforded via four methods:

• Disabling JavaScript with tools like NoScript.
• Use of Torbutton, which is bundled with SecBrowser and enabled by default.
• Use of mobile devices like Android and iPhone.
• Corporate desktop machines which are clones of one another.

With JavaScript disabled, SecBrowser provides significant resistance to browser fingerprinting.

• The User Agent is uniform for all Torbutton users.
• Plugins are blocked.
• The screen resolution is rounded down to 50 pixel multiples.
• The timezone is set to GMT.
• DOM Storage is cleared and disabled.

The EFF's Panopticlick ^[archive] fingerprint test shows that SecBrowser resists fingerprinting.

Note: Because tracking techniques are complex, Panopticlick does not measure all forms of tracking and protection.

• SecBrowser conveys 6.26 bits of identifying information.
• One in 76.46 browsers having the same fingerprint.
• Browser's that convey lower bits of identification are better at resisting fingerprinting.

When Tor Browser's and SecBrowser's HTTP headers are compared using Fingerprint central ^[archive] the test results are near identical.

Table: Tor Browser vs SecBrowser HTTP headers comparison.

Percentage (%) out of 1652 with fingerprints tags [Firefox,Windows]:

Name	Value	Tor Browser	SecBrowser
		%	%
User-Agent	Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0	2.48	2.42
Accept	text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8	97.15	97.15
Host	fpcentral.irisa.fr	90.44	90.43
Content-Length		100.00	100.00
Accepted-Language	en-US,en;q=0.5	32.63	32.95
Referer	https://fpcentral.irisa.fr/ [archive]	69.37	69.35
Upgrade-Insecure-Requests	1	83.05	83.04
Accepting-Encoding	gzip, deflate, br	82.14	82.13
Content-Type		100.00	100.00
Connection	close	100.00	100.00

Install SecBrowser

SecBrowser can be installed using tb-updater which is a package developed and maintained by Whonix developers. When run, tb-updater seamlessly automates the download and verification of SecBrowser (from The Tor Project's website). One of the many benefits of tb-updater is the ability to disable Tor is prebuilt into the software. This improves usability and is convenient since a security-focused browser (SecBrowser), is readily available. Unlike other manual methods of disabling Tor, this greatly simplifies the procedure and lessens the chance of a configuration error.

Conclusion

SecBrowser is a highly configurable security-focused browser that affords users with numerous options to fine tune their browser's security and usability. This can be achieved through user preferences (user_pref) or on the fly by means of an easy to use and intuitive security slider. This allows users to easily and seamlessly change their security posture to meet changing environments. SecBrowser's fingerprinting resistance provides strong protection against web tracking and can be combined with a VPN to further enhance privacy. SecBrowser can be used with any Debian 10 (buster) based operating system including SecOS ^[archive] (a Hardened Debian based OS) which is in active development and coming soon.

OnionShare Installation from git

1. Optional: Create a separate Whonix-Workstation ™ (Qubes-Whonix ™: anon-onionshare AppVM).

Note: This is not strictly necessary, but best practice is to separate anonymous activities of a different nature in distinct VMs (AppVMs).

In Qubes-Whonix ™, to clone the existing anon-whonix:

Qube Manager → Right-click on anon-vm → Select "Clone qube" → Rename to "anon-onionshare"

2. Install git in Whonix-Workstation ™ (anon-onionshare).

Open a terminal (Konsole) in Whonix-Workstation ™ (anon-onionshare) and navigate to the persistent home directory.

cd /home/user

cd /home/user

Next install git which is not available by default in the VM (AppVM).

sudo apt-get install git

sudo apt-get install git

3. Clone the OnionShare directory.

This will pull the OnionShare source code directly from GitHub.

git clone https://github.com/micahflee/onionshare.git

git clone https://github.com/micahflee/onionshare.git

Next navigate to the OnionShare directory.

cd onionshare

cd onionshare

4. Retrieve the OnionShare PGP signing key.

This step retrieves the OnionShare developer's PGP key using its long key ID.

gpg --keyserver pool.sks-keyservers.net --recv-keys 0x927F419D7EC82C2F149C1BD1403C2657CD994F73

gpg --keyserver pool.sks-keyservers.net --recv-keys 0x927F419D7EC82C2F149C1BD1403C2657CD994F73

5. Examine and verify the git tags and commit.

These steps list the available git tags, and verifies the latest version and its commit (v2.0 at the time of writing).

Good signature messages should appear for each verify command below. Do not proceed if signatures are bad! In that case, remove the OnionShare directory and repeat step 3.

git tag

git tag

git verify-tag v2.0

git verify-tag v2.0

git verify-commit v2.0^{commit}

git verify-commit v2.0^{commit}

Qubes-Whonix ™ users should shut down anon-onionshare prior to the next step.

6. Install OnionShare dependencies.

Several dependencies must be installed in Whonix-Workstation ™ (whonix-ws-15 TemplateVM) for OnionShare to work correctly. Locate the BUILD.md file in the OnionShare repository and run the necessary apt-get commands in the "Debian-like distros" section.

For example, for OnionShare 2 run in a terminal (Konsole).

sudo apt install -y python3-flask python3-stem python3-pyqt5 python3-crypto python3-socks python-nautilus tor obfs4proxy python3-pytest build-essential fakeroot python3-all python3-stdeb dh-python

sudo apt install -y python3-flask python3-stem python3-pyqt5 python3-crypto python3-socks python-nautilus tor obfs4proxy python3-pytest build-essential fakeroot python3-all python3-stdeb dh-python

Qubes-Whonix ™ users should shutdown the whonix-ws-15 TemplateVM after dependencies have installed, and restart the anon-onionshare AppVM.

Notice

Note: Whonix ™ users should download new releases with Tor Browser Downloader (Whonix ™).

6 May, 2019

Tor Browser 8.0.9 is now available from the Tor Browser Download page ^[archive] and also from our distribution directory ^[archive].

This release fixes the issue which caused NoScript and all other Firefox extensions signed by Mozilla to be disabled ^[archive].

If you used the workaround mentioned in our previous blog post ^[archive], don't forget to set the xpinstall.signatures.required entry in about:config back to true after installing this update.

---

8 May, 2019

Tor Browser 8.5a12 is now available from the Tor Browser Alpha download page ^[archive] and also from our distribution directory ^[archive].

...

This release fixes the issue which caused NoScript and all other Firefox extensions signed by Mozilla to be disabled ^[archive].

If you used the workaround mentioned in our previous blog post ^[archive], don't forget to set the xpinstall.signatures.required entry in about:config back to true after installing this update.

Repository Location URI

To set the default Whonix ™ repository URI, choose one of the following.

Default https URI.

sudo whonix_repository --baseuri https://deb.whonix.org --enable --repository stable

sudo whonix_repository --baseuri https://deb.whonix.org --enable --repository stable

Onion URI. See also Onionizing Repositories.

sudo whonix_repository --baseuri tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion --enable --repository stable

sudo whonix_repository --baseuri tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion --enable --repository stable

To undo any changes, just run the Whonix ™ APT Repository Tool again.

APT Security Update - DSA 4371-1

Special instructions are required to update due to APT security update DSA 4371-1 ^[archive]

This procedure is not required for Whonix ™ 14.0.1.3.8 or above.

Using onion sources might provide protection against this vulnerability. The special instructions below should be safe for Whonix ™ users; minor modifications are necessary for Debian platforms.

1. Move /etc/apt/sources.list.d/debian.list to a temporary location.

sudo mv /etc/apt/sources.list.d/debian.list /etc/apt/debian.list

sudo mv /etc/apt/sources.list.d/debian.list /etc/apt/debian.list

2. Create an apt sources list that works without redirections.

echo "deb http://cdn-fastly.deb.debian.org/debian-security stable/updates main" | sudo tee /etc/apt/sources.list.d/debian.list

echo "deb http://cdn-fastly.deb.debian.org/debian-security stable/updates main" | sudo tee /etc/apt/sources.list.d/debian.list

3. Securely update the package lists using the -o Acquire::http::AllowRedirect=false workaround.

sudo apt-get -o Acquire::http::AllowRedirect=false update

sudo apt-get -o Acquire::http::AllowRedirect=false update

4. Securely upgrade apt-get using the -o Acquire::http::AllowRedirect=false workaround.

sudo apt-get -o Acquire::http::AllowRedirect=false upgrade

sudo apt-get -o Acquire::http::AllowRedirect=false upgrade

5. Verify the installed apt version has been upgraded.

dpkg -l | grep "commandline package manager"

dpkg -l | grep "commandline package manager"

This command should show.

ii  apt                                            1.4.9                                      amd64        commandline package manager

The output above shows apt version 1.4.9, which includes the security fix.

6. Delete the temporary /etc/apt/sources.list.d/debian.list.

sudo rm /etc/apt/sources.list.d/debian.list

sudo rm /etc/apt/sources.list.d/debian.list

7. Restore the original /etc/apt/sources.list.d/debian.list.

sudo mv /etc/apt/debian.list /etc/apt/sources.list.d/debian.list

sudo mv /etc/apt/debian.list /etc/apt/sources.list.d/debian.list

8. Perform the Standard Upgrade Steps.

The procedure is now complete.

Forum discussion:
https://forums.whonix.org/t/special-instructions-required-to-securely-update-because-of-apt-security-update-dsa-4371-1/6721 ^[archive]

Upgrade

Upgrade torsocks and usability-misc first.

apt-get install torsocks usability-misc

apt-get install torsocks usability-misc

Ignore any errors relating to missing torsocks libraries.

Stop whonixcheck systemd unit.

systemctl stop whonixcheck

systemctl stop whonixcheck

Purge packages which are not required or deprecated in Whonix ™ and have been replaced by new functionality.

VirtualBox Guest Addition

For Whonix ™ versions below 14

If you are using a default Whonix-Gateway ™ or Whonix-Workstation ™, follow these steps:

1) Power off the virtual machine.

2) Go to the VirtualBox main window -> Right click a VM -> choose Settings -> Shared Folders -> click on the 'plus +' icon -> under 'Folder Path' choose a folder from your host OS -> in 'Folder Name:' type shared. Tick the Auto-mount checkbox. Press OK.

3) Power on the virtual machine.

4) Done. Files you drop into /mnt/shared in the virtual machine will end up in your host OS shared folder and vice versa.

Tor Browser Licensing

• Tor Browser is installed by default in the Qubes-Whonix ™ Whonix-Workstation ™, but not in Non-Qubes-Whonix ™ for licensing reasons. This will change in Whonix ™ 14.

Browser Plugins

Flash Leak Test SocksPort and TransPort

Flash Leak Test both TransPort

Introduction

We explain the risks of browser plugins (flash etc.), discuss some alternatives and finally explain how to use browser plugins anyway in the best possible secure manner.

Tor Browser

For information about Tor Browser in general, see Tor Browser.

Warning not to use them

Some popular plugins are non-Free, Closed Source software! See Warning, Avoid non-Free Software. Check if your browser plugin is Free Software before using it.

Quoted the Whonix ™ Features page : "Java / JavaScript / flash / browser plugins / Malware / misconfigured applications cannot leak your real external IP." "This is still not recommended as they may decrease anonymity (e.g. flash cookies) and often have security vulnerabilities. Some popular plugins are closed source. See Whonix ™ Security in real world ^[archive]."

Although it is not recommended, we don't want to withhold the knowledge from you how to use browser plugins.

IP leaks are not easily possible.

The concern against browser plugins can be broken down to:

1. Non-Free Software. See our warning Box above.

2. Linkability: browser plugins use can be probably correlated to the same pseudonym ^[archive].

3. Fingerprinting: browser plugins can probably leak lots of information about your (virtual) operating system (Whonix-Workstation ™)

4. Security: some plugins have a history for remote exploits. More precise: the risk for your virtual operating system to get infected by trojan horses etc. is higher.

But anyway, of course you should look for alternatives first (see below), but if you insist on using browser plugins, an isolating/transparent proxy like Whonix ™ is probably your best bet.

Avoiding browser plugins

Avoiding browser plugins and flash is better than using them.

Note that there are alternatives to browser plugins. Most of the workarounds aren't a 100% complete, perfect drop in replacement, but perhaps it works sufficient for you (for example, if you only need youtube). Alternatives are html5, gnash, flash video replacer, flash video download or using a flash video download and convert online service. There are also applications worth checking, such as youtuberipper, ClipGrab, minitube, Totem with totem-plugins-extra, etc. Discussing the flash alternatives in details is beyond the scope of Whonix ™.

Also the Tails folks prepared a good list of Flash alternatives, see Tails Flash support ^[archive].

If you still want to use browser plugins or flash, read below.

How to use Flash - EASY

Adobe Flash is non-Free, Closed Source software!
Make sure you have read our Warning not to use them ^[archive] above first!

If you insist on using browser plugins anyway (read warnings ^[archive] above), you can install new software in Whonix-Workstation ™. Your best bet may be using the Tor Browser. JDownloader is a Libre alternative to Flash for downloading videos for local viewing.

Your IP/location will still be hidden. Consider the plugin usage pseudonymous rather than anonymous ^[archive]. This is the EASY chapter, which does not include all security considerations. For those, read the whole page.

If you are using any plugins such as Flash, it will be probably known to the exit relay, exit relay's ISP and website, that you are a Whonix ™ user.

Install Flash.

sudo apt-get install flashplugin-nonfree

sudo apt-get install flashplugin-nonfree

(2) Additionally, it might make sense to install Firefox (Tor Browser) Add-On BetterPrivacy BetterPrivacy ^[archive], which can be setup to delete Flash Cookies.

(3) Activate browser plugins in Tor Browser.

To activate browser plugins in Tor Browser right click on Tor Button -> Preferences... -> Security Settings -> uncheck: Disable Plugins during Tor usage. You have to restart Tor Browser.

(4) Updating Flash

Each time there is a new version of flash, you should update.

sudo update-flashplugin-nonfree --install --verbose

sudo update-flashplugin-nonfree --install --verbose

How to use other browser plugins

Note that Tor Browser developers added a patch , which blocks all plugins except flash. To use other plugins, read the more advanced guide below.

How to use browser plugins - Advanced

If you don't like to use Tor Browser, you could install the mainstream Firefox, Chromium, Flash etc. For a discussion whether this is good or bad for anonymity, see the "More Security" section below.

Firefox.

sudo apt-get install firefox-esr

sudo apt-get install firefox-esr

Or Chromium.

sudo apt-get install chromium-browser chromium-browser-l10n

sudo apt-get install chromium-browser chromium-browser-l10n

How to use browser plugins - More Security

Read the EASY chapter above first

Read the EASY chapter above first

Deactivate unneeded browser plugins

It is recommended to activate only plugins, you really use. On most browsers their is a pseudo URL 'about:plugins' to check which are activated. Go to Tor Browser -> Tools -> Plugins and deactivate all plugins, which you don't need, or even better, uninstall them.

Separate Tor Browser or Separate Whonix-Workstation ™ dedicated to browser plugins

For best security use More than one Tor Browser behind an transparent or isolating proxy ^[archive] or even better, VM snapshots ^[archive] or Multiple Whonix-Workstation ™ ^[archive].

SocksPort vs TransPort

Using the easy instructions above will cause Tor Browser to go through SocksPort and browser plugins such as Flash to go through TransPort. It may or may not make sense to either force both through a SocksPort (difficult) or to force both through the TransPort, see footnotes.

Download Flash directly from Adobe

Adobe Flash is non-Free, Closed Source software!
Make sure you have read our Warning not to use them ^[archive] above first!

If you insist on using it... For better security or if Flash from the Debian repository does not work for you, Flash can be downloaded directly from Adobe.

(1) Go to https://get.adobe.com/flashplayer/otherversions/ ^[archive]

(2) choose Linux (32-bit)

(3) choose 11.2 for other Linux (.tar.gz) 32-bit

(4) click on the Download now button

(5) you will see

An external application is needed to handle:

https://fpdownload.macromedia.com/get/flashplayer/pdc/11.2.202.270/install_flash_player_11_linux.i386.tar.gz

[...]

Verify, that you'll download from https.

(6) Download.

(7) Unpack.

(8) Follow the Installation instructions in the readme.txt.

License

Gratitude is expressed to JonDos ^[archive] for permission ^[archive] to use material from their website. (w ^[archive]) (w ^[archive]) The "Restrict Flash Settings" chapter of the Whonix ™ BrowserPlugins wiki page contains content from the JonDonym documentation How to anonymize Flash videos and applets ^[archive] page.

Qubes DisposableVM

Adding Shortcuts to Application Menus

Qubes 3.2 / XFCE4 (Untested)

Make a .desktop file for every DisposableVM shortcut that will be added to the menu. These .desktop files must be placed in ~/.local/share/applications/.

Open a terminal in the DisposableVM Template.

dom0 → Qubes VM Manager → right-click on 'whonix-ws-15-dvm' → click 'Run command in VM' → type 'konsole'

Create a local applications directory.

mkdir -p ~/.local/share/applications/

mkdir -p ~/.local/share/applications/

Use a text editor to create and open each .desktop file and logically name each one.

kwrite ~/.local/share/applications/dvm-torbrowser.desktop

kwrite ~/.local/share/applications/dvm-torbrowser.desktop

As appropriate, add the following entries and substitute fields to each .desktop file. In the Exec field, substitute torbrowser with the command used to launch each relevant application matching the shortcut. For example: konsole, kwrite, libreoffice, kgpg, okular, dolphin and so on.

[Desktop Entry]
Name=Tor Browser
Comment=Launch Tor Browser in DisposableVM
Type=Application
Terminal=false
Exec=sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

[Desktop Entry] Name=Tor Browser Comment=Launch Tor Browser in DisposableVM Type=Application Terminal=false Exec=sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

Icon= & Category= are also useful fields. Feel free to research the .desktop specification using the footnote above.

Once the .desktop files have been created, they need to be added to the Applications menu. Use a text editor to edit the following file.

kwrite ~/.config/menus/xfce-applications.menu

kwrite ~/.config/menus/xfce-applications.menu

Find the menu entry associated with the DisposableVM Template. (Help!)

<Menu>
    <Name>DisposableVMTemplate</Name>

<Menu> <Name>DisposableVMTemplate</Name>

In the <Include> subsection, add the appropriately named .desktop file.

<Filename>dvm-torbrowser.desktop</Filename>

<Filename>dvm-torbrowser.desktop</Filename>

Qubes 3.2 / XFCE4: MenuLibre (Untested)

This is recommended for testers only! Users should know how to fix the application menu in case it breaks. If interested, click on Expand on the right.

Warning: Testers have previously experienced removal of the Qubes System Tools start menu entry ^[archive] when applying these changes! For greater safety, consider using git to manage the home folder so any MenuLibre changes can be reverted.

In dom0, run.

sudo qubes-dom0-update menulibre

sudo qubes-dom0-update menulibre

The use the menu editor.

Qubes Start Menu → System Tools → Menu Editor

spawn from other VMs

If intending to spawn DisposableVMs from other VMs, configure the NetVM for the DisposableVM setting, see Warning: Use caution when spawning DisposableVMs from other VMs.

new DisposableVM Template

Step 4: Configure Whonix-Gateway ™ as the NetVM.

dom0 → Qubes VM Manager → right-click on 'whonix-ws-15-dvm' → VM Settings → NetVM → sys-whonix

Updating Tor Browser

Tor Browser presents a special situation because it is installed in a user's home directory. As a result, the TemplateVM (whonix-ws-15) never updates existing Tor Browser installations.

Non-Customized DisposableVM Templates Users

To obtain the latest Tor Browser, the simplest method is to use Whonix ™ built-in Tor Browser downloader functionality. Simply update using Tor_Browser#Tor_Browser_Downloader_by_Whonix ™Tor Browser Downloader by Whonix ™ (tb-updater) in whonix-ws-15 when performing your usual maintenance upgrading ^[archive].

Update and upgrade.

sudo apt-get update && sudo apt-get dist-upgrade

sudo apt-get update && sudo apt-get dist-upgrade

Then, create a new DisposableVM to overwrite the existing one.

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") → System Tools → Konsole or Xfce Terminal

Create a new DisposableVM Template using the updated whonix-ws-15 TemplateVM.

qvm-create-default-dvm whonix-ws

qvm-create-default-dvm whonix-ws

Customized DisposableVM Template Users

Users have two choices:

1. Tor_Browser#Tor_Browser_Downloader_by_Whonix ™Tor Browser Downloader by Whonix ™ (tb-updater) (update-torbrowser)
2. Tor Browser's internal updater.

Option #1: Use update-torbrowser to download a new copy of Tor Browser

dom0 → Qubes VM Manager → right-click on 'whonix-ws-15-dvm' → click 'Run command in VM' → type 'konsole'

Launch Tor Browser Downloader by Whonix ™ and follow the instructions.

update-torbrowser --input gui

update-torbrowser --input gui

Shutdown the DisposableVM Template.

dom0 → Qubes VM Manager → right-click on 'whonix-ws-15-dvm' → click 'Shutdown VM'

Regenerate the DisposableVM Template.

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") → System Tools → Konsole or Xfce Terminal

Then run.

qvm-create-default-dvm whonix-ws

qvm-create-default-dvm whonix-ws

Option #2: Use Tor Browser's internal updater and download new updates only

dom0 → Qubes VM Manager → right-click on 'whonix-ws-15-dvm' → click 'Run command in VM' → type 'torbrowser'

Use Tor Browser's Internal Updater by clicking TorButton and selecting Check for Tor Browser Update. Close and restart Tor Browser.

Shutdown the DisposableVM Template.

dom0 → Qubes VM Manager → right-click on 'whonix-ws-15-dvm' → click 'Shutdown VM'

Regenerate the DisposableVM Template.

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") → System Tools → Konsole or Xfce Terminal

Regenerate the template.

qvm-create-default-dvm whonix-ws

qvm-create-default-dvm whonix-ws

Edit Qubes' DisposableVM Start Menu

Complete the following to work around #Warning: Do not use Firefox from Qubes DisposableVM default start menu.

In Qubes dom0.

alt + F3 → on the left side, click 'DisposableVM' → right-click on 'Firefox' → edit ->

• Name: DisposableVM: Tor Browser
• Command: sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

→ click 'Save'

While editing entries, it is also possible to edit the xterm entry and change it to konsole. This is not important for security, but may be a personal preference.

R3.2 If you wish to install the alpha version of Tor Browser

Advanced users: If you wish to install the alpha version of Tor Browser, click on Expand on the right.

Option #1: Use a non-customized DisposableVM Template

This template will use a stock image based on whonix-ws and will not preserve any changes that are made to it.

Step 1: Disable tb-updater's functionality which automatically updates during apt-get inside the Qubes TemplateVM.

This prevents the preferred Tor Browser version being overwritten by the stable version.

In whonix-ws terminal, run.

echo "tb_install_follow=false" | sudo tee -a /etc/torbrowser.d/50_user.conf

echo "tb_install_follow=false" | sudo tee -a /etc/torbrowser.d/50_user.conf

Step 2: Install the preferred version of Tor Browser to TemplateVM by launching Tor Browser Downloader by Whonix ™ and following the instructions.

In whonix-ws terminal, run.

noaskstart=true update-torbrowser --input gui >/dev/null 2>&1

noaskstart=true update-torbrowser --input gui >/dev/null 2>&1

Step 3: Create a DisposableVM Template based on the whonix-ws TemplateVM.

In dom0 terminal, run.

qvm-create-default-dvm whonix-ws

qvm-create-default-dvm whonix-ws

When a new version of Tor Browser is released, repeat the previous two steps to update the TemplateVM and DisposableVM Template.

Option #2: Use a Customized DisposableVM Template

Note: This template can be further customized by following the instructions below.

Step 1: Delete the existing DisposableVM Template.

In dom0 terminal, run.

qvm-remove <oldDVM_Template>

qvm-remove <oldDVM_Template>

Step 2: Create a new DisposableVM Template based on the whonix-ws TemplateVM.

In dom0 terminal, run.

qvm-create-default-dvm whonix-ws

qvm-create-default-dvm whonix-ws

Step 3: Configure Whonix-Gateway ™ as the NetVM for the DisposableVM Template.

In dom0 terminal, run.

qvm-prefs -s whonix-ws-dvm netvm sys-whonix

qvm-prefs -s whonix-ws-dvm netvm sys-whonix

Step 4: Launch a DisposableVM Template terminal.

In dom0 terminal, run.

qvm-run -a whonix-ws-dvm konsole

qvm-run -a whonix-ws-dvm konsole

Step 5: Enable a customized flag in the DisposableVM Template.

In the DisposableVM Template terminal, run.

touch /home/user/.qubes-dispvm-customized

touch /home/user/.qubes-dispvm-customized

Step 6: Use update-torbrowser to download and install the preferred TorBrowserBundle.

In the DisposableVM Template terminal, run.

noaskstart=true update-torbrowser --input gui >/dev/null 2>&1

noaskstart=true update-torbrowser --input gui >/dev/null 2>&1

Step 7: Shutdown the DisposableVM Template.

In the DisposableVM Template terminal, run.

sudo poweroff

sudo poweroff

Step 8: Regenerate the DisposableVM Template.

In dom0 terminal, run.

qvm-create-default-dvm whonix-ws

qvm-create-default-dvm whonix-ws

Do not forget to check your Tor Browser version!

---

Warning: Do not Use Firefox from Qubes' DisposableVM Default Start Menu

Do not expect anonymity when selecting Qubes Start Menu → DisposableVM → Firefox!

Using any browser other than Tor Browser is strongly discouraged if anonymity is desired, see Tor Browser. The default Qubes start menu option is best not used at all, unless the menu entry is manually edited to launch Tor Browser in place of Firefox.

Qubes 3.1 / KDE4

dom0 → right-click Application Launcher Menu → click `Edit Applications` → Select DisposableVM from the VM entries on the left panel → Press the arrow button to expand the menu → Click New Item on the Toolbar → Type in a Name for the shortcut ->

Type in the specific command to launch the program in the DisposableVM. Tor Browser, konsole and dolphin are provided as examples below.

sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

sh -c 'echo torbrowser | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

sh -c 'echo konsole | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

sh -c 'echo konsole | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

sh -c 'echo dolphin | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

sh -c 'echo dolphin | /usr/lib/qubes/qfile-daemon-dvm qubes.VMShell dom0 DEFAULT red'

→ Click on the square in the upper right in order to choose an icon → Click Save.

---

VLC

Warning: As of May 2018, VLC has reached end of life in Debian jessie ^[archive] and hence Whonix ™ 13. A different media player should be used until Whonix ™ 14 is released, because VLC in jessie has unpatched security vulnerabilities.

VirtualBox

Recommended Version

Whonix ™ recommends installing the package contained in the Debian Stable repository.

Install from Debian Stable

Latest Stable VirtualBox package information ^[archive]

sudo apt-get install virtualbox linux-headers-$(uname -r)

sudo apt-get install virtualbox linux-headers-$(uname -r)

To install VirtualBox Guest Additions:

sudo apt-get install virtualbox-guest-x11

sudo apt-get install virtualbox-guest-x11

whonix-setup-wizard dev

overloading 'whonix-setup-wizard setup' issue

I think the problem is we're overloading the 'whonix-setup-wizard setup' command with logic to start (not)

• show disclaimer,
• connection wizard,
• repository,
• first use notice

Related code:

• https://github.com/Whonix/whonix-setup-wizard/blob/33b63f7d6aca34cf47b2d12e22180205050598ef/usr/share/pyshared/whonix_setup_wizard/whonix_setup_wizard.py#L69-80 ^[archive]
• wizard_steps=

Newer Proposal for Whonix ™ 13

Qubes-Whonix ™:

• The qubes-whonix package will keep care of automatically starting anon-connection-wizard.
• Users can manually start Whonix ™ Repository Wizard from the start menu.
• Users can manually start Anon Connection Wizard from the start menu.
• That's it. No more windows.

Non-Qubes-Whonix:

• At first start...
  • Show Disclaimer page.
  • Show First Run Notice page.
  • Show Whonix ™ Repository Wizard.
  • Show Anon Connection Wizard.
• Users can manually start Whonix ™ Repository Wizard from the start menu.
• Users can manually start Anon Connection Wizard from the start menu.

About this page

This is outdated documentation which no longer applies. Kept in case it will be required again in future.

Legacy instructions: applies up to Whonix ™ 13

1. First we will start with Whonix-Gateway ™:

virsh -c qemu:///system define {{gateway_product_name}}*.xml

2. Followed by the Whonix ™ isolated internal network (XML also in the same folder as Whonix ™ Gateway):

virsh -c qemu:///system net-define Whonix_network*.xml

If the definition of the Whonix ™ internal network fails because the network bridge "virbr1" already exists, edit the Whonix_network*.xml file and change the name to one that doesnt exist, e.g. "virbr2" (you can list all existing bridge adapters with "sudo brctl show").

virsh -c qemu:///system net-autostart Whonix

virsh -c qemu:///system net-start Whonix

3. Lastly the Whonix-Workstation ™:

virsh -c qemu:///system define {{workstation_product_name}}*.xml

• On the host, a libvirt bug that conflicts with the way it works with Apparmor and the VM will refuse to start. It was fixed upstream but it will be a while until it reaches you.

To fix it run:

sudo ln -s /etc/apparmor.d/libvirt/TEMPLATE.qemu /etc/apparmor.d/libvirt/TEMPLATE.kvm

Add FoxyProxy to Tor Browser in Whonix ™.

Warning: Installing FoxyProxy worsens the user's browser fingerprint and adversely affects anonymity since it is not a default Tor Browser add-on. The Tor Project's anonymity warning is explicit:

Can I install other Firefox extensions?

Tor Browser is free software, so there is nothing preventing you from modifying it any way you like. However, we do not recommend installing any additional Firefox add-ons with Tor Browser. Add-ons can break your anonymity in a number of ways, including browser fingerprinting and bypassing proxy settings.

When using a browser and FoxyProxy in combination, a user's web fingerprint becomes more unique. The potential fingerprinting harm to user anonymity depends on how many others are running Tor Browser in conjunction with FoxyProxy.

This configuration is so specialized that probably very few are doing it, reducing the user pool to a small subset. Due to the risk, this approach is generally recommended against. If a user decides to proceed anyhow, the tunnel configuration should not be combined with any browser other than Tor Browser (like Firefox or Chrome), due to an even greater browser fingerprinting risk.

This warning equally applies to configurations such as Tor Browser and I2P, or Tor Browser and remote (http(s)/socks4/5) proxies.

To install FoxyProxy, follow these steps in the Whonix-Workstation ™ (Qubes-Whonix ™: Whonix-Workstation ™ AppVM).

Make the tbb-foxyproxy config file available to Tor Browser.

cp /usr/share/usability-misc/tbb-foxyproxy/foxyproxy.xml /home/user/.tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/

cp /usr/share/usability-misc/tbb-foxyproxy/foxyproxy.xml /home/user/.tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/

Navigate to addons.mozilla.org.

Tor Browser Menu → Tools → Add-ons

Download and install the FoxyProxy add-on.

Search: "foxyproxy" → Install: FoxyProxy Standard

Restart Tor Browser.

When prompted, select Restart now.

After restart, the FoxyProxy icon should appear in the Tor Browser toolbar and be enabled. Check you can interact with it and change proxy settings as required.

After FoxyProxy is installed, you may see an app-armory warning you about the denied creation of dconf/user. The current Debian profile for Firefox does not yet include the modern temporary file location /run/user. However, this can be safely ignored since FoxyProxy never needs access to this dconf/user. However, if you'd like give the Tor Browser permission to use tempory file directory /run/user/ and not receive the warning, edit the file

lxsudo mousepad /etc/apparmor.d/home.tor-browser.firefox

lxsudo mousepad /etc/apparmor.d/home.tor-browser.firefox

And uncomment line

# owner /run/user/[0-9]*/** rwkl,

# owner /run/user/[0-9]*/** rwkl,

by removing the #.

To reverse this procedure and restore the default Tor Browser fingerprint:

• Non-Qubes-Whonix ™: It is best to use a VM snapshot taken before installing the add-on.
• Qubes-Whonix ™: FoxyProxy should be installed to a specific Whonix-Workstation ™ AppVM set up for proxy purposes. The AppVM can be discarded at leisure.

If Non-Qubes-Whonix ™ users did not take a snapshot prior to these changes, Tor Browser can be downloaded again. Alternatively, FoxyProxy can be removed via the about:addons → Extensions menu.

For further technical discussion of FoxyProxy, see the Whonix ™ forum ^[archive].

AnnealMail

Project uncontained and contains vulns: https://github.com/annealmail/annealmail/issues/12#event-1489053019 ^[archive]

AnnealMail is a modified Enigmail ^[archive] implementation built around the Codecrypt PQ-crypto suite. Some interesting features include encrypted subject lines. Until it is packaged for Debian it can be easily built from source.

1. Download the build dependencies and execute the commands then install the resulting addon file from Thunderbird's extension tab.

2. Follow the instructions for setting up AnnealMail with Codecrypt

Usenet

Quicksilver Lite in Whonix ™ / creating a Mixmin nym

mirimir posted a guide to wilderssecurity.com forum, see Installing Quicksilver Lite in Whonix ™ and creating a Mixmin nym ^[archive]. If you need help, try asking in that forum thread.

Please note that Whonix ™ developers cannot answer support requests related to Quicksilver. This possibility has just been pointed out and wasn't tested in practice. It is a whole different thing than Whonix ™ and very technical, difficult with many stumble points. Please look for another way, if you need support. Setting up Nym is not Whonix ™ specific. Success stories, use cases, comments, improved documentation etc. however is welcome.

grsecurity

About grsecurity

Linux kernel is not a secure OS, Linus himself made it pretty clear that he doesn't think highly of the "security community". His threat model and a Tor User threat model don't have much in common. Good that Linux is open source and if we disagree with a policy or politics we can just patch or fork it... Grsecurity/PaX is the most comprehensive kernel patch providing much needed security hardening both for the kernel itself and for making userland protections more effective.

Sadly Debian does not ship a grsecurity kernel. That means either a packager/maintainer of Whonix ™ needs to compile them EVERY TIME there is a security update to the kernel (which is pretty frequently) or the Whonix ™ users themselves need to compile and update their kernels. This is undesirable because kernel compilation is not set and forget, you need a bit of knowledge, it takes a while, especially in a resource restricted VM and you need to keep updated about new releases via mailing lists or similar because your software updater doesn't automatically handle custom kernels (even emerge in hardened gentoo doesn't). All this would most likely only result in users running old, outdated kernel versions.

Furthermore, for Whonix-Gateway ™ and the Identity/Location TCB grsecurity only addresses a subset of security risks: It can mitigate some kernel vulnerabilities (and we only really care about the networking stack which is pretty secure judging from its track record). Maybe some (memory corruption) vulnerabilities in apt-get and Tor that aren't already mitigated by the existing userland hardening done by Ubuntu. It can't protect against backdoors or security issues related to design, policy or yet unknown classes of exploits. We feel that these relatively small advantages outweigh the issues introduced by using a custom compiled kernel. We hope a binary distro will step forward and start using grsecurity. In that case we'll most likely switch Whonix-Gateway ™ to that distro as soon as possible.

For Whonix-Workstation ™ the benefits are even more doubtful. To be effective grsecurity needs to lock down some functions that are needed by Xorg, JIT compilers... but we need those to be working. To solve this we'd have to write a restrictive RBAC policy which is far from trivial. We think accepting that Whonix-Workstation ™ will be exploitable and acting accordingly (using snapshots and rolling back to clean state) is the right approach for a desktop system.

If you disagree with this assessment or have any suggestions how to improve the current situation please let us know.

Experts only: There is also Hardened Gentoo based Whonix-Gateway ™. Outdated, needs maintainer. See Hardened Gentoo TG ^[archive] .

Updates:

• There's Alpine Linux, where Tor is in testing. Package Request: Tor ^[archive].</ref>
• Arch Linux offers a grsecurity kernel.

Footnotes:

Installation

Try these instructions: grsecurity

Or...

Advanced users only!
These instructions are not in a state yet where they are easily usable by anyone.

Install genmkfile ^[archive]. See instructions for apparmor-profile-torbrowser but replace apparmor-profile-torbrowser with genmkfile.

Install grsecurity-installer ^[archive]. See instructions for apparmor-profile-torbrowser but replace apparmor-profile-torbrowser with grsecurity-installer.

To speed up compilation, you might want to assign additional CPU cores and more RAM to your virtual machine.

Run grsecurity-installer to download kernel sources, grsecurity patch, compile and install the grsecurity kernel.

sudo bash -x grsecurity-installer

sudo bash -x grsecurity-installer

During make menuconfig you need to enable grsecurity.

TODO: expand

TorChat

HowTo

Installation

EXPERIMENTAL
Experimental in that it is difficult to install. Only use it in case you trust TorChat. There shouldn't be any anonymity leaks and it should be as safe as other onion services in general and in Whonix ™.

Learn about Onion Services in Whonix ™ first and learn how to set up the hidden webserver. This will ease following this guide.

On Whonix-Gateway ™

Step 1: open /usr/local/etc/torrc.d/50_user.conf

Open /usr/local/etc/torrc.d/50_user.conf.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named sys-whonix) → Tor User Config (Torrc)

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → Settings → /usr/local/etc/torrc.d/50_user.conf

If you are using a terminal-only Whonix-Gateway ™, complete the following steps.

sudo nano /usr/local/etc/torrc.d/50_user.conf

sudo nano /usr/local/etc/torrc.d/50_user.conf

Step 2: edit /usr/local/etc/torrc.d/50_user.conf

(all Whonix ™ platforms)

Once inside /usr/local/etc/torrc.d/50_user.conf, scroll all the way to the bottom, and copy-paste the following text:

Qubes-Whonix ™:

The IP of Qubes-Whonix ™ Whonix-Workstation ™ AppVM needs to be replaced with the actual IP address. To find out the IP address of the Qubes-Whonix ™ Whonix-Workstation ™ AppVM, the following command can be run within the Qubes-Whonix ™ Whonix-Workstation ™ AppVM: qubesdb-read /qubes-ip

HiddenServiceDir /var/lib/tor/torchat/
HiddenServicePort 11009 IP-of-q-ws-AppVM:11009
HiddenServiceVersion 3

HiddenServiceDir /var/lib/tor/torchat/ HiddenServicePort 11009 IP-of-q-ws-AppVM:11009 HiddenServiceVersion 3

Non-Qubes-Whonix ™:

HiddenServiceDir /var/lib/tor/torchat/
HiddenServicePort 11009 10.152.152.11:11009
HiddenServiceVersion 3

HiddenServiceDir /var/lib/tor/torchat/ HiddenServicePort 11009 10.152.152.11:11009 HiddenServiceVersion 3

(all Whonix ™ platforms)

Save.

Step 3: make changes to /usr/local/etc/torrc.d/50_user.conf take effect

Reload Tor.

After editing /usr/local/etc/torrc.d/50_user.conf, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named 'sys-whonix') → Reload Tor

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → Settings → Reload Tor

If you are using a terminal-only Whonix-Gateway ™, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo service tor@default reload

sudo service tor@default reload

Check Tor's daemon status.

sudo service tor@default status

sudo service tor@default status

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

Step 4: get your onion hostname

Find out your .onion hostname.

sudo cat /var/lib/tor/torchat/hostname

sudo cat /var/lib/tor/torchat/hostname

Step 5: backup your Tor onion service private key

Reminder: Always backup the onion service key. This is necessary in order to restore it on another machine, on a newer Whonix-Gateway ™, after HDD/SSD failure, etc. Follow the instructions below to find its location; root permission is required to access it.

/var/lib/tor/torchat/private_key

Qubes-Whonix ™

Use the usual Qubes tools. The following example shows how to copy the /var/lib/tor/torchat/private_key from the sys-whonix VM to the vault VM (which should be started beforehand) using qvm-copy-to-vm.

sudo qvm-copy-to-vm vault /var/lib/tor/torchat/private_key

sudo qvm-copy-to-vm vault /var/lib/tor/torchat/private_key

The above step copies the Tor onion service private key file to the QubesIncoming folder of the vault VM.

/home/user/QubesIncoming/sys-whonix/{{{file_name}}}

/home/user/QubesIncoming/sys-whonix/{{{file_name}}}

Consider moving the file from the QubesIncoming folder to another preferred location.

Qubes VM Manager can be used to conveniently backup the vault and/or other VMs. Please refer to the Qubes backups documentation for necessary steps to accomplish that.

Non-Qubes-Whonix ™

TODO document
Also see: File Transfer.

On Whonix-Workstation ™

No worries, this won't result in Tor over Tor thanks to Whonix ™ anon-ws-disable-stacked-tor package on Whonix-Workstation ™ which prevents this.

Step 1: Install TorChat

Update your package lists.

sudo apt-get update

sudo apt-get update

Install TorChat.

sudo apt-get install torchat python-socksipy

sudo apt-get install torchat python-socksipy

Step 2: Configure TorChat

Open the torchat.ini which is in the hidden folder /home/user/.torchat/torchat.ini. The folder ~/.torchat/Tor can be ignored.

kwrite /home/user/.torchat/torchat.ini

kwrite /home/user/.torchat/torchat.ini

Look for the following line.

own_hostname = <your onion hostname without the .onion ending>

Replace it with your onion hostname. For example if your onion hostname is idnxcnkne4qt76tg.onion replace it enter idnxcnkne4qt76tg, so it looks like this:

own_hostname = idnxcnkne4qt76tg

Save.

Step 3: Qubers users only

Qubes-Whonix ™ users who require an additional firewall exception, please press Expand on the right.
Note: Non-Qubes-Whonix ™ users can skip this step.

Open firewall port access for the application between Whonix-Gateway ™ and Whonix-Workstation ™.

sudo iptables -I INPUT 5 -p tcp --dport 11009 -m conntrack --ctstate NEW -j ACCEPT

sudo iptables -I INPUT 5 -p tcp --dport 11009 -m conntrack --ctstate NEW -j ACCEPT

Unless setting up a web server, change the port number from 11009 to whatever the application requires.

To make the firewall rule persistent, add the rule to the rc.local file and make it executable.

Open /rw/config/rc.local.

lxsudo mousepad /rw/config/rc.local

lxsudo mousepad /rw/config/rc.local

Add the following in the rc.local file.

#!/bin/sh
sudo iptables -I INPUT 5 -p tcp --dport 11009 -m conntrack --ctstate NEW -j ACCEPT

#!/bin/sh sudo iptables -I INPUT 5 -p tcp --dport 11009 -m conntrack --ctstate NEW -j ACCEPT

Make the rc.local file executable.

sudo chmod +x /rw/config/rc.local

sudo chmod +x /rw/config/rc.local

Step 4: Final Notes

Done.

Note, that it may take up to 30 minutes (or so?) until a fresh .onion domain gets reachable.

Starting

It can take a while until a Tor onion service becomes reachable for the first time. Wait at least a few minutes before you believe it doesn't work.

Qubes-Whonix ™:
Qubes App Launcher (blue/grey "Q") -> Whonix-Workstation ™ AppVM (commonly named whonix) -> TorChat Instant Messenger

Non-Qubes-Whonix ™:
Start menu -> Applications -> Internet -> TorChat Instant Messenger

Uninstall

If you want to remove it...

On Whonix-Workstation ™.

sudo apt-get remove torchat

sudo apt-get remove torchat

On Whonix-Gateway ™.

Open /usr/local/etc/torrc.d/50_user.conf.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named sys-whonix) → Tor User Config (Torrc)

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → Settings → /usr/local/etc/torrc.d/50_user.conf

If you are using a terminal-only Whonix-Gateway ™, complete the following steps.

sudo nano /usr/local/etc/torrc.d/50_user.conf

sudo nano /usr/local/etc/torrc.d/50_user.conf

And undo the changes in /usr/local/etc/torrc.d/50_user.conf on Whonix-Gateway ™.

Reload Tor.

After editing /usr/local/etc/torrc.d/50_user.conf, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named 'sys-whonix') → Reload Tor

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → Settings → Reload Tor

If you are using a terminal-only Whonix-Gateway ™, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo service tor@default reload

sudo service tor@default reload

Check Tor's daemon status.

sudo service tor@default status

sudo service tor@default status

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

Debugging

In case it won't work for you.

Test if Tor is reachable on 10.152.152.10:9119.

/usr/bin/wget.anondist-orig 10.152.152.10:9119

/usr/bin/wget.anondist-orig 10.152.152.10:9119

If it says.

--2013-02-13 13:49:47--  http://10.152.152.10:9119/
Connecting to 10.152.152.10:9119... connected.
HTTP request sent, awaiting response... 501 Tor is not an HTTP Proxy
2013-02-13 13:49:47 ERROR 501: Tor is not an HTTP Proxy.

It means, it is fine and the port is reachable.

Run torchat in a Terminal.

torchat

torchat

The following output is an example, how it looks when everything is fine.

~ $ torchat
(0) [config,470,main] python version 2.7.3 (default, Jan  2 2013, 16:53:07) [GCC 4.7.2]
(0) [config,477,main] script directory is /usr/share/torchat
(0) [config,478,main] data directory is /home/user/.torchat
./tor.sh: 6: ./tor.sh: tor: not found
(0) [tc_client,2083,startPortableTor] very strange: portable tor started but hostname could not be read
(0) [tc_client,2084,startPortableTor] will use section [tor] and not [tor_portable]

If you are using Multiple Whonix-Workstation ™, where the Workstation has another IP than 10.152.152.11 you must edit the following line in torchat.ini.

listen_interface = 10.152.152.11

Did the hidden webserver example from the Onion Services page work for you? Try that first.

You also could try using the TorChat source package, which is still documented on the Deprecated page.

Technical Design

The Dev/anon-ws-disable-stacked-tor package prevents Tor over Tor.

Credits

Thanks to scarp for helping with the TorChat instructions!

OnionCat

Introduction

• OnionCat, GarliCat: Tunnel TCP, UDP, ICMP or any other protocol through Tor or I2P; IPv6, VPN-like, TAP/TUN tunneling device

|description=OnionCat, GarliCat: Tunnel TCP, UDP, ICMP or any other protocol through Tor or I2P; IPv6, VPN-like, TAP/TUN tunneling device

image=

Introduction to OnionCat:

• torproject wiki about OnionCat ^[archive] (w ^[archive]) (onion ^[archive])
• cypherpunk.at/onioncat ^[archive] (w ^[archive])
• cryptoanarchy.org about OnionCat ^[archive] (webarchive ^[archive]; webcitation ^[archive])

Status

• OnionCat (Tor) will work with Whonix ™. (Tested.)
• GarliCat (I2P) might partially work with Whonix ™. (Untested.)

Over Tor

OnionCat transports any protocol between endpoints inside the Tor network. All involved peers need to run OnionCat. It gives IPv6 addresses to Onion Services, making many applications possible.

IPv6 is currently disabled on Whonix-Gateway ™, because Tor doesn't support IPv6 yet (except for bridges), and because no one developed more than rudimentary IPv6 firewall rules for Whonix-Gateway ™ yet. Whonix-Gateway ™ firewall blocks all IPv6 traffic including local traffic by default. Anyway, that will not be an issue. IPv6 on Whonix-Workstation ™, where OnionCat will be running, is enabled. Since only OnionCat's underlying operating system requires IPv6, but not the Tor process there will be no problem. OnionCat on Whonix-Workstation ™ will translate the IPv6 requests to IPv4 to the Tor process which is running on Whonix-Gateway ™. Therefore no IPv6 on Whonix-Gateway ™ is required.

On your Whonix-Gateway ™.

If you want to read an introduction about onion services and to learn about about onion service security, see Onion Services.

If you also want to run a hidden web server on the same .onion domain (nice for testing and learning Onion Services basics), see Onion Services.

Open /usr/local/etc/torrc.d/50_user.conf.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named sys-whonix) → Tor User Config (Torrc)

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → Settings → /usr/local/etc/torrc.d/50_user.conf

If you are using a terminal-only Whonix-Gateway ™, complete the following steps.

sudo nano /usr/local/etc/torrc.d/50_user.conf

sudo nano /usr/local/etc/torrc.d/50_user.conf

Add.

HiddenServiceDir /var/lib/tor/onioncat/
HiddenServicePort 8060 10.152.152.11:8060
HiddenServiceVersion 3

HiddenServiceDir /var/lib/tor/onioncat/ HiddenServicePort 8060 10.152.152.11:8060 HiddenServiceVersion 3

Save.

Reload Tor.

After editing /usr/local/etc/torrc.d/50_user.conf, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named 'sys-whonix') → Reload Tor

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → Settings → Reload Tor

If you are using a terminal-only Whonix-Gateway ™, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo service tor@default reload

sudo service tor@default reload

Check Tor's daemon status.

sudo service tor@default status

sudo service tor@default status

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

Reminder: To get your onion service url.

sudo cat /var/lib/tor/onioncat/hostname

sudo cat /var/lib/tor/onioncat/hostname

Reminder: Always backup the onion service key. This is necessary in order to restore it on another machine, on a newer Whonix-Gateway ™, after HDD/SSD failure, etc. Follow the instructions below to find its location; root permission is required to access it.

/var/lib/tor/onionchat/private_key

Qubes-Whonix ™

Use the usual Qubes tools. The following example shows how to copy the /var/lib/tor/onionchat/private_key from the sys-whonix VM to the vault VM (which should be started beforehand) using qvm-copy-to-vm.

sudo qvm-copy-to-vm vault /var/lib/tor/onionchat/private_key

sudo qvm-copy-to-vm vault /var/lib/tor/onionchat/private_key

The above step copies the Tor onion service private key file to the QubesIncoming folder of the vault VM.

/home/user/QubesIncoming/sys-whonix/{{{file_name}}}

/home/user/QubesIncoming/sys-whonix/{{{file_name}}}

Consider moving the file from the QubesIncoming folder to another preferred location.

Qubes VM Manager can be used to conveniently backup the vault and/or other VMs. Please refer to the Qubes backups documentation for necessary steps to accomplish that.

Non-Qubes-Whonix ™

TODO document
Also see: File Transfer.

On your Whonix-Workstation ™.

Update your package lists

sudo apt-get update

sudo apt-get update

Install onioncat.

sudo apt-get install onioncat

sudo apt-get install onioncat

Start onioncat. Replace address.onion with your actual onion service url from above.

sudo ocat address.onion -l 10.152.152.11:8060

sudo ocat address.onion -l 10.152.152.11:8060

As of onioncat r555 (only applies to Jessie onwards) onioncat starts in unidirection 'client' mode by default. To accept incoming connections -U must be used. Mutual authentication is also available in this newer version which is needed to ensure that the identities of all endpoints engaged in a transaction are verified.

sudo ocat address.onion -U -l 10.152.152.11:8060

sudo ocat address.onion -U -l 10.152.152.11:8060

Alternatively, if starting onioncat in 'client' mode run:

sudo ocat -R

sudo ocat -R

At least one node has to run as a 'server' with a Hidden service configured for contact to occur.

To enumerate your onioncat IPv6 address run:

sudo ocat -i address.onion

sudo ocat -i address.onion

Notes

Security

There are two possible ways to authenticate and control who is allowed to connect to you Onioncat instance and the applications running on top of it.

1. The simpler and more robust approach is to setup Tor to perform authentication of clients connecting to your Onion Service. If they do not possess a certain randomly generated cryptographic secret, they cannot connect to your Onion Service.

For information on how to do this see Onion Services#Onion Service Authentication.

2. The second approach does this process at the higher level through delegating authentication to Onioncat.

For official documentation on security read the reference at the end of this sentence.

Onioncat Authentication Notes and Definitions:

• Bi-directional mode is what was used for OC since the beginning. That means that one established circuit (TCP session through Tor) is being used to send AND transmit packets. Thus, it is called bi-directional.

• Uni-directional mode means that there are two separate circuits: one for sending and one for receiving.

So what's the implications:
Circuits are established through Tor and are identified and authenticated by the network through the onion hostname (= OC IPv6 address). But this authentication is just one-ended. That means that the client (the one initiating the circuit) can authenticate the server but the server can't authenticate the client. As a consequence the client could spoof its IP address. In Tor/OnionCat context, IP spoofing means to use any IPv6 address but not the one which is associated to the onion ID (that's actually what -R does). Although this is technically no problem there's a security risk which could be that someone takes over the IPv6 address from someone else and could thereby attract (steal) packets. The risk is still very low.

Uni-directional mode addresses exactly that problem. It forces the server to not reuse an incoming connection but establish a new circuit to the supposed client. Thus spoofing is defeated because it requires for the client to own the private key as well.

Uni-directional mode is on by default since revision 556, but this change may be subject to change in future releases.

Uni-directional mode and -R (i.e. starting onioncat in 'client' mode) are incompatible! That means an OnionCat using -R will not be able to communicate with an OnionCat in uni-directional mode.

OnionCats with -R can only talk to bi-directional OnionCats having -U set as noted above.

Source / Credits of this chapter:
These are Onioncat dev, Bernhard Fischer's words with modifications by the Whonix ™ team. All credit goes to him.

Tunneling IPv4

Many programs do not support IPv6 and so to use IPv4 with Onioncat, IPv4 will need to be tunneled over IPv6. This option is preferred to Onioncat's native IPv4 forwarding designated by the -4 parameter, which is deprecated and could not have guaranteed the authenticity of the communicating endpoints as the tunneling method can.

Most operating systems should support IP-IP6 tunneling. IPv6 supports encapsulation of IPv4 or IPv6, hence, tunneling is not a big deal. An IP-IP6 tunnel is a point-to-point tunnel between two IPv6 nodes. The tunnel endpoints are virtual network interfaces. IP addresses are assigned to them and routing has to be set up as usual (as if those interfaces where ethernets). Before configuring a tunnel you need to know the two IPv6 addresses of the IPv6 nodes. Those will be the IPv6 OnionCat addresses. There are a few steps necessary on Linux. First insert the IPv6 tunneling kernel module, then setup the tunnel interface by connecting it to the two IPv6 addresses. Next configure the IPv4 addresses to the tunnel endpoints, bring them up and add the necessary routes (... and don't forget to update your firewall rules - but this is not needed with Whonix ™ Workstation's default settings).

sudo su
modprobe ip6_tunnel
ip -6 tunnel add iptun0 mode ipip6 local fd87:d87e:eb43:1f53:c75:3b27:7adc:c9a5 remote fd87:d87e:eb43:8733:3338:21f6:a2b8:eebf
ifconfig iptun0 192.168.100.1 up
route add -net 192.168.100.0/24 dev iptun0

sudo su modprobe ip6_tunnel ip -6 tunnel add iptun0 mode ipip6 local fd87:d87e:eb43:1f53:c75:3b27:7adc:c9a5 remote fd87:d87e:eb43:8733:3338:21f6:a2b8:eebf ifconfig iptun0 192.168.100.1 up route add -net 192.168.100.0/24 dev iptun0

On the other end do the same thing except that you have to swap the two IPv6 addresses and use another IP address on the tunnel endpoint, e.g. 192.168.100.2. If Tor, OnionCat, and the tunnel is up on both ends you should be able to ping the remote end.

Useful Commands

• Check connectivity between endpoints using ping:

ping6 onioncat-address

ping6 onioncat-address

• Replies should come immediately if everything is working.

• To derive the OnionCat IPv6 address from your Onion Service address run:

ocat -i onion.address

ocat -i onion.address

• Running ifconfig can show helpful information on active network interfaces:

sudo ifconfig

sudo ifconfig

Debugging

On your Whonix-Workstation ™.

To terminate onionat you could use.

sudo kill -sigint $(pgrep ocat)

sudo kill -sigint $(pgrep ocat)

Miscellaneous

To make Onioncat to autostart with the system using the parameters listed above. editing its configuration file:

sudoedit /etc/default/onioncat

sudoedit /etc/default/onioncat

Enable the autostart comment by removing '#':

ENABLED=yes

Add your settings:

DAEMON_OPTS="Paramters go here"

Over I2P

GarliCat over I2P might only work, if you use ip2 over Tor.

There was the idea to create an I2PBOX, but it never came to live due to lack of community interest, which means GarliCat directly over I2P will not be supported by Whonix ™.

As soon as I2P over Tor is working in Whonix-Workstation ™, you can probably follow the instructions on cryptoanarchy.org ^[archive] (webarchive ^[archive]; webcitation ^[archive]) without modifications.

General Debugging Hints

• There at multiple sources for issues, you might stumble upon.
• Therefore it is recommended, before you try using OnionCat with Whonix ™, if that doesn't endanger you, try first to successfully test OnionCat without Whonix ™.
• As soon as you learnt that, it eliminated one source for possible issues (OnionCat) and can start learning how to use it with Whonix ™ (which might introduce new issues, but enhanced security will be your reward).
• You also have to learn first, how to use onion services with Whonix ™, see hosting onion services for reference.

Footnotes

---

Whonix ™ is Supported by Evolution Host DDoS Protected VPS. Stay private and get your VPS with Bitcoin or Monero.

---

Jobs in USA

---

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

---

Follow:

Donate:

Share: Twitter | Facebook

Did you know that Whonix could provide protection against backdoors ^[archive]? See Verifiable Builds ^[archive]. Help is wanted and welcomed.

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee ^[archive] of the Open Invention Network ^[archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian ^[archive]. Debian is a registered trademark ^[archive] owned by Software in the Public Interest, Inc ^[archive].

Whonix ™ is produced independently from the Tor® ^[archive] anonymity software and carries no guarantee from The Tor Project ^[archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.

Tor Access

These instructions break sending emails to other domains that are not riseup.

Some email services provide access via Onion Service addresses. This provides better end to end security properties for authenticating to the server and conceals when you check your inbox.

In Thunderbird go to:

Settings -> Preferences -> Account Settings

Server Settings Tab, set the IMAP address to: imap.<address>.onion

Outgoing Server (SMTP) Tab, Edit: smtp.<address>.onion

The service providers may or may not enable TLS/STARTTLS connection security for their Onion domain since it is redundant. Its best to leave turned on by default and only disable it if problems arise.

Leave your Default Identity with the clearnet domain to avoid confusing recipients when replying to you.

Pidgin

For instant messaging in Whonix ™ you can install the Pidgin Instant Messenger. It is a multi-protocol client, so you could run MSN, ICQ, IRC, AIM, XMPP/Jabber and many other protocols at the same time, even with several instances of the same protocol.

All of these chat systems are unsafe if not used together with OTR. Even when used with OTR, expect to be exposing your social graph. Privacy hackers isolate parts of the social graph by running several accounts for groups of people on each popular server, thus avoiding the insecure XMPP federation (adding people on servers that is not your own).

For more detailed documentation refer to the official Pidgin user guide ^[archive].

You can install it using Start menu -> Applications -> System -> Terminal.

sudo apt-get update

sudo apt-get update

sudo apt-get install pidgin

sudo apt-get install pidgin

There is also a Torchat plugin available for pidgin official libpurple-torchat pidgin plugin ^[archive], which could be implemented to allow p2p encrypted end-to-end communications although there is no known documentation on getting this done specifically in Whonix ™. It works seamless on standard pidgin/linux distro's with tor, the code is over a year without any changes/updates, hopefully because it simply works without any need for changes.

Some protocols that are problematic in context of privacy/anonymity are disabled by default.

To get a list of those, you could run.

sudo dpkg-divert --list

sudo dpkg-divert --list

To re-enable all of them, you could run.

sudo /var/lib/dpkg/info/pidgin-improved-privacy.prerm remove

sudo /var/lib/dpkg/info/pidgin-improved-privacy.prerm remove

After a restart of Pidgin, the protocols will be available.

OTR encryption

Of course the issue of end-to-end encryption arises again. As we mentioned earlier, we have Off-the-record messaging (commonly called OTR) for instant messaging, and Pidgin and many other instant messengers have support for that. There are several resources on how it works and how to use it on their web site. Basically all you need to do is choose "Start private conversation" in the OTR menu and a key will be generated automatically if you do not have one already. After that OTR will establish a private conversation if the other end's instant messenger supports it.

If you didn't authenticate your partner with something like a shared secret there can be a man in the middle recording your chat, even if you are using the same server (the server or the TLS connection to the server may be corrupted).

OTR and other Pidgin plugins are enabled in the "Tools menu -> Plug-ins" section. Simply check the appropriate box for enabling any plugin you want, and possibly you might also want to configure it by pressing the "Configure Plug-in" button. When this is done for the OTR plugin a window that can be used to manage your keys will open. The use of OTR is recommended as many instant messaging protocols normally sends your messages in plaintext. Force your friends to migrate to clients with support for OTR!

NOTE: /me is not encrypted when used in a OTR private conversation! Also /msg in XMPP chatrooms is not – it goes through the chatroom server!

Read also those various other resources about OTR ^[archive].

You can install it using Start menu -> Applications -> System -> Terminal.

sudo apt-get update

sudo apt-get update

sudo apt-get install pidgin-otr

sudo apt-get install pidgin-otr

Jitsi

Jacob Appelbaum (Tor researcher) recommends Jitsi (this applies if _not_ using Tor). It supports OTR encryption and ZRTP and is available in Debian Testing.

Jitsi supports push to talk.

Jitsi is the most feature-rich Free Software VoIP client. The team behind it is very innovative, constantly focusing on adding new functionality. It supports many protocols and advanced features like Multi-party video conferencing - in which someone's client will be running into server mode for that purpose because of latency management.

Its stability leaves more to be desired however. Alpha stage clients are available for Android.

Unfortunately it is not usable with Tor, because the Tor network does not support UDP and because Jitsi does not support TCP for audio/video at time of writing (April 2014).

TODO: write a guide on how to connect to a free public server, having a secure ZRTP encrypted conversation with someone using the same client (note: impossible as of April 2014 without revealing the ip numbers of the corresponding parties to both eavesdroppers and the server).

sflphone

Nathan Freitas (Tor Orbot developer) likes sflphone. Can be installed from Debian package sources.

It does not support OTR. You would have to keep that in mind and use another way to exchange encrypted text. This is not a reason, not to use it, if you are aware of that.

TODO: research, does sflphone support push to talk?

TODO: write a guide how to connect to a free public server, having a secure ZRTP encrypted conversation with someone using the same client.

OnionPhone

OnionPhone is the successor to TOR Fone, improving the ciphers used among other problems. Repo here

The main improvement is that OnionPhone can now be used as a VoIP plugin that integrates it with with TorChat ^[archive], using the Tor network to protect and anonymize your communication in this mode. It is also the only mode that makes sense in terns of usability because otherwise its a command line utility.

OnionPhone works on Linux and Windows, with Android support planned.

Other modes of operation include using the Tor network as a decentralized and secure alternative for SIP signalling. The call streams are then initiated directly using either TCP or UDP (for NAT traversal). Note that metadata is not concealed in that mode.

It can be run standalone with direct connections with OnionCat.

TODO: Encourage Debian Packaging TODO: Build, test and document usage instructions with TorChat

linphone

Introduction

Linphone is one of the most feature-rich Free Software clients available, second only to Jitsi in that respect, but second to none is stability and performance from testing. It can also support conferencing (audio only as of 2014). Additionally it has fully developed clients for all desktop and mobile operating systems.

Should an Android port of Onioncat ever become a reality by the Guardian Project, Linphone can be used for anonymous VoIP between all combinations of device form factors. There is headway on that front.

Setup with Whonix ™

Technically, only one member of the chat party needs to configure a Tor Onion Service (be a callee). Others can run Onioncat in 'client' only mode (be ca caller).

Bidirectional communication can only be established after the client party (caller) connects to the one running an onion service 'server' mode (callee), because the latter can accept incoming connections while the former cannot.

	callee	caller
Can make outgoing calls	Yes	Yes
Can initially receive incoming calls	Yes	No
Needs to host a Tor onion service	Yes	No
Difficulty setup	medium	easy

Setup as Both, Callee or Caller

You only have to read this, if you want to use linphone as both, callee or caller. As a caller, you can only make outgoing calls. As a callee (that includes ability of being a caller), you can make outgoing calls and receive incoming calls. Only one of both calling parters has to follow these instructions. However, it doesn't matter if both calling partners follow these following instructions. If you are interested, click on Expand on the right.

On your Whonix-Gateway ™.

If you want to read and introduction about onion services and to learn about about onion service security, see Onion Services.

If you also want to run a hidden web server on the same .onion domain (nice for testing and learning Onion Services basics), see Onion Services.

Open your /usr/local/etc/torrc.d/50_user.conf.

sudoedit /usr/local/etc/torrc.d/50_user.conf

sudoedit /usr/local/etc/torrc.d/50_user.conf

Add.

HiddenServiceDir /var/lib/tor/linphone_service/
HiddenServicePort 64739 10.152.152.11 :64739
HiddenServiceVersion 3

Reload Tor.

sudo service tor reload

sudo service tor reload

Reminder: To get your onion service url.

sudo cat /var/lib/tor/linphone_service/hostname

sudo cat /var/lib/tor/linphone_service/hostname

Reminder: Backup your onion service key, in case you want to be able to restore it, on another machine, on a newer Whonix-Gateway ™, after hdd failure, etc. You can find it here and need sudo to access it.

/var/lib/tor/linphone_service/private_key

On your Whonix-Workstation ™.

Update your package lists

sudo apt-get update

sudo apt-get update

Install onioncat and linphone.

sudo apt-get install onioncat linphone

sudo apt-get install onioncat linphone

Start onioncat. Replace address.onion with your actual onion service url from above.

sudo ocat address.onion -U -l 10.152.152.11 :64739

sudo ocat address.onion -U -l 10.152.152.11 :64739

As of onioncat r555 (only applies to Jessie onwards) onioncat starts in unidirection 'client' mode by default. To accept incoming connections -U must be used. Mutual authentication is also available in this newer version which is needed to ensure that the identities of all endpoints engaged in a transaction are verified.

Find out your onioncat IPv6 address.

ip addr show dev tun0

ip addr show dev tun0

Open Linphone settings and select IPv6. Apply and restart Linphone.

Setup only as Caller

You only have to read this, if you want to use linphone caller only. As a caller, you can only make outgoing calls. Only one of both calling parters can follow these instructions. If both calling partners would follow these instructions, would not be able to call each other. If you are interested, click on Expand on the right.

On your Whonix-Workstation ™.

Update your package lists

sudo apt-get update

sudo apt-get update

Install onioncat and linphone.

sudo apt-get install onioncat linphone

sudo apt-get install onioncat linphone

Start onioncat.

sudo ocat -R

sudo ocat -R

Open Linphone settings and select IPv6. Apply and restart Linphone.

Calling

On your Whonix-Workstation ™.

At this point you should have exchanged IPv6 addresses of the callee. To call someone put in the call box. You can keep user. Must use brackets. Replace onioncat IPv6 address with the actual IPv6 of your calling partner.

user@[onioncat ipv6 address]

Debugging

On your Whonix-Workstation ™.

To terminate onioncat you could use.

sudo kill -sigint $(pgrep ocat)

sudo kill -sigint $(pgrep ocat)

Miscellaneous

To make Onioncat to autostart with the system using the parameters listed above. editing its configuration file:

sudoedit /etc/default/onioncat

sudoedit /etc/default/onioncat

Enable the autostart comment by removing '#':

ENABLED=yes

Add your settings:

DAEMON_OPTS="Paramters go here"

Credits

Credits go to HulaHoop ^[archive] for researching how to use Linphone with Tor for sharing instructions in Whonix ™ User Forum ^[archive].

Development Ideas

OnionCat

OnionCat could be useful if tunneling UDP and/or ICMP tunneling over Tor should be required. It should be avoided if possible, because it add complexity to the setup. Does it introduce more latency because connection always goes from onion service to onion service?

OpenBazaar

OpenBazaar supports both TCP and UDP. The latter was added to aid those using it on the clearnet that had difficulties connecting from behind their routers. When using Tor you don't have to worry about that.

A community demo ^[archive] for OpenBazaar was done with Tor by hosting seed nodes as Onion Services.

Hosting ANY Onion Services

You can provide any server service, which relies on TCP, such as web servers, IRC servers, chat servers and so forth. UDP and IPv6 are not supported by the Tor network, but if required you could use OnionCat as a workaround.

OnionCat

See OnionCat.

Syncthing with OnionCat

Syncthing is a libre software solution for private file synchronization.

This section will cover file syncing with peers inside the Tor network.

TO-DO: Test Syncthing without OnionCat since SOCKS support was added recently.

1. Set up OnionCat on Whonix ™ Gateway. All parties involved will need to configure a Onion Service with OnionCat because syncing is bidirectional. Make sure you can successfully ping all OnionCat addresses before proceeding.

Security warning: Adding a third party repository allows the vendor to replace any package on your system. Proceed at your own risk! See Foreign Sources for further information. For greater safety, users adding third party repositories should always use Multiple Whonix-Workstation ™ to compartmentalize VMs with additional software.

2. Before adding the repo, fetch the key and verify fingerprints. Always check the fingerprint for yourself. The output at the moment is:

pub  2048R/0xD26E6ED000654A3E 2014-12-29 Syncthing Release Management <release@syncthing.net>
      Key fingerprint = 37C8 4554 E7E0 A261 E4F7  6E1E D26E 6ED0 0065 4A3E

Download key with scurl to home folder.

scurl -o syncthing-pubkey.asc https://syncthing.net/release-key.txt

scurl -o syncthing-pubkey.asc https://syncthing.net/release-key.txt

Check fingerprints/owners without importing anything.

gpg --keyid-format long --with-fingerprint syncthing-pubkey.asc

gpg --keyid-format long --with-fingerprint syncthing-pubkey.asc

If it looks good import into trusted.gpg.d.

gpg --no-default-keyring --keyring ./syncthing-pubkey.gpg --import syncthing-pubkey.asc
sudo cp syncthing-pubkey.gpg /etc/apt/trusted.gpg.d/syncthing-pubkey.gpg

gpg --no-default-keyring --keyring ./syncthing-pubkey.gpg --import syncthing-pubkey.asc sudo cp syncthing-pubkey.gpg /etc/apt/trusted.gpg.d/syncthing-pubkey.gpg

sudo sh -c 'echo deb http://apt.syncthing.net/ syncthing release > /etc/apt/sources.list.d/syncthing-release.list'

sudo sh -c 'echo deb http://apt.syncthing.net/ syncthing release > /etc/apt/sources.list.d/syncthing-release.list'

sudo apt-get update -qq

sudo apt-get update -qq

sudo apt-get install syncthing

sudo apt-get install syncthing

3. Launch Syncthing:

syncthing

syncthing

Do not close the running terminal or Syncthing will shutdown. Answer 'No' if asked to 'Allow Anonymous Usage Reporting'.

To open the WebGUI, open Tor Browser and paste:

http://127.0.0.1:8384/

http://127.0.0.1:8384/

4. At this point Syncthing back-end should have generated your unique Device ID. Go to:

Actions > Show ID

Share the Device ID along with your OnionCat address. As long as one side shares this information the other can add and find them.

5. Once ID information is exchanged, go to

Add Device

and paste the other endpoint's Device ID. Then under Addresses change dynamic to

[OnionCat-address]:22000

Note that you MUST write the OnionCat IPv6 address within brackets for it to work.

Select the default directory under Share Folders With Device.

6. Syncing more than two endpoints can quickly become tedious so select at least one node to be an Introducer by selecting the option. The Introducer node will inform the new device about all nodes attached to it.

7. Finally drag and drop any files you want to sync to the 'Sync' folder under your Home directory.

Done.

Note: No one can connect to your swarm without you adding them but you may still want to make your virtual network more private. This is done using HiddenServiceAuthorizeClient - a Tor feature.

Torrenting over OnionCat

This section will cover torrenting with anonymous peers inside the Tor network. This is a trackerless setup.

Seeding

1. Set up OnionCat on Whonix ™ Gateway. All parties involved will need to configure a Onion Service with OnionCat because torrenting is bidirectional.

2. Next install qBittorrent:

sudo apt-get install qbittorrent

sudo apt-get install qbittorrent

3. Create your torrent:

Tools > Torrent creator

Add the file/folder you want to share. Leave the Tracker information boxes empty. Insert your OnionCat IPv6 IP into the Comment section.

Check Start seeding after creation then create and save the torrent file.

4. Share the torrent file on your personal Onion Site blog or some other channel as you normally would.

Downloading

1. Add the torrent file in qBittorrent

2. Select the the torrent from the list and go to the General tab. Copy the OnionCat IPv6 address from the Comment section.

3. Click the Peers tab and right-click into the empty tab. Click Add a new peer... and paste the IPv6 address. Note that the default listening port for incoming connections is set to 6881 and nothing needs to be done.

Done.

For a private sharing environment you will need to configure Tor to use the HiddenServiceAuthorizeClient option. More on that here ^[archive].

Tunnel Freenet over OnionCat

Some Freenet users have successfully experimented with connecting over OnionCat. Note that all communicating parties need to set this up for this to work. Follow this guide ^[archive] to connect to other Darknet peers. No connections to the public datastore possible with this method.

Whonix ™ specific caveats to the above instructions.

Adjust OnionCat to connect to the Gateway with socat.

TO-DO: Create and add socat template to all relevant onion service guides

Pond

Removed because upstream dead.

Pond is a forward secure, asynchronous messaging system that uses Tor to conceal metadata. Pond messages not a record; they expire automatically a week after they are received.

Add Debian Experimental to repos sources lists.

sudo su -c "echo -e 'deb http://httpredir.debian.org/debian experimental main' > /etc/apt/sources.list.d/debian-experimental.list"

sudo su -c "echo -e 'deb http://httpredir.debian.org/debian experimental main' > /etc/apt/sources.list.d/debian-experimental.list"

Install Pond and its dependencies.

sudo apt-get update
sudo apt-get install golang libgtk-3-dev libgtkspell3-3-dev libtspi-dev
sudo apt-get -t experimental install pond

sudo apt-get update sudo apt-get install golang libgtk-3-dev libgtkspell3-3-dev libtspi-dev sudo apt-get -t experimental install pond

Run Pond.

cd
mkdir gopkg
export GOPATH=$HOME/gopkg
$GOPATH/usr/bin/pond-client

cd mkdir gopkg export GOPATH=$HOME/gopkg $GOPATH/usr/bin/pond-client

The server's file path: /usr/bin/pond-server

Optionally set a passphrase and keep the default server selected.

For usage instructions read help --all to understand the options.

HugePages

Huge memory pages improve performance for some virtualized workloads such as running databases. They are not enabled by default in Linux because the amount of memory to be allocated this way depends on the different needs from one user/admin to another.

On the host you need to activate the nr_hugepages setting in the proc filesystem:

echo 1054 > /proc/sys/vm/nr_hugepages

NOTE: To make the above value persistent, you'd need to set:

echo "vm.nr_hugepages=1054" > /etc/sysctl.d/50_hugepages

Then, `grep` for the HugePages_Total:

grep -i HugePages_Total /proc/meminfo 

Should show.

HugePages_Total:    1054

The total system RAM allocated as hugepages can be calculated as:

2Mb * 1054 = 2108 ≈ 2GiB

Then, boot a libvirt virtual machine with 2 GB memory with appropriate XML setting as noted in the example below:

  <memory unit='KiB'>2000896</memory>
  <currentMemory unit='KiB'>2000000</currentMemory>
  <memoryBacking>
    <hugepages>
      <page size='2048' unit='KiB' nodeset='0'/>
    </hugepages>
  </memoryBacking>
  <vcpu placement='static'>8</vcpu>

Clipboard Sharing

SPICE allows accelerated graphics and clipboard sharing. The clipboard is disabled by default for security reasons but could be enabled.

When editing using xml, search for.

<clipboard copypaste='no'/>

And change to.

<clipboard copypaste='yes'/>

KSM

The security assumptions about virtual environments is that each vm is a completely isolated instance that knows nothing about what's happening outside it. It posses a privacy problem for an isolated multi-workstation setup.

In a single workstation-to-gateway scenario, KSM is not problematic because technically, nothing going on, on the gateway, even if known would endanger privacy. However should someone run multiple workstation vms, each with the intent that they are all separated - each with its own internal network for isolation for example, then with KSM all similar activities or processes running in the other vms, would register to an attacker who has compromised one of them. For example, information that the same website has been visited in another vm too. This would allow cross-vm activity correlation.

Its not really a weakness unique to KSM, but a common problem shared by using the equivalent feature on other hypervisors too (Xen's TPS - Transparent Page Sharing).

Quote Memory Deduplication as a Threat to the Guest OS ^[archive]:

4.3 Detection of Downloaded Files

The memory disclosure attack can also be applied to find an opened file on a victim’s VM. We have tried to detect a logo file when Firefox shows a home page.

We confirmed that the Google logo file was detected if page caching is enabled on Firefox. When the page cache was set to 0, detection failed. If an attacker leads a victim to a malicious home page which includes an identifiable logo file, the attacker can detect the page view from the victim’s VM.

This disclosure attack is dangerous because it detects a page view even if the network is encrypted by TLS/SSL. Especially in a multi-tenant data center, this attack is serious, because it does not violate any SLA statements on cloud computing.

Wiping the storage used by a guest domain

A volume used by a domain can contain confidential data, hence it is necessary to wipe it before removal. Libvirt offers a helping hand for such cases:

virsh vol-wipe <volume>

which truncates and extends the volume to its original size. This in fact fills the file with zeroes. This ensures that data previously stored on volume is not accessible to reads anymore. After this, you can remove volume :

virsh vol-delete <volume>

Source

Template:Install Backport

Upgrade your system as usual.

Create a file /etc/apt/sources.list.d/user.list. Open file /etc/apt/sources.list.d/user.list in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security ^[archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/apt/sources.list.d/user.list

sudoedit /etc/apt/sources.list.d/user.list

Add the following content.

deb http://ftp.us.debian.org/debian jessie-backports main contrib non-free

deb http://ftp.us.debian.org/debian jessie-backports main contrib non-free

Save.

Update your package lists.

sudo apt-get update

sudo apt-get update

Install a package from jessie-backports. Example.

sudo apt-get install -t jessie-backports {{{package}}}

sudo apt-get install -t jessie-backports {{{package}}}

Note:

• Don't forget the -t jessie-backports, which does the trick here.

Mounting Shared Folders in KVM Guests

Run the following command in terminal (Start Menu -> Applications -> System -> Terminal).

sudo mount -t 9p -o trans=virtio shared /mnt/shared -oversion=9p2000.L

To automatically mount this every time at boot, modify /etc/fstab.

Open /etc/fstab in an editor as a regular, non-root user.

If you are using a graphical environment, run.

mousepad /etc/fstab

mousepad /etc/fstab

If you are using a terminal, run.

nano /etc/fstab

nano /etc/fstab

Add.

shared /mnt/shared    9p  trans=virtio,version=9p2000.L,rw    0   0

Save.

SELinux

SELinux is more robust than Apparmor because its label based vs file-path based. But his comes at the expense of being difficult to write policies. The good news is if you are a KVM user and want to harden your GNU/Linux host, its as simple as enabling SELinux and libvirt will automatically take advantage of it without any further effort needed on your part.

These instructions apply to Whonix ™ and could be easily replicated for your Debian host. First disable Apparmor if you are using it. Both MAC systems cannot be run simultaneously run. This is not supported by LSM and may also be a source of conflicts.

AppArmor is disabled, and the kernel module unloaded by entering the following:

sudo /etc/init.d/apparmor stop
sudo update-rc.d -f apparmor remove

To enable SELinux follow these steps. The cited guide also includes steps for writing custom policy for hardening.

    # aptitude install selinux-basics selinux-policy-default
    # selinux-activate
    # reboot

    # sudoedit /etc/default/grub

    Replace all mention of apparmor in settings for GRUB_CMDLINE_LINUX with selinux=1 and the enforcing=1 parameter to the Linux kernel. The audit=1 parameter enables SELinux logging which records all the denied operations.

    Remove the line under it that starts with: GRUB_CMDLINE_LINUX_DEFAULT

    # update-grub

Updating Tor

Tor was installed on Whonix ™ according to official instructions for Ubuntu ^[archive]. You can update Tor (and the rest of the system) using apt-get update and apt-get dist-upgrade.

If you run in the following error message when running apt-get update on the Gateway...

W: GPG error: http://deb.torproject.org precise Inrelease: The following signature were invalid: Keyexpired 1346668560

...or into the following error message on the Gateway when running apt-get dist-upgrade:

Warning: The following packages cannot be authenticated!
deb.torproject.org-keyring tor
Install these packages without varification?

...please use the workaround below. Please do not install without verification for your own safety!

Temporary fix. Run these two commands. (Check if they are still current and genuine in official instructions for Ubuntu.)

gpg --keyserver keys.gnupg.net --recv 886DDD89

gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -

(If they fail for the first time, perhaps because you are on a slow network or slow Tor circuit, run them a few times until the succeed.)

,, Technical problem: The latest Whonix ™ release is a few days ago and in meanwhile there is a new deb.torproject.org-keyring got renewed while the old torproject deb keys expired. Fixing the problem requires a new Whonix ™ release. It will be fixed in 0.3.0.

Nymserver QuickSilver Mail How-To

This guide is for QuickSilver Lite, a Freedom Software GUI for Mixmaster. QuickSilver Lite was written for Windows but is fully compatible with Wine. The paranoici Zax-type Nymserver is used for this example. Credit goes to Whonix ™ user mirimir whose instructions this work is based on.

## Generate your GPG keypair using KGpg. Fill in the nym you chose for the Email field. Use something likely not taken:
KGpg -> Keys -> Generate Key Pair... ->

Name: John Doe (or any alias of choice)
Email: yournym@nymphet.paranoici.org
Keysize: 4096 bits
    
OK -> Enter passphrase for key -> OK.


## Import Nymserver key from KGpg.
KGpg -> Open Keyserver Dialog -> Search for 'send@nymphet.paranoici.org' -> Import


## Always check the fingerprint for yourself. The output at the moment is:

pub  4096R/0x5CE8D7B97340F3A7 2013-01-06 Nymserver <send@nymphet.paranoici.org>
      Key fingerprint = B91A FAEE 998D 5134 5AFE  E104 5CE8 D7B9 7340 F3A7


## In KGpg, highlight your key, and set Trust level on Nymserver key to 'Marginal' and sign it with your own key.

Right-click on Nymserver key -> Key Properties

Owner Trust: Marginally

-> Apply -> OK


Right-click on Nymserver key -> Continue -> Select your nym's secret key to use for signing -> OK -> Enter passphrase



## Download QuickSilver's signing keys with scurl to home folder.
scurl -ko quicksilver.asc https://www.quicksilvermail.net/quicksilver.asc

## Check fingerprints/owners without importing anything. 
gpg --keyid-format long --with-fingerprint quicksilver.asc

## Always check the fingerprint for yourself. The output at the moment is:

pub  4096R/0x1B04C05145FF11B1 2013-09-08 QuickSilver <admin@quicksilvermail.net>
      Key fingerprint = 6BC3 5E3D 7473 E416 F423  E845 1B04 C051 45FF 11B1

## Import key:
gpg --import quicksilver.asc

## To avoid ''unsafe ownership'' key warnings
gpg --fingerprint
chmod --recursive 700 ~/.gnupg



## Download archives.
wget -r --no-check-certificate --no-parent -A 'QSLite*.zip' https://www.quicksilvermail.net/qslite/
wget -r --no-check-certificate --no-parent -A 'QSLite*.zip.sig' https://www.quicksilvermail.net/qslite/
wget -r --no-check-certificate --no-parent -A 'QSAam*.zip' https://www.quicksilvermail.net/qsaam/
wget -r --no-check-certificate --no-parent -A 'QSAam*.zip.sig' https://www.quicksilvermail.net/qsaam/


## Move files into Home folder.
mv /home/user/www.quicksilvermail.net/qslite/QSLite*.zip /home/user
mv /home/user/www.quicksilvermail.net/qslite/QSLite*.zip.sig /home/user
mv /home/user/www.quicksilvermail.net/qsaam/QSAam*.zip /home/user
mv /home/user/www.quicksilvermail.net/qsaam/QSAam*.zip.sig /home/user


## Verify archive. Fingerprint should match the key above.
gpg --verify-options show-notations --verify QSLite*.zip.sig QSLite*.zip
gpg --verify-options show-notations --verify QSAam*.zip.sig QSAam*.zip


## Install Wine.
sudo apt-get install wine

## Run Wine to create its directories. Cancel Wine Mono Installer.
wine run

## Create folder for QS components and transfer them.
mkdir /home/user/.wine/drive_c/QS/
unzip QSLite*.zip -d /home/user/.wine/drive_c/QS/
unzip QSAam*.zip -d /home/user/.wine/drive_c/QS/

## Select 'Replace All' when prompted for duplicate files.
A

## Open Terminal and create links to allow QSL and QSA to use Debian gpg:
mkdir .wine/drive_c/QS/gpg-links
link '/home/user/.gnupg/pubring.gpg' '/home/user/.wine/drive_c/QS/gpg-links/pubring.gpg'
link '/home/user/.gnupg/secring.gpg' '/home/user/.wine/drive_c/QS/gpg-links/secring.gpg'

## Run QSL. This way is needed only for the initial run it applies to QSA too. Access QSL from the desktop shortcut afterwards.
cd /home/user/.wine/drive_c/QS
wine qsl.exe

## Setup QSL.
Setup -> Draw randomly in window until "OK" appears ... click "OK" -> Check: Create desktop shortcut | Email Address: yournym@nymphet.paranoici.org -> SMTP Server: gbhpq7eihle4btsn.onion -> Leave SMTP Proxy setings unchanged -> Leave HTTP Proxy setings unchanged -> Finish

(Note: Mixnym's SMTP Onion Service used. Tor Transport used - stream isolation unnecessary)


## Configure QSL.
Open Tools | Options.
...In General tab:
......Under "User Mode", check "Expert".
......Under "On Start-up", check "Open Template Dialog".
...In PGP tab:
......Check "PGP Public Key Encryption".
......For "Private Keyring", use "C:\QS\gpg-links\secring.gpg".
......For "Public Keyring", use "C:\QS\gpg-links\pubring.gpg".
......Click "Default key" and select it (will be just your new one).
......If desired, choose to cache private-key passphrases for five minutes or so.
...In Mix tab:
......Select "once a day" for "Update remailer stats".
...Click "Ok" to finish.
Open Tools | Stats manager.
...Click "Update".
...When you see "done!" click "Ok".
...If it stalls, there's something wrong with your Tor setup.
......Check with Firefox, and also check Tor config in Tools | Proxies.
Open Tools | Allpingers manager.
...Click "Update".
...When you see "done!" click "Ok".


Now you'll configure the message that QSL uses to create a Mixnym nym.
In the main compose pane, customize the message to look like the following:

Code:

Fcc: nyms
Host: gbhpq7eihle4btsn.onion
From: nobody@nowhere.net
Chain: *,*,*; copies=2;
To: send@nymphet.paranoici.org
Subject:

hsub: New Mail For Jude!

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFFP2l4BEACXJDUM6SxyjUk8K+MJ4fRJ5VMaE6hSsAD6n8eO04l9HMzSx26X
<snip>
wnOpR4sYYD9MFLura6+YiHWtT8ih
=ndP9
-----END PGP PUBLIC KEY BLOCK-----

~~

In the above:
...Replace "Jude" in "hsub: New Mail For Jude!" with your fake first name.
...Replace the public key block with your public key that you exported above. Get it by exporting it from KGpg then copy-paste the contents.
...Be very careful near line ends ... Unix vs DOS newline can be buggy here.
...The "~~" at the bottom, preceeded by two blank lines, is crucial!
Save as "nym create template".
...You can reuse it with edits for creating other nyms.
Click the PGP lock and signing icons.
......The mixnym server will only accept signed configuration requests.
Now click "Send" 
"PGP Enrypt to Recipients..." prompt will appear. 
...Choose the Nymserver key from the top pane then click "OK"
Enter your key passphrase when prompted to sign message.
After it finishes, you should see:

Code:

0 in message queue
0 in problem queue
2 sent

All mail sent!

If it worked, the next step is configuring QSA.
If it hangs, cancel out and go back through everything looking for errors.
Close QSL when you're done (and ignore the crash error that you may see).

You can't get a reply from the Nymserver until you configure QSA.


## Run QSA.
cd /home/user/.wine/drive_c/QS
wine qsa.exe

## Setup QSA.
Check: Create desktop shortcut... click "OK" 

If your Nymserver name and type is not listed you must add it first before you can add AAM subject lines encrypted to you.

Open Tools | Nymservers.
...New:
......Nymserver Domain: nymphet.paranoici.org.
......Type: Zax
...Click "OK" then "Done"
Open Tools | AAM Subject Lines.
...New:
...In AAM Subject Line Tab:
......Nym, select your nym's private-key".
......Subject (HSUB), use the one you set or "New Mail For Jude!" if you are following the example above.
...Click "OK" then "Done".
Only one AAM Subject Line can be configured to find your hsub. Be sure to enter it exactly as you did before or else QSA won't find it.
Click "Get Mail" from the main interface. Replies take a while.

## Clean-Up
rm -rf /home/user/www.quicksilvermail.net
rm QSLite*.zip
rm QSLite*.zip.sig
rm QSAam*.zip
rm QSAam*.zip.sig
rm /home/user/Desktop/"QuickSilver Lite.lnk"
rm /home/user/Desktop/"QuickSilver Aam.lnk"

From: Header Support

For a list of remailers that accept From: headers.

http://pinger.mixmin.net/from.html ^[archive]

KVM GUI Instructions

No longer applies as we are now using vm xml templates for a standard configuration. The rest of the instructions for shared folders and spice have been moved into a readme file distributed with the images.

sudo apt-get update
sudo apt-get install virt-manager

Make sure folder /var/lib/libvirt/images/ exists.

sudo mkdir -p /var/lib/libvirt/images/

Do not use unxz! Extract the images using tar to /var/lib/libvirt/images/.

Before starting the new vm wizard we must create an internal isolated network that connects the workstation with the gateway.

Go to the VMM GUI --> Edit --> Connection Details --> Add button Choose whonix as network name Edit subnet range to 10.0.0.2/24 Uncheck the dhcpv4 option Ignore anything to do with ipv6 Keep the default option of: Isolated Virtual Network selected and click finish.

The next steps may need more work to customize vm devices and clock to safe defaults. Work in this area not final.

Create a Whonix ™ Gateway vm first and choose to edit it before installation. Customize the first NIC that is included to be in default NAT mode. Click to add hardware and chose another NIC. This new NIC must have the newly created isolated virtual network 'whonix' selected as the network device. Finalize and launch. Must enable disk controller as SATA Must select qcow2 as storage format.

Create Whonix ™ Workstation vm and make sure you select the isolated int. network for the only NIC this machine has. Launch. Disk Controller works only with IDE Must select qcow2 as storage format

Don't forget to take snapshot.

Done!

-SPICE is enabled for graphics by default but needs a vdagent to be installed in the guest vms for accelerated 2D in vm to happen. Not included in workstation install by default which impacts performance greatly.

http://www.linux-kvm.org/page/SPICE ^[archive]

It should be safe for use unless you Adrelanos determine otherwise. 2D and 3D in VBox have an insecure architecture and even the manuals admit to this. 2D in VBox is not even available for anything but windows guests which is not recommended and insecure of course. Everything Linux based is designed from the ground up with security considerations in mind.

Clock disabling for vms on host is recommended. Still haven't done it yet, and it seems to need command line.

Enabling SPICE

SPICE allows accelerated graphics and clipboard sharing. Its implications for security are an open question that needs a detailed answer rather than a vague clear cut one.

1. Enable SPICE by selecting it from the VMM GUI. (It is the default option if you decide not select VNC when creating the VM).

Not enabling SPICE from the beginning, will prevent the spice channel device from being added which impacts performance. To fix this add a channel device and select SPICE. This steps is not necessary if you leave the defaults as they are at the beginning.

2. QXL is the GPU model that should be attached.

3. Install vdagent in guest and reboot.

.qcow file size too big?

Short:
It won't really take up 101 GB. Just ~ 2.6 GB. This is an issue with file managers, not Whonix ™.

Long:

KVM Shared Folders

To move data between the guest and host follow these steps:

1. Set the following settings for shared folders in virt-manager:

The file sharing mode 'mapped' is just an example, using squash or passthrough is possible by selecting them from the drop down menu.

Driver:Default

Mode: Mapped

Source Path: [This is the path of the folder on the Host you are sharing with the Guest]

Target Path: [A custom tag for the shared directory that is used when running the mounting commands within the guest. for example: /tmpshare]

2. Run terminal as root in Guest then use the following command:

mount -t 9p -o trans=virtio [mount tag] [mount point] -oversion=9p2000.L

Mount tag is: /tmpshare

Mount point is the path of the directory that you will share in the Guest with the Host. If it doesn't exist you must create that folder.

Note: you replace the parentheses in the command, they are just a placeholder in this example and should not be typed in.

3. To automatically mount this every time at boot, add the following to your guest's /etc/fstab:

sudoedit /etc/fstab [mount tag] [mount point] 9p trans=virtio,version=9p2000.L,rw 0 0

cpfpy

Debugging start command.

sudo service control-port-filter-python start

Debugging stop command.

sudo service control-port-filter-python stop

To find any eventual leftovers, stale processes, try this.

ps aux | grep cpfpd

or

ps aux | grep python

On the gateway, talk to cpfpy directly.

telnet 10.152.152.10 9052

To check if the port is free, if cpfpy really has shut down.

sudo lsof -i :9052

COMMAND   PID       USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
cpfpd 27653 debian-tor    4u  IPv4  73153      0t0  TCP 10.152.152.10:9052 (LISTEN)

Footnotes

[1] http://wiki.qemu.org/Documentation/9psetup#Starting_the_Guest_using_libvirt ^[archive]

VirtualBox Guest Additions

Introduction

Written and tested with Whonix ™ 0.2.1 (Ubuntu precise). Many things can go wrong and none or the very least of them will be caused by Whonix ™. This has only limited support by the Whonix ™ developers, because 1. it is not recommended for security reasons and 2. the guest additions related bugs and instructions are somewhat out of the scope of the Whonix ™ project.

Installation is somewhat difficult and no packages exist. Just search the internet and you'll see, that loads of people having issues installing the VirtualBox guest additions. People having problems for years. VMware is of no alternative, people are also having trouble installing the VMware tools into Linux guests. The issue with the guest additions is ridiculous. For years no solution has been found. With each kernel update, recompilation is required, and quite often, due to some updates, complication becomes difficult or impossible for a long time.

Also see article, [VirtualBox Kernel Driver Is Tainted Crap ^[archive]].

If you are having trouble, than in most cases not because of Whonix ™. The Whonix ™ setup is a regular Ubuntu Linux and VirtualBox. You can try asking the regular VirtualBox and Ubuntu resources if you have trouble.

TorChat source package

HowTo

EXPERIMENTAL Experimental as in it is difficult to install. Only use it in case you trust TorChat. There shouldn't be any anonymity leaks and it should be as safe as other onion services in general and in Whonix ™.

Learn about Onion Services in Whonix ™ first and learn how to set up the hidden webserver. This will ease following this guide.

On Whonix-Gateway ™.

Open your /usr/local/etc/torrc.d/50_user.conf.

sudoedit /usr/local/etc/torrc.d/50_user.conf

Add.

HiddenServiceDir /var/lib/tor/torchat_service/
HiddenServicePort 11009 10.152.152.11:11009
HiddenServiceVersion 3

Save. Reload Tor.

sudo service tor reload

On Whonix-Gateway ™.

Install dependencies.

sudo apt-get install python python-wxgtk2.8

Get your onion address.

nano /var/lib/tor/torchat_service/hostname

Backup your key, if you want to ever restore it one another machine, a newer Whonix-Workstation ™ or after hdd failure.

/var/lib/tor/torchat_service/private_key

Download the latest Python version of TorChat source code, for example as time of writing torchat-source-0.9.9.553.zip - Python source code (classic standalone 0.9.9 version) from (https://github.com/prof7bit/TorChat/downloads ^[archive]) and store it in /home/user.

Unpack.

unzip torchat-source-0.9.9.553.zip

Get into the torchat source folder. For example.

cd /home/user/torchat-source-0.9.9.553/

Get into the src folder.

cd src

Get into the Tor folder.

cd Tor

Rename tor.sh.

mv tor.sh backup_tor.sh

Go back to the src folder.

cd ..

Create torchat.ini.

nano torchat.ini

Add the following content.

[client]
listen_interface = 10.152.152.11 
listen_port = 11009
own_hostname = <your onion hostname without .onion>

[tor]
tor_server = 10.152.152.10
tor_server_control_port = 9154
tor_server_socks_port = 9154

[tor_portable]
tor_server = 10.152.152.10
tor_server_control_port = 9154
tor_server_socks_port = 9154

Make torchat executable.

chmod +x torchat.py

Run torchat.

./torchat

Alternative

After installing the dependencies we could also force install the torchat deb package.

sudo dpkg -i --force-depends torchat-0.9.9.553.deb

And then configure the files inside /home/user/.torchat. I don't know if that may be the better way.

Mixmaster

MX capable DNS resolver

No longer required.

Mixmaster needs to resolve MX DNS records, while Tor does not support that ^[archive]. We have to install a DNS resolver capable of doing that. It still comes with caveats.

Required knowledge:

• Introduction chapter of Secondary DNS Resolver

The Example with CZ.NIC Labs DNS resolver worked in this case.

Security considerations when replacing the system wide DNS resolver:

• The third party DNS resolver traffic goes through its own circuit, which is good.

• All (custom installed) applications not configured to use a SocksPort (see [Stream Isolation]), would resolve their DNS through the system wide DNS resolver, which would be the third party resolver, giving too much power to it, because it is always the same, only one service provider, not changing like Tor circuits but static. ## Install Postfix ##

  sudo apt-get install postfix ## configure postfix as sattelite system, default settings

Technical background: Mixmaster requires either - a) An (open) smtp server SMTPRELAY in /etc/mixmaster/remailer.conf. Unfortunately, I haven't found any open smtp server (search term: open relay). A mailserver where the user registers first would probably work, but this would defeat the original idea: sending e-mails without depending on registration. Or, - b) a mta (mail transfer agent), which speaks to the remailer directly. TODO: Are there enough Tor exit relays, which allow the SMTP port and does their ISP allow to speak SMTP? If there are too few servers, it could be bad for anonymity.

Open /etc/postfix/main.cf.

lxsudo mousepad /etc/postfix/main.cf

Replace the content with the following.

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = host.localdomain
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = host, host.localdomain, localhost.localdomain, localhost
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = 
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = loopback-only
inet_protocols = all

relayhost = 1.1.1.1
#relayhost = 2.2.2.2

Debugging Postfix

Looking into the mail log.

tail -f /var/log/mail.info

Should contain something like this.

<date> <time> debian postfix/pickup[id]: id2: uid=1000 from=<user>
<date> <time> debian postfix/cleanup[id]: id2: message-id=<id3.id4@host.localdomain>
<date> <time> debian postfix/qmgr[id]: id2: from=<user@host.localdomain>, size=30000, nrcpt=1 (queue active)
<date> <time> debian postfix/smtp[300]: id2: to=<remailer@breaka.net>, relay=mail.breaka.net[202.75.54.8]:25, delay=30, delays=0.30/0.01/30/3.0, dsn=2.0.0, status=sent (250 OK id=id5-id6-id7)
<date> <time> debian postfix/qmgr[id]: id2: removed

Reading local mail.

## Either with cli tool mail.
mail

## Or using gui tool Icedove (Debian version of Mozilla Thunderbird)
## using movemail.

If all went well, there will be no local mail. Only error messages result in local mails.

Bugs

• In Whonix ™ 0.4.5, due to a Tor Browser upstream bug ^[archive] (they forgot to update the changelog) and because the keyserver is/was down, the torbrowser and whonixcheck script in Whonix ™ can no longer find out which Tor Browser version is locally installed. (Whonix ™ Bug Report ^[archive]) The Update Tor Browser chapter contains a workaround and a fix is available for testers.

Attack matrix in different order

<thead> </thead> <tbody> </tbody>

attack	TBB	TBB in a VM	Tails	Tails in a VM	Whonix ™ Standard Download version host+vm+vm	Whonix ™ Physical Isolation
(1) Protocol IP leak	fail	fail	fail	fail	safe	safe
(2) exploit + Unsafe Browser	fail	fail	fail	fail	safe	safe
(3) exploit + root exploit + Unsafe Browser	fail	fail	fail	fail	safe	safe
(4) root exploit + Unsafe Browser	fail	fail	fail	fail	safe	safe
(5) exploit + vm exploit + Unsafe Browser	fail	fail	fail	fail	fail	safe
(6) exploit + vm exploit + exploit against physically isolated Whonix-Gateway ™	fail	fail	fail	fail	fail	fail
(7) vm exploit	safe	fail	safe	fail	fail	safe
(8) vm exploit + exploit against physically isolated Whonix-Gateway ™	safe	fail	safe	fail	fail	fail
(9) exploit against Tor process	fail	fail	fail	fail	fail	fail
(10) attack against the Tor network	fail	fail	fail	fail	fail	fail

E-Mail Notification

Users, who have an (anonymous) sourceforge.net account, could go to the Whonix ™ sf.net Project Page ^[archive], scroll down to Update Notifications and hit the Subscribe to Updates button. They would receive notifications about new releases sent to their (anonymous) [E-Mail] address.

There is currently no way for users to subscribe to sf.net blogs or wiki, but such a feature has been requested ^[archive].

Sourceforge.net E-Mail Notification

Didn't work reliable.

E-mail notification: For users having an account on sf.net, there is on sf.net ^[archive] git is an E-Mail subscribe button: M.

This is an example how such a mail could look like:

experimental: comment by adrelanos http://sourceforge.net/p/whonix/code/ci/a1740dfcd391cedfa625d72b990b2a587620df30/ ^[archive]

experimental: Whonix-Workstation ™_packages: added gtk3-engines-oxygen by adrelanos http://sourceforge.net/p/whonix/code/ci/7375070a7986230028bf4e82a6ab3ecb420bfd60/ ^[archive]

---

Sent from sourceforge.net because you indicated interest in https://sourceforge.net/p/whonix/code/ ^[archive]

To unsubscribe from further messages, please visit https://sourceforge.net/auth/prefs/ ^[archive]

Restrict Flash Settings

You can skip this chapter. It is no longer of use, because if you use BetterPrivacy as recommended above, you won't need this.

Flash applications can set cookies, so-called Local Shared Objects (LSO), independently of the browser's settings. These cookies are able to save data up to 100 Kb. Usually, they save settings but they may be used to track surfers as well.

In order to manage the settings of your Adobe Flash Player, Macromedia offers a Flash application ^[archive] on its website. There you may e.g. configure the rules concerning the data storage and the rights for using camera and microphone. The settings are spread over several flash applications. Deactivate all functions that allow sharing and saving of data. The storage of LSOs may be deactivated on the Global Storage Settings panel ^[archive].

Hint: Only in case you previously deactivated JavaScript: You must have Javascript enabled for adobe.com and macromedia.com temporary to run the Flash application.

Furthermore, the cookies already saved have to be deleted. This functionality may be found on the Website Storage Settings panel ^[archive].

Personal side note: you see how ridiculous that plugin is, if the usage of the Flash settings manager depends on their website being reachable.

Build Documentation dpkg-source commit

To dpkg commit changes, run the debian upstream tarball creation script.

./help-steps/make-debian-package-upstream-tarball

Then run.

dpkg-source --commit

When it asks "Enter the desired patch name:" just enter anything you wish, for example "buildconfig". In the following window, you don't have to fill out anything. Just save and close the editor. You only have to do this once and won't be asked again to do this, unless you add another change which needs to be dpkg-source committed.

If you want to undo the dpkg-source committed change, check the contents of the .pc and the debian/patches folder and delete it.

Build Documentation - Override Whonix ™ Version

Since the Whonix ™ debian package version number is auto derived from git describe and used for Whonix ™ News download, it is recommended to override it. You could add a file to buildconfig.d, for example buildconfig.d/50_version and add for example.

temp="$WHONIX_BUILD_CLOSEST_GIT_TAG"

## Using `export`, so whonix_shared/usr/share/whonix/chroot-scripts-post.d/70_log_build_version can read it.
export WHONIX_BUILD_WHONIX_VERSION_NEW="$(echo "$temp" | sed 's/-/./g')"

echo "WHONIX_BUILD_WHONIX_VERSION_NEW: $WHONIX_BUILD_WHONIX_VERSION_NEW"

WHONIX_BUILD_NEW_CHANGELOG_VERSION=""$WHONIX_BUILD_WHONIX_VERSION_NEW""-debpackage""$WHONIX_BUILD_NEW_DEB_REVISION_VERSION""

echo "WHONIX_BUILD_NEW_CHANGELOG_VERSION: $WHONIX_BUILD_NEW_CHANGELOG_VERSION"

While building, check if WHONIX_BUILD_NEW_CHANGELOG_VERSION looks sane.

If you added a new file to buildconfig.d, for example buildconfig.d/50_target_arch, those have to be dpkg-source committed before building Whonix ™. Otherwise you'll get an error message. (Which looks like this:).

Whonix ™ 0.5.6 Download Matrix

Version: Template:Version

Note: You need to download both Gateway and Workstation virtual machine images.

	Whonix-Gateway	Whonix-Workstation ™	Anonymous Download possible	Download Security without Verification	Download Security with Verification
	<html><a href="http://sourceforge.net/projects/whonix/files/whonix- [archive]</html>Template:Version<html>/Whonix-Gateway.ova/download" target="_blank">Download</a></html>	<html><a href="http://sourceforge.net/projects/whonix/files/whonix- [archive]</html>Template:Version<html>/Whonix-Workstation.ova/download" target="_blank">Download</a></html>	Yes	Low	High
	<html><a href="/download/</html>Template:Version<html>-sig/Whonix-Gateway.ova.sig">OpenPGP Signature</a></html>	<html><a href="/download/</html>Template:Version<html>-sig/Whonix-Workstation.ova.sig">OpenPGP Signature</a></html>	Yes	-	-
	Verify the images using the Signing Key		Yes	-	-
	<html><a href="/download/</html>Template:Version<html>-torrent/Whonix-Gateway.ova.torrent">Torrent Download</a></html>	<html><a href="/download/</html>Template:Version<html>-torrent/Whonix-Workstation.ova.torrent">Torrent Download</a></html>	No	Medium	High
	<html><a href="magnet:?xt=urn:btih:fba5ace7a163afae54aa1677cf92540a38d5914c&dn=Whonix-Gateway.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2FWhonix-Gateway-0.5.6.ova">Magnet Link</a></html>	<html><a href="magnet:?xt=urn:btih:7255075def146b6f5d7b6e23121e1e5a5bedf13d&dn=Whonix-Workstation.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2FWhonix-Workstation ™-0.5.6.ova">Magnet Link</a></html>	No	Medium	High
	Build from source code		See Build Anonymity	Excellent

XChat

The following information only applies to the deprecated version of Whonix 0.5.6. It requires updating for more recent versions of Whonix ™. Please help.

All XChat plugins have been deactivated (hardening) and moved to /usr/lib/xchat/plugins.disabled. If you really need a plugin, such as perl for SASL, you can use the example below.

sudo mv /usr/lib/xchat/plugins.disabled/perl.so /usr/lib/xchat/plugins/

Manually updating Tor Browser (Whonix ™ 0.5.6)

The following information only applies to the deprecated version of Whonix 0.5.6. It requires updating for more recent versions of Whonix ™. Please help.

(1) Go to https://www.torproject.org/ ^[archive] and/or http://idnxcnkne4qt76tg.onion/ ^[archive] and download the Tor Browser Bundle for Linux 32 bit. Store it in /home/user/.

(2) Read https://www.torproject.org/docs/verifying-signatures.html.en ^[archive] and/or http://idnxcnkne4qt76tg.onion/docs/verifying-signatures.html.en ^[archive] and learn about gpg verification.

(3) Go to https://www.torproject.org/docs/signing-keys.html.en ^[archive] and/or http://idnxcnkne4qt76tg.onion/docs/signing-keys.html.en ^[archive] to get the gpg keys.

(4) Verify the Tor Browser Bundle download.

(5) Go into /home/user/ with the file manger. (Dolphin)

(6) Extract the Tor Browser Bundle. Right click on the downloaded archive -> extract -> extract archive here.

(7) In case you downloaded another version than en-US, rename the tor-browser_lang folder to tor-browser_en-US. This is important, because the paths in the following script are hardcoded.

(8) Go into the /home/user/tor-browser_en-US folder.

(9) Delete start-tor-browser or move it to the /home/user/tor-browser_en-US/Docs folder.

(10) Create a new file within the /home/user/tor-browser_en-US/ folder called start-tor-browser with the following content.

#!/bin/bash
## {{project name}} Tor Browser start script

export TOR_SKIP_LAUNCH=1
    
cd ~
~/tor-browser_en-US/App/Firefox/firefox --profile ~/tor-browser_en-US/Data/profile
    
## End of {{project name}} Tor Browser start script

(11) Make the start-tor-browser script executable. Right click on start-tor-browser -> Properties -> Permissions -> enable the Is executable box -> ok.

(12) Go to /home/user/tor-browser_en-US/Data/profile/ and create a file user.js with the following content.

## Begin of patched user.js.

## If you edit this file while Firefox is running, your changes will be
## overwritten, when you close Firefox.

## How to create the user.js network settings:
## 1. Make a backup of prefs.js.
## 1. Start Tor Browser with the patched start script.
## 2. Apply proxy settings using the Tor Button settings dialog..
## 3. Make a diff from the old and the new pref.js.
## 4. Copy the relevant changes to user.js.

## network settings
## (Are now set in /etc/environment - or not...)
## (See /etc/environment.)
user_pref("extensions.torbutton.use_privoxy", false);
user_pref("extensions.torbutton.settings_method", "custom");
user_pref("extensions.torbutton.socks_host", "10.152.152.10");
user_pref("extensions.torbutton.socks_port", 9100);
user_pref("network.proxy.socks", "10.152.152.10");
user_pref("network.proxy.socks_port", 9100);
user_pref("extensions.torbutton.custom.socks_host", "10.152.152.10");
user_pref("extensions.torbutton.custom.socks_port", 9100);

## End of {{project name}} user.js.

(13) If you want to make 100% sure you never have Tor over Tor, you must shut down Whonix-Gateway ™ while doing the following.

(14) Delete /home/user/my_tor-browser_en-US/App/tor.

(15) If there is no green Vidalia icon in the task bar, everything is fine.

(16) Start Tor Browser and run

ps aux | grep tor

If you see something like.

109 /usr/sbin/tor

Or.

/home/user/my_tor-browser_en-US/App/tor

Something went wrong and you're running Tor over Tor, which is recommended against.

(17) If the tests results are as expected, everything went fine.

(18) Don't forget to restart Whonix-Gateway ™, if you shut it down in step (13).

(19) Done.

DummyTor

Introduction

The following information only applies to the deprecated version of Whonix 0.5.6. It requires updating for more recent versions of Whonix ™. Please help.

Whonix-Workstation ™ has an empty Tor package installed by default, called Dummy Tor package. It contains no files, besides some default files, which are required to create a dummy package. Debian packages are standard Unix ar archives, auditors can unpack and check them.

The reason for installing the Dummy Tor package inside Whonix-Workstation ™ is to prevent installing the Tor package from the upstream (Debian or The Tor Project) repository, to prevent running Tor over Tor. This allows installation of packages, which depend on Tor, such as TorChat and parcimonie on Whonix-Workstation ™.

To prevent the package from upgrading

echo "tor hold" | sudo dpkg --set-selections

has been run while building Whonix ™ from source code.

To check the status an auditor could run.

dpkg --get-selections | grep tor

To undo holding the packing a user could run.

echo "tor install" | sudo dpkg --set-selections

Implementation

The following information only applies to the deprecated version of Whonix 0.5.6. It requires updating for more recent versions of Whonix ™. Please help.

• Everything is inside the whonix_workstation/usr/local/share/whonix/dummytor/ folder in Whonix ™ source code
• and subsequently in /usr/local/share/whonix/dummytor/ in Whoix-Workstation.
• .deb package format
• /usr/local/share/whonix/dummytor/tor is the control file
• /usr/local/share/whonix/dummytor/tor_1.0_all.deb is the package which was installed using dpkg by whonix_workstation/usr/local/share/whonix_internal_install_script.
• whonix_workstation/usr/local/share/whonix/dummytor/dummytor is the "build script" for the package, which is actually only a single "equivs-build ./tor" command.

How it would look...

The following information only applies to the deprecated version of Whonix 0.5.6. It requires updating for more recent versions of Whonix ™. Please help.

...if a Tor version higher than 1.0 was released.

sudo apt-get dist-upgrade

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
  tor

Tor Browser

FoxyProxy Sandboxing Warning

Tor Browser will soon ship with sandboxing on an opt-in basis. Unfortunately, the initial sandbox versions are incompatible with this configuration and it must not be enabled. Users with AppArmor enabled may see Tor Browser profile warning messages. These messages can be safely ignored, since they do not prevent FoxyProxy functioning at this time.

Remove Proxy Settings - Whonix ™ 0.5.6

The following information only applies to the deprecated version of Whonix 0.5.6. It requires updating for more recent versions of Whonix ™. Please help.

It is best to get a fresh copy of Tor Browser, which has never been started before.

Whonix ™ modifies user.js as documented in the Tor Browser chapter.

Open /home/user/tor-browser_en-US_my/Data/profile/user.js.

kwrite /home/user/tor-browser_en-US_my/Data/profile/user.js

Comment out all network settings.

## network settings
#user_pref("extensions.torbutton.use_privoxy", false);
#user_pref("extensions.torbutton.settings_method", "custom");
#user_pref("extensions.torbutton.socks_host", "10.152.152.10");
#user_pref("extensions.torbutton.socks_port", 9100);
#user_pref("network.proxy.socks", "10.152.152.10");
#user_pref("network.proxy.socks_port", 9100);
#user_pref("extensions.torbutton.custom.socks_host", "10.152.152.10");
#user_pref("extensions.torbutton.custom.socks_port", 9100);

You could use Tor Button's settings dialog to set it to any other proxy or transparent torification. The latter means "no proxy", which will result in Tor Browser using whatever the operating system provides and if you don't have a VPN installed inside Whonix-Workstation ™, it will go through Tor's TransPort.

If you are using the transparent torification option in Tor Button, you could point a socksifier to start-tor-browser and it should work as usual.

If you are having problems, it is most likely a problem with Tor Browser / Tor Button's proxy settings. In Tor Browser open the pseudo url "about:config" and search for "network.proxy" and check if these settings are sane.

Warning

Don't use Tor Browser's Internal Updater. For now. Use Tor Browser Updater (Whonix ™). More information below.

There are various update mechanisms. Not all are equally secure. Whonix ™ recommends against using Tor Browser's internal updater for security reasons. Using Tor Browser Updater (Whonix ™) is recommended. To enable you to distinguish them, here are some screenshots of the various updaters.

Forum Help Thread ^[archive]

Warning2

Don't this Tor Browser's internal updater. For now. Why? See #Warning. Below you see a screenshot of Tor Browser's Internal Updater.

Language

Method 4 - Command Line Parameter Method

Whonix-Workstation ™ ONLY!

Currently broken. Will be fixed in Whonix ™ 10.

Not a good method, because tb-starter would miss this setting.

Please TEST and leave feedback.

Available languages as in May 2014:

ar
de
en-US
es-ES
fa
fr
it
ko
nl
pl
pt-PT
ru
tr
vi
zh-CN

To check if further languages are supported visit https://www.torproject.org/dist/torbrowser/ ^[archive] or http://idnxcnkne4qt76tg.onion/dist/torbrowser/ ^[archive].

Syntax.

update-torbrowser --update --language <language code>

Example.

update-torbrowser --update --language vi

update-torbrowser --update --language vi

Replace "vi" with "zh-CN" for Chinese and so on.

Whonix ™ 0.5.6 Disable Auto Login

The following information only applies to the deprecated version of Whonix 0.5.6. It requires updating for more recent versions of Whonix ™. Please help.

OPTIONAL. Only in case you want to do that.

If you aren't using Physical Isolation, i.e. if you use the Default-Download-Version (Virtual Machines), it is probably better to use the desktop locking mechanism of your host operating system.

These features are inherited from Debian and its packages.

1. On Whonix-Gateway ™ and Whonix-Workstation ™

Open /etc/inittab:

sudoedit /etc/inittab

Look for:

## If you do not want this,
## comment in the next line and comment out the second one.

Below you'll see:

#1:2345:respawn:/sbin/getty 38400 tty1
1:2345:respawn:/sbin/getty --autologin user 38400 tty1

Change it to:

1:2345:respawn:/sbin/getty 38400 tty1
#1:2345:respawn:/sbin/getty --autologin user 38400 tty1

2. On Whonix-Workstation ™

Start Menu -> System Settings -> Login Screen -> Convenience -> Disable "Enable Auto Login"

Tor Browser in Whonix ™ 0.5.6

Introduction

The regular Tor Browser Bundle and Tor Browser in Whonix ™ slightly differ. Tor Browser has been slightly modified by Whonix ™ to work behind the Whonix-Gateway ™. The network and browser fingerprint however, is the same.

Tor Browser's internal update check mechanism is untouched and works fine. Default homepage is untouched and still https://check.torproject.org ^[archive].

New Identity Button

Note that, if you are using the Tor Browser, which comes with Whonix ™, that the New Identity button of Tor Button is defunct (greyed out). This is because Tor Button can not access Tor's control port. Due to Whonix ™ Technical Design, Tor Browser and Tor are isolated from each other, which means there is no way to fix this without loosing the added security by Whonix ™.

When using the regular Tor Browser Bundle (not Whonix!), the New Identity button unlinks your old identity, changes your circuit (exit relay IP) and creates a fresh identity.

As a workaround close Tor Browser, change your circuit with Arm and start Tor Browser again.

This is not a big issue, since the New Identity button is not perfect yet anyway, there are open bugs.

(New Identity Button will be fixed in Whonix ™ 6 and above.)

Whonix ™ Proxy Settings / user.js

When running torbrowser -update, the update script creates a user.js file, for example ~/tor-browser_en-US/Data/profile/user.js. User.js is used to override some Tor Button defaults, namely the SocksProxy settings and other minor misc settings. See also the Tor Browser sub chapter on the Stream Isolation page.

More than one Tor Browser in Whonix ™

For better isolation of different identities. For advanced users. Moved to the Advanced_Security_Guide#More_than_one_Tor_Browser_in_Whonix ™Advanced Security Guide.

Manually updating Tor Browser

(1) Go to https://www.torproject.org/ ^[archive] and/or http://idnxcnkne4qt76tg.onion/ ^[archive] and download the Tor Browser Bundle for Linux 32 bit. Store it in /home/user/.

(2) Read https://www.torproject.org/docs/verifying-signatures.html.en ^[archive] and/or http://idnxcnkne4qt76tg.onion/docs/verifying-signatures.html.en ^[archive] and learn about gpg verification.

(3) Go to https://www.torproject.org/docs/signing-keys.html.en ^[archive] and/or http://idnxcnkne4qt76tg.onion/docs/signing-keys.html.en ^[archive] to get the gpg keys.

(4) Verify the Tor Browser Bundle download.

(5) Go into /home/user/ with the file manger. (Dolphin)

(6) If you still have the old version of TBB opened (because you are probably reading this from the old TBB), close it. (copy the next steps to Kwrite if necessary)

(7) Rename your old TBB /home/user/tor-browser_en-US to something else.

(8) Extract the Tor Browser Bundle. Right click on the downloaded archive -> extract -> extract archive here.

(9) In case you downloaded another version than en-US, rename the tor-browser_lang folder to tor-browser_en-US. This is important, because the paths in the following script are hardcoded.

(10) Go into the /home/user/tor-browser_en-US folder.

(11) Delete start-tor-browser or move it to the /home/user/tor-browser_en-US/Docs folder.

(12) Create a new file within the /home/user/tor-browser_en-US/ folder called start-tor-browser with the following content.

#!/bin/bash
## {{project name}} Tor Browser start script

export TOR_SKIP_LAUNCH=1
    
cd ~
~/tor-browser_en-US/App/Firefox/firefox --profile ~/tor-browser_en-US/Data/profile
    
## End of {{project name}} Tor Browser start script

(13) Make the start-tor-browser script executable. Right click on start-tor-browser -> Properties -> Permissions -> enable the Is executable box -> ok.

(14) If you want to make 100% sure you never have Tor over Tor, you must shut down Whonix-Gateway ™ while doing the following.

(15) Delete /home/user/my_tor-browser_en-US/App/tor.

(16) If there is no green Vidalia icon in the task bar, everything is fine.

(17) Start Tor Browser and run

ps aux | grep tor

If you see something like.

109 /usr/sbin/tor

Or.

/home/user/my_tor-browser_en-US/App/tor

Something went wrong and you're running Tor over Tor, which is recommended against.

(18) If the tests results are as expected, everything went fine.

(19) Don't forget to restart Whonix-Gateway ™, if you shut it down in step (13).

(20) Done.

More than one Tor Browser in Whonix ™

WARNING: "More than one Tor Browser in Whonix" instructions have not been updated for TBB 3.x yet!

As the Warning page stated, Whonix ™ doesn't magically separate your different contextual identities and since Tor Browser and Tor Button do not yet solve this, for further separation of identities you could use Multiple Whonix-Workstation ™, which would be more secure.

Alternatively, less secure than Multiple Whonix-Workstation ™, you could start multiple instances of Tor Browser and run them through different SocksPorts. The instructions in the Manually Downloading Tor Browser article need minimal changes.

Instead of

#!/bin/bash
## {{project name}} Tor Browser start script

~/tor-browser_en-US/App/Firefox/firefox --profile ~/tor-browser_en-US/Data/profile

## End of {{project name}} Tor Browser start script

Use

#!/bin/bash
## {{project name}} Tor Browser start script

## Adjust the path!
~/tor-browser_2/App/Firefox/firefox --profile ~/tor-browser_2/Data/profile -no-remote

## End of {{project name}} Tor Browser start script

Only -no-remote was added to the start script. Otherwise Tor Browser would connect to the already running Tor Browser and this is not what you want. And don't forget to adjust the path to the other Tor Browser.

You also have to use a different SocksPort, see Change/Remove Proxy Settings. (See Stream Isolation page for explanation why you should use different SocksPorts.)

Trusting the key

Download the key from multiple sources

A simple technique to increase the trust you can put in the Whonix ™ signing key would be to download it several times, from several locations, several computers, possibly several countries, etc.

You could also use this technique to compare keys downloaded by your friends or other people you trust.

Downloading the key from the same server only lowers the possibility of a man-in-the-middle attack for a part of the route. The following figure illustrates that best:

user <-> user ISP <-> internet <-> sourceforge.net ISP <-> sourceforge.net server
MITM less likely for this route |  no help for this route

For this reasons adrelanos' homepage, which describes and contains adrelanos' OpenPGP key is mirrored at six different places. Download adrelanos' key from all those places and store it as adrelanos1.asc, adrelanos2.asc, adrelanos3.asc, etc.

1. adrelanos' homepage on github ^[archive]; (key download ^[archive])

Github.com is accessible over SSL.

2. adrelanos' key page on sourceforge ^[archive]; (key download ^[archive])

SSL available for users logged into sourceforge.net.

3. adrelanos' homepage on gitorious ^[archive]; (key download ^[archive])

Gitorious.org is accessible over SSL.

4. adrelanos' homepage on torproject.org wiki ^[archive]

SSL available. Anyone can edit the torproject.org wiki and exchange content with malicious one. Therefore check the history feature. Obviously, I do trust Tor and torproject.org. My wiki account "proper" should be genuine, therefore changes by "proper" should be legit.

5. adrelanos OpenPGP key mirror on savannah.gnu.org profile page ^[archive]

SSL available. The following command is recommended to enforce downloading the key over SSL:

## Not forced through Tor, unless you are using Whonix ™, torsocks or similar.
curl --tlsv1.2 --proto =https --output adrelanos.asc.4 https://savannah.gnu.org/people/viewgpg.php?user_id=89289

## Not forced through Tor, unless you are using Whonix ™, torsocks or similar. curl --tlsv1.2 --proto =https --output adrelanos.asc.4 https://savannah.gnu.org/people/viewgpg.php?user_id=89289

6. adrelanos' OpenPGP key mirror on OpenPGP keyserver

No SSL. Should really be only used as a mirror.

## Not forced through Tor, unless you are using {{project_name}}, torsocks or similar.
gpg --keyserver x-hkp://pool.sks-keyservers.net --recv-key 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA

7. adrelanos' OpenPGP key in Whonix ™ 6 and above

gpg --import /usr/share/whonix/keys/whonix-keys.d/adrelanos.asc

Verify:

gpg --recv-key 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA

Should show.

pub   4096R/2EEACCDA 2014-01-16 [expires: 2015-01-16]
      Key fingerprint = 916B 8D99 C38E AF5E 8ADC  7A2A 8D66 066A 2EEA CCDA
uid                 [ unknown] Patrick Schleizer <adrelanos@riseup.net>
sub   4096R/0x3B1E6942CE998547 2014-01-16 [expires: 2015-01-16]
sub   4096R/0x10FDAC53119B3FD6 2014-01-16 [expires: 2015-01-16]
sub   4096R/0xCB8D50BB77BB3C48 2014-01-16 [expires: 2015-01-16]

Each time you re-import the key from a different source:

gpg --import adrelanos.asc 
gpg --import adrelanos1.asc 
gpg --import adrelanos2.asc 
...

It should always show:

gpg: key 2EEACCDA: "Patrick Schleizer <adrelanos@riseup.net>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

And:

gpg --fingerprint

Should always show the same fingerprint and only contain: (Besides keys you imported knowingly earlier, perhaps your friends keys.)

pub   4096R/0x8D66066A2EEACCDA 2014-01-16 [expires: 2015-01-16]
      Key fingerprint = 916B 8D99 C38E AF5E 8ADC  7A2A 8D66 066A 2EEA CCDA
uid                 [ unknown] Patrick Schleizer <adrelanos@riseup.net>
sub   4096R/0x3B1E6942CE998547 2014-01-16 [expires: 2015-01-16]
sub   4096R/0x10FDAC53119B3FD6 2014-01-16 [expires: 2015-01-16]
sub   4096R/0xCB8D50BB77BB3C48 2014-01-16 [expires: 2015-01-16]

Unless the new key is signed with the old key, something fishy is going on.

Whonix ™ 7 Download Table (Deprecated)

Version: Template:Version

Note: You need to download both Gateway and Workstation virtual machine images.

	Whonix-Gateway (1.2 GiB)	Whonix-Workstation ™ (1.3 GiB)	Anonymous Download possible	Download Security without Verification	Download Security with Verification
	<html><a href="http://mirror.whonix.org/Whonix- [archive]</html>Template:Version<html>/Whonix-Gateway-</html>Template:Version<html>.ova" target="_blank">Download</a></html>	<html><a href="http://mirror.whonix.org/Whonix- [archive]</html>Template:Version<html>/Whonix-Workstation ™-</html>Template:Version<html>.ova" target="_blank">Download</a></html>	Yes	Very Low	High
	<html><a href="http://sourceforge.net/projects/whonix/files/current/ [archive]</html>Template:Version<html>/Whonix-Gateway-</html>Template:Version<html>.ova/download" target="_blank">Download</a></html>	<html><a href="http://sourceforge.net/projects/whonix/files/current/ [archive]</html>Template:Version<html>/Whonix-Workstation ™-</html>Template:Version<html>.ova/download" target="_blank">Download</a></html>	Yes	Very Low	High
	<html><a href="https://jhcloos.com/whonix/7/Whonix-Gateway-7.ova [archive]" target="_blank">Download</a></html>	<html><a href="https://jhcloos.com/whonix/7/Whonix-Workstation [archive] ™-7.ova" target="_blank">Download</a></html>	Yes	Low	High
	<html><a href="/download/current/</html>Template:Version<html>-sig/Whonix-Gateway-</html>Template:Version<html>.ova.asc">OpenPGP Signature</a></html>	<html><a href="/download/current/</html>Template:Version<html>-sig/Whonix-Workstation ™-</html>Template:Version<html>.ova.asc">OpenPGP Signature</a></html>	Yes	-	-
	Verify the images using the Signing Key		Yes	-	-
	<html><a href="/download/</html>Template:Version<html>-torrent/Whonix-Gateway-</html>Template:Version<html>.ova.torrent">Torrent Download</a></html>	<html><a href="/download/</html>Template:Version<html>-torrent/Whonix-Workstation ™-</html>Template:Version<html>.ova.torrent">Torrent Download</a></html>	No	Medium	High
	<html><a href="magnet:?xt=urn:btih:405e051b5309fb66fd7ba9a04066936de64ce478&dn=Whonix-Gateway-7.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2FWhonix-Gateway-7.ova">Magnet Link</a></html>	<html><a href="magnet:?xt=urn:btih:13ec8c33dd9b58fe4e5120002dad7b4c683c2b78&dn=Whonix-Workstation ™-7.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2FWhonix-Workstation ™-7.ova">Magnet Link</a></html>	No	Medium	High
	Build from source code		See Build Anonymity	Very High	Best

Whonix ™ 7 OLD Known Issues

=== Connection Issues - Tor stops working after an Upgrade and needs a Workaround ===When upgrading to Tor 0.2.4.19-1~d79.jessie+1 (using sudo apt-get dist-upgrade), your Tor connection may go down. There is a temporary workaround.

Open /etc/default/tor.

## If you are using a graphical {{gateway_product_name}}, use:
kdesudo kate /etc/default/tor

## Or alternatively, if you are using a terminal-only {{gateway_product_name}}, use:
sudoedit /etc/default/tor

Scroll down, near bottom comment in (by removing the # in front of it).

USE_AA_EXEC="no"

Then try:

sudo service tor restart

You should keep that in mind and undo that change when Whonix ™ or Tor fixes that bug. We'll keep you posted. (See Download#Stay_tuned and Security_Guide#Recommendation_to_install_latest_security_updates_on_all_systems.)

Forum help thread: Special:AWCforum/st/id287/new_tor_and_debian_updates_today....html

=== Virtual Box Shared Folder Issues ===Shared Folders aren’t working with the latest Linux kernel. (This is a Debian/Virtual Box issue, not caused by Whonix ™. Has already been reported to upstream by a Debian user.)

Possible workarounds, more information, etc. can be found in the Whonix ™ User Help Forum discussion thread: Special:AWCforum/st/id261/VirtualBox_shared_directories_on....html

=== Tor Browser Starter (Whonix ™) ===After manually upgrading Tor Browser (see above)... To start Tor Browser, got to your /home/user/tor-browser_en-US folder and double click start-tor-browser. Or type in terminal (Konsole).

/home/user/tor-browser_en-US/start-tor-browser

=== Tor Browser Updater (Whonix ™) ===Currently broken due to changes by torproject.org. You have to manually update Tor Browser in meanwhile.

Forum help thread: Special:AWCforum/st/id262/updating_TOR_browser_error...html

=== Enigmail Encryption ===When using OpenPGP encryption in Thunderbird / Enigmail you might get "encryption command failed".

Thunderbird has been updated in Debian Testing in meanwhile. Upgrade it.

sudo apt-get update
sudo apt-get dist-upgrade

You should then install enigmail as usual:

sudo apt-get install enigmail

=== Defunct Desktop Shortcuts ===The desktop shortcuts Tor Browser, Contribute, Forum, Documentation, Donate won't work until there is an upgrade of Whonix ™. Please manually visit these pages. How to start Tor Browser has already been explained above.

Whonix-Gateway ™: Err: http://deb.torproject.org ^[archive] tor-0.2.4.x-jessie/main i386 Packages 404 Not Found

Short answer:
Update and upgrade your underlying Debian system (Whonix ™ is a derivative of Debian).

sudo apt-get update
sudo apt-get dist-upgrade

See also Security_Guide#Recommendation_to_install_latest_security_updates_on_all_systems. This bug will be fixed with next Whonix ™ upgrade (will take some time). No other action strictly required for now.

Long answer:
This is because torproject deprecated that repository. That was to be expected. The repository we're using now is already preconfigured (in /etc/apt/sources.list.d/torproject.list).

Taking action is not important at this stage. You can comment it out (by putting a # in front of it) in /etc/apt/sources.list.d/torproject.list if you want. (kdesudo kate /etc/apt/sources.list.d/torproject.list for graphical Whonix-Gateway ™ or sudoedit /etc/apt/sources.list.d/torproject.list for terminal-only Whonix-Gateway ™) If you don't do it, it will be auto fixed with next upgrade of Whonix ™.

There is no public key available for the following key IDs

The message "There is no public key available for the following key IDs" is not necessarily an error. It might be just a warning/information.

sudo apt-get update
...
Reading package lists... Done
...
W: There is no public key available for the following key IDs:
9C131AD3713AAEEF

Check the exit code of apt-get.

echo $?
0

When it is 0, there is no problem. This is due to key transition, because Whonix ™ repository is currently signed with the old and the new signing key.

Reasons for Staying Anonymous Developer

Security and trust shouldn't depend on showing a face:

• Tails ^[archive] (w ^[archive])

KVM

Convert

Converting is only required if you want to use the stable version of Whonix ™. No longer required for testers-only versions, see:
https://www.whonix.org/blog/category/testers-wanted/ ^[archive]

1. Extract the downloaded Whonix ™ ova images to obtain the VMDK virtual storage files.

tar -xvf ~/{{project_name_short}}.ova

As of now, VMDK files cannot be directly used by KVM or converted to a file type supported by KVM.

VBoxManage clonehd --format VDI vmdk_file vdi_file

(You need to adjust the names vmdk_file and vdi_file.)

2. Use qemu-img to convert the vdi to qcow2. Why qcow2? Because it supports snapshotting, which is very useful for reverting Whonix-Workstation ™ to a known clean state. You must not revert gateway snapshots of the gateway vm as that will change your guard nodes which is not good for anonymity. This would increase your chances of having a rogue guard node and exit.

qemu-img convert -p -O qcow2 ~/whonix.vdi ~/whonix.qcow2

System Requirements

• • • Lucid has been reported, not to work. Since it is only supported until 2013-04 it won't be fixed.

Mirror

| {{GrayBackground}}| [[File:SSL_Symbol.png|40px]] {{Anchor|signature}}
| <html><a href="https://jhcloos.com/whonix/{{project_name_short}}-</html>{{VersionNew}}<html>/{{gateway_product_name_short}}-</html>{{VersionNew}}<html>.ova" target="_blank">Download</a></html>
| <html><a href="https://jhcloos.com/whonix/{{project_name_short}}-</html>{{VersionNew}}<html>/{{workstation_product_name}}-</html>{{VersionNew}}<html>.ova" target="_blank">Download</a></html>
|{{Yes}} <ref name=anonymousdownload />
| style="background-color: {{Red}}"| Low <ref>[[Warning#Man-in-the-middle_attacks|Man-in-the-middle attacks]] could poison the download.</ref>
| style="background-color: {{Green}}"| High <ref name=openpgpverification>It does not matter if you did the bulk download over an insecure channel, if you use OpenPGP verification at the end.</ref>
|- style="height: 47px"

Magnet Link

| {{GrayBackground}}| [[File:Magnet_icon.svg.png|20px]] <ref>Magnet link clients known to work: gtk-gnutella. Check this [https://en.wikipedia.org/wiki/Magnet_URI_scheme#Clients_table clients table]. If nobody is [http://wiki.answers.com/Q/What_are_seeders_and_leechers seeding] at the time, only clients with the [https://en.wikipedia.org/wiki/Magnet_URI_scheme#Normal_.28as.29 "as"] feature can be used, because we are providing a [https://en.wikipedia.org/wiki/BitTorrent#Web_seeding webseed].</ref>
| <html><a href="magnet:?xt=urn:btih:b8969f87015c994f2c4dd93b3ed7c62861c27477&dn={{gateway_product_name_short}}-8.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2F{{gateway_product_name_short}}-8.ova">Magnet Link</a></html>
| <html><a href="magnet:?xt=urn:btih:7a6a5294ebebef5e5edcb05aa2caf66ebaeaf300&dn={{workstation_product_name}}-8.ova&tr=http%3A%2F%2Fannounce.torrentsmd.com%3A6969%2Fannounce&as=http%3A%2F%2Fwebseed.whonix.org%3A8008%2F{{workstation_product_name}}-8.ova">Magnet Link</a></html>
|{{No}}
| style="background-color: {{Yellow}}"| Medium <ref name=atleastssl />
| style="background-color: {{Green}}"| High <ref name=openpgpverification />
|- style="height: 47px"

Download / Snapshot

• Take a snapshot for both Whonix-Gateway ™ and Whonix-Workstation ™ on VirtualBox. So you can easily restore the original snapshot whenever you need a clean state.

Mediawiki Install

Get and install the mediawiki web app.

sudo su
cd /var/www
wget http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.3.tar.gz
tar -xvzf mediawiki-1.22.3.tar.gz
mv mediawiki-1.22.3 wiki

Start iceweasel.

Setup mediawiki. Go to http://127.0.0.1/wiki/mw-config/index.php ^[archive].

Use the following settings.

Database name: wiki
Datebase password: what you remembered above
No more questions.
Otherwise use the defaults.
Name of wiki:
Whonix

Download LocalSettings.php, safe as /home/user/LocalSettings.php.

Tor Browser Recommended

When you start Tor Browser Recommended, there is a shortcut on the desktop, see , it will open both Whonix ™ News Blogs in a privacy friendly way.

I2P

Clock Skew Issues

Whonix ™ 9:
Should have no issues.

In Whonix ™ 8:
I2P-0.9.11 this doesn't work - I2P complains about clock skews even after disabling both sdwdate and bootclockrandomization.

sudo service sdwdate stop
sudo chmod -x /etc/init.d/sdwdate

It is still possible to fix the clock manually. For example, if I2P reports a clock skew of 60 seconds at startup, use this command to change system time:

sudo date -s now-60sec

then restart I2P.

However, time sync management in Whonix ™ is a complex issue, so before changing the default way of time management in Whonix ™, make sure to read Dev/TimeSync and understand the implications.

old known issues

gpg keyserver unreachable

Open gpg.conf.

kwrite ~/.gnupg/gpg.conf

Search for all instances of "keyserver". And comment them out, i.e.

#keyserver ...

Add a functional keyerver at the bottom. In Whonix ™ 9 we will be using the following one as default.

keyserver hkp://qdigse2yzvuglcix.onion

libtorsocks Warning

During running apt-get dist-upgrade, you may see a warning similar to the following one.

15:36:37 libtorsocks(12225): sendmsg: Connection is a UDP or ICMP stream, may be a DNS request or other form of leak: rejecting.
Cannot talk to rtnetlink: No such file or directory
acpid: error talking to the kernel via netlink

Sounds scary, but is of no concern. See footnote for technical explanation.

No Network after Upgrade to Whonix ™ 12

If whonixcheck fails with "tor.pid does not exist" after upgrade from Whonix ™ 11 to Whonix ™ 12...

On your Whonix-Gateway ™. And on your Whonix-Workstation ™.

Make sure /etc/network/interfaces looks like this.

# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

(The comments starting with # are actually not important. You can skip them if you wish.)

Open file /etc/network/interfaces in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security ^[archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/network/interfaces

sudoedit /etc/network/interfaces

Then make sure /etc/network/interfaces.d/30_non-qubes-whonix looks like this:

• Whonix-Gateway ™: https://github.com/Whonix/whonix-gw-network-conf/blob/master/etc/network/interfaces.d/30_non-qubes-whonix ^[archive]
• Whonix-Workstation ™: https://github.com/Whonix/whonix-ws-network-conf/blob/master/etc/network/interfaces.d/30_non-qubes-whonix ^[archive]

Forum discussion:
whonixcheck fail: tor.pid does not exist after upgrade from Whonix ™ 11 to Whonix ™ 12 ^[archive]

Upgrade from Testers repository

Whonix ™ testers-only repository contains a fix. If you like to volunteer as a tester, see Whonix-APT-Repository on how to enable it, so this change can move soon into Whonix ™ stable repository. After enabling it, upgrade.

VirtualBox spoof the initial virtual hardware clock offset

Moved back to Advanced_Security_Guide#Spoof_the_Initial_Virtual_Hardware_Clock_Offset.

Physical Isolation

Install Basic Packages

This step is only required up to and including Whonix ™ 8. Versions higher than Whonix ™ 8 do not require this manual step anymore.

Make sure you have all packages installed which are listed in the file grml_packages. You can do that using the following command.

sudo apt-get install $(grep -vE "^\s*#" grml_packages | tr "\n" " ")

Why was Whonix ™ 7 based on Debian Testing, not Debian Stable?

• Contains python-stem ^[archive], which is a Tor controller library. It is in use to ask for Tor's bootstrap status. This is required for whonixcheck (diagnosing connection issues) and TimeSync (TimeSync starts as soon as Tor is bootstrapped). See this ticket ^[archive] for more details. The alternative, uploading python-stem to Whonix ™ APT Repository is not doable given Whonix ™ contributor size. (It would require keeping up with the original package and updating when they update. And implementing the feature, allowing builders to build Whonix ™ from source code without touching Whonix ™ APT repository for Trust reasons would also have been more difficult.)
• Being based on stable and incorporating a few packages from testing is difficult, see this ticket ^[archive] for details.
• Contains build dependency config-package-dev ^[archive] with debhelper support. (We could probably build on stable and just get the config-package-dev with debhelper support elsewhere, but it is simpler just to require Debian testing as build operating system.
• Stable (Wheezy) contains only obfs2 (obfsproxy 0.1.4 ^[archive]), while Testing (Jessie) contains obfs3 (obfsproxy 0.2.3 ^[archive]), and obfsproxy has been recently removed from torproject's apt repository.

Whonix ™ 9 OLD Issues

KEYEXPIRED Error

You might see this error when attempting to update existing Whonix ™ versions (build version 9.4 and below.)

W: GPG error: http://sourceforge.net wheezy Release: The following signatures were invalid: KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449659 KEYEXPIRED 1421449659 KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449659 KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449064 KEYEXPIRED 1421449659

To fix this issue, open a terminal

fpr="916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA"
gpg --recv-keys "$fpr"
gpg --fingerprint "$fpr" 
gpg --export "$fpr" | sudo apt-key add -

Then update your system as usual.

After that you will be able to update Tor Browser as well.

It will be fixed out of the box in Whonix ™ 9.6 and above.

Forum support thread:
https://forums.whonix.org/t/issue-t100-error-signatures-were-invalid-keyexpired-1421449064/810 ^[archive]

Tor Browser Startup Issues

This has been fixed out of the box in Whonix ™ 9.3 and above.

After the upgrade to Tor Browser 4.x, it can be no longer started.

Whonix ™ stable repository contains a fix. Upgrade. After upgrading, reboot is required.

Forum discussion:
https://forums.whonix.org/t/after-updating-to-tor-browser-4-0-browser-doesnt-start/599 ^[archive]

Connection Issues - Tor stops working after an Upgrade and needs a Workaround

This is fixed in Whonix ™ 9.2 ^[archive] above.

In Whonix ™ 9... When upgrading to Tor 0.2.5.8-rc-1~d70.wheezy+1 (using sudo apt-get dist-upgrade) in Whonix ™ 9, your Tor connection may go down. There is a workaround.

Open /etc/apparmor.d/local/system_tor.

## If you are using a graphical {{gateway_product_name}}, use:
kdesudo kate /etc/apparmor.d/local/system_tor

## Or alternatively, if you are using a terminal-only {{gateway_product_name}}, use:
sudoedit /etc/apparmor.d/local/system_tor

Scroll down until you see.

/usr/bin/obfsproxy rix,

Comment out (by adding a # in front of it).

#/usr/bin/obfsproxy rix,

Then reboot.

sudo reboot

You should keep that in mind. When Whonix ™ fixes that bug, you'll get an interactive dpkg conflict resolution dialog. This is explained in Security Guide#Updates. Just choose to install the new /etc/apparmor.d/local/system_tor file then.

Forum discussion:
https://forums.whonix.org/t/after-last-apt-get-upgrade-gateway-doesnt-connect-to-tor-anymore/532 ^[archive]

AppArmor Warning during Boot

If you wonder during boot about following warning.

Warning /etc/apparmor.d/... network rules not enforced.

This is not a security issue. Whonix ™ installs AppArmor and the apparmor-profiles ^[archive] package by default, but does not enforce AppArmor by default. We are not there yet and Debian also does not enforce AppArmor by default yet either. The apparmor-profiles package gets installed by default for better usability, to make enforcing AppArmor easier. This warning only reflects, that the profile is not enforced by default.

Forum discussion dovecot:
https://forums.whonix.org/t/apparmor-errors-functional-/628 ^[archive]

Debian bug report:
please provide an option to hide or deactivate all the noisy, scary warnings during boot ^[archive]

VirtualBox Guest Additions

New Instructions for Debian Wheezy

Installation from Debian apt repository

Inside your VirtualBox virtual machine.

Very simple.

Searching for Debian packages containing VirtualBox was a wise thing. In past it was sometimes a real pain to install the guest additions. The search brought up, that honorable people created a debian package with the tools.

1. Update your operating system.

2. Install. Easy:

sudo apt-get install virtualbox-guest-x11

Advanced security? See footnote or skip:

3. Reboot.

4. NOTE: Sometimes after reboot the Workstation guest fails to pick up a new resolution. Try to change the screen resolution manually a few times, from KDE settings. Once it succeeds to change to fullscreen, the change will stay persistent across reboots.

Installing using VirtualBox Instructions

Alternatively, above #Installation from Debian apt repository fails, which should not, you could also refer to the upstream documentation, VirtualBox: Chapter 4. Guest Additions ^[archive].

Instructions for Debian Jessie

Whonix ™ 10 is based on Debian Wheezy. So unless you are using a Whonix-Custom-Workstation ™ based on Debian Jessie, you most likely want to use above instructions. Otherwise press expand on the right side.

Not sure if the jessie instructions are still up to date. Maybe the ones for wheezy also work for jessie just fine.

Inside your VirtualBox virtual machine.

This version is difficult to get working with guest additions and vbox shares. Debian Jessie has the issue that Whonix ™ installs with Kernel 3.10 and the distro is at 3.12, and the 3.10 headers are not available. Therefore, it is dangerous (and unsafe) to get the Kernel headers on a different repository. Additionally, there are reports that updating the kernel can cause issues (and is also unsafe).

Noteː It has been reported that reverting Virtualbox 2 versions back with 3.10 can also solve issues. Update this wiki with your results.

Build Warnings

• Short: Don't install apt-listchanges as custom package during VM image builds or don't have it installed during --target root builds.

Long: Because likely might change the build process from a non-interactive one to an interactive one. You're better off purging apt-listchanges.

sudo apt-get purge apt-listchanges

Alternatively, you could use a non-interactive frontend for apt-listchanges such as text. To do so, you would have to edit /etc/apt/listchanges.conf.

sudoedit /etc/apt/listchanges.conf

[apt]
frontend=text

After Whonix ™ has been build, you're free to reinstall apt-listchanges.

Tor Browser

Change/Remove Proxy Settings

This is an advanced topic. You most likely only need it for advanced tunneling scenarios.

You could either:

• Use Tor Button's -> Preferences to set it to any other proxy or no proxy. Transparent Torification means, "no proxy" or in other words it means "use whatever the system provides".

1) Click on Tor Button.
2) Click on Preferences.

3) Choose Transparent Torification.

4) Click OK.

• For an alternative method, setting Transparent Torification which does not involve Tor Button's graphical user interface, see footnote .
• Forget about Tor Button's -> Open Network Settings. See footnote, if you want to know why.

Grub Fix

Introduction

The following instructions differ for 686-pae and 486 kernel users.

Are you are 686-pae kernel kernel or 486 kernel user?

• If you previously did not choose any options right after starting Whonix ™ in the grub boot menu, if you don't know what this is about, then you're very likely a 686-pae Kernel User.
• If you are used to picking the 486 kernel as per page Starting Whonix ™, chapter Boot Options, then you already know, that you're a 486 Kernel User.

686-pae Kernel Users

Remove the 486 and 586 kernel meta packages.

sudo apt-get remove linux-image-*-486 linux-image-*-586

Remove the 486 and 586 kernel packages.

sudo apt-get remove linux-image-3.*-486 linux-image-3.*-586

Make sure a kernel is installed.

sudo apt-get install linux-image-686-pae

Proceed with #Install Grub chapter!

486 Kernel Users

Remove the 686-pae kernel meta packages.

sudo apt-get remove linux-image-686-pae

Remove the 686-pae kernel packages.

sudo apt-get remove linux-image-3.*-686-pae

Make sure a kernel is installed.

sudo apt-get install linux-image-486

Proceed with #Install Grub chapter!

Stream Isolation

Limited workarounds for Tor Browser

Possible

1. Weakest: On Tor Browser, click on the Torbutton and then click on "New Identity". However your current browser session will be lost.

2. Better: Install a second browser and configure it to use its own SocksPort, see Tor_Browser#More_than_one_Tor_Browser_in_Whonix ™More than one Tor Browser in Whonix ™.

3. Even better: Use multiple Whonix-Workstation.

IsolateDestAddr and IsolateDestPort for Tor Browser (Recommended against!)

(Recommended against!) If you are interested anyway, see footnote .

Qubes

Torified dom0 Updates

Now in Qubes wiki.

Go to Qubes VM Manager -> System -> Global Settings. See the UpdateVM setting. Choose your desired Whonix-Gateway ™ ProxyVM from the list. For example: sys-whonix.

Qubes VM Manager -> System -> Global Settings -> UpdateVM -> sys-whonix

Qubes-Whonix ™ Gnome Workstation

OR, to install Workstation with complete Gnome applications that are installed in Qubes Fedora templates:
For Gnome, read security notes on Other Desktop Environments.

• Input command:
  sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-ws-gnome

2. Increase Update Size

The Gnome version of the Whonix-Workstation ™ TemplateVM may be too large and will you need to increase the allowed update size to accommodate installing it.

In Dom0 -> Terminal:

• Input command:
  export UPDATES_MAX_BYTES=$[ 4 * 1024 ** 3 ]

AppArmor

At the moment, if you want to use this, you must apply these settings to the TemplateVMs as well as the TemplateBasedVMs. Once Qubes Q3 gets released, TemplateBasedVMs will inherit the kernelopts setting of their TemplateVM. ^[archive]

Edit Firewall Rules

2. Edit Whonix-Workstation ™ Firewall Rules

In Dom0 » Qubes VM Manager:

• Select Whonix-Workstation ™ AppVM:
  • Edit VM firewall rules:
    • Select: Deny network access except...
    • Disable: Allow ICMP traffic
    • Disable: Allow DNS queries
    • Disable: Allow connections to Updates Proxy
    • Press: OK

Misc

This guide will create a new instance of a Whonix-Gateway ™ ProxyVM, which routes all internet traffic through Tor, that you can then connect your Whonix-Workstation ™ AppVMs to.

You can repeat this guide multiple times and create as many Whonix-Gateway ™ ProxyVM instances as you need, for greater Tor isolation. Note that using multiple Whonix-Gateway ™ ProxyVMs simultaneously will reveal a pattern of connecting to multiple sets of Tor guard nodes, which may or may not be a unique usage indicator.

This guide will create a new instance of a Whonix-Workstation ™ AppVM, which serves as an AnonVM application environment, that you connect to Tor through a Whonix-Gateway ™ ProxyVM of yours.

You can repeat this guide multiple times and create as many Whonix-Workstation ™ AppVM instances as you need, for greater Tor and data isolation. You can connect multiple Whonix-Workstation ™ AppVMs to the same or different instances of Whonix-Gateway ™ ProxyVMs.

If connecting this AppVM to the internet, you will need an existing Whonix-Gateway ™ ProxyVM instance to connect to. You may need to create a Whonix-Gateway ™ ProxyVM before proceeding.

If you wish to keep your version of Whonix ™ up-to-date you should also enable the Whonix ™ Repository. You should apply this process to all of your Whonix ™ TemplateVMs. In otherwords, make sure you follow these directions for both your Whonix-Gateway ™ (commonly called whonix-gw) and Whonix-Workstation ™ (commonly called whonix-ws).

When running the Whonix ™, Whonixcheck will automatically tell you if Debian package updates are available (Debian is the version of Linux that Whonix ™ is built upon).

3. Enable Whonix ™ repository

When first running a Whonix ™ TemplateVM, a window called "Whonix ™ Setup Wizard" should automatically pop up.

In Whonix ™ Setup Wizard:

* Select "Yes. Automatically install updates from the {{project name}} team"
* Click <Next>
* Choose which {{project name}} Repository (recommended: {{project name}} Stable Repository)
* Click <Next> 
* Click <Finish>

To Manually Restart Whonix ™ Repository Tool

You may also manually start the Whonix ™ Repository Tool to change your settings in the future by doing the following from your respective Whonix ™ TemplateVMs (i.e. Whonix-Workstation ™, Whonix-Gateway ™, etc.)

In a terminal:

sudo whonix_repository

Or by running:

Start Menu -> Applications -> System -> {{project name}} Repository.

You may need to first create a Whonix-Gateway ™ ProxyVM to use, if one does not exist yet.

Note: If you are installing Whonix ™ on top of Qubes OS, you do not need to worry about disabling ICMP timestamps at this stage. You will do that after you install the Whonix-Gateway ™ and Whonix-Workstation ™ TemplateVMs when you create your Whonix ™ VMs (done through the Qubes VM Manger). For more information on this, refer to the links provided under the Next Steps section (point's a and b) in the Install Guide for installing Whonix ™ onto Qubes.

Whonix ™ 10 TemplateVM Update

With the advent of Whonix ™ 11, the update guide for Whonix ™ 10 is now deprecated If you are still using Whonix ™ 10, you are advised to install Whonix ™ 11 If you are still interested in updating Whonix ™ 10, click on Expand on the right.

This guide explains how to update your Whonix ™ TemplateVMs using the update repositories.

You should regularly apply this update process to all of your Whonix-Gateway ™ and Whonix-Workstation ™ TemplateVMs.

1. Attach Whonix ™ TemplateVM to a Whonix-Gateway ™ ProxyVM (commonly called sys-whonix)

You may need to first create a Whonix-Gateway ™ ProxyVM to use, if one does not exist yet.

In Dom0 » Qubes VM Manager:

• Select Whonix ™ TemplateVM » VM Settings » Basic tab » NetVM:
  • Choose an existing Whonix-Gateway ™ ProxyVM from the NetVM list for downloading updates.

2. Start Whonix ™ TemplateVM

In Dom0 » Qubes VM Manager:

• Select Whonix ™ TemplateVM:
  • Start selected VM

3. Launch TemplateVM Terminal

In Dom0 » Application Launcher Menu:

• For your Whonix ™ TemplateVM's launcher menu, click on the "Terminal" app to launch it.

4. Enable Whonix ™ Repository

Qubes and Debian updates install by default. If you would also like to install Whonix ™ updates this way, then ensure you have the Whonix ™ repository enabled -- (or disabled if you prefer). This setting will remain in your TemplateVM for later. On first run of template you will be presented with the Whonix ™ repository options, but you may change them at any time.

In Whonix ™ TemplateVM » Terminal:

• Input command: sudo whonix-setup-wizard repository
  • Choose: Yes. Automatically install updates from the Whonix ™ team.
  • Press: OK
  • Choose: Whonix ™ Stable Repository (unless you are a tester or developer and understand what you are doing).
  • Press: OK

5. Check and Install Updates

In Whonix ™ TemplateVM » Terminal:

• Input command: sudo apt-get update && sudo apt-get dist-upgrade -y

• OR, You can right click the Whonix ™ templateVM in Qubes Manager and select Update

6. Clear Terminal History

In Whonix ™ TemplateVM » Terminal:

• Input command: history -cw

7. Shutdown Whonix ™ TemplateVM

In Dom0 » Qubes VM Manager:

• Select Whonix ™ TemplateVM:
  • Shutdown selected VM

8. Restart/Update Whonix ™ VMs

If new updates were available and installed, you will need to either simply restart your running Whonix-Gateway ™ ProxyVMs and running Whonix-Workstation ™ AppVMs for them to be updated -- or alternatively apply this same update process again to your running VMs if not wanting to restart them right away.

qubes-release package

In dom0, upgrade qubes-release to Qubes' dom0 current testing repository.

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-release

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing qubes-release

Qubes R3.2 Only

In Qubes R3.2, users must manually update the TemplateVM setting for sys-whonix and anon-whonix:

1. Qubes VM Manager -> sys-whonix -> right click -> VM settings -> Template -> whonix-gw-15 -> OK
2. Qubes VM Manager -> anon-whonix -> right click -> VM settings -> Template -> whonix-ws-15 -> OK

Download the Whonix ™ Templates

Only the Qubes R3.2 version of Whonix ™ requires manual downloading of templates with qubes-dom0-update, which downloads Whonix ™ from Qubes' dom0 templates-community-testing repository.

• Reinstall see footnote:
• Testers see footnote:

Download Whonix-Gateway ™ (whonix-gw-15) TemplateVM.

sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-gw-15

sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-gw-15

Download Whonix-Workstation ™ (whonix-ws-15) TemplateVM.

sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-ws-15

sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-ws-15

Before installing

First you need to have the Qubes OS installed on your system. A helpful Installation Guide for Qubes OS 3.0 is found here ^[archive]

However, before installing Qubes OS on your system, after you have downloaded the Qubes ISO, make sure that you follow the Qubes OS security advice for verifying the signatures of the Qubes ISO found here ^[archive]

After you have Qubes OS up and running on your system, before you install Whonix ™ you must next

Read and apply the Pre-Installation Security Advice.

Enigmail / gpg / keyserver

Since enigmail just calls gpg. And since everything is torified in Whonix ™ anyway, and since gpg is stream isolated (by uwt wrapper) anyhow, there is no need for this setting in Whonix ™.

(Minor security notice: )

Source Code Verification Wheezy

git tag -v {{VersionNew}}-stable

git log --show-signature -1 "$(git rev-list --max-count 1 {{VersionNew}}-stable)"

Using Tor / Pluggable Transports from the Tor Browser Bundle

Untested!

Unfinished!

TODO:
Figure out and document below here how to use TBB as "system Tor" inside Whonix-Gateway ™. (ticket ^[archive])

Install the Tor Browser Updater by Whonix ™ developers (tb-updater).

sudo apt-get install --no-install-recommends tb-updater

sudo apt-get install --no-install-recommends tb-updater

Create a new home folder for user debian-tor.

sudo mkdir /home/user/debian-tor

sudo mkdir /home/user/debian-tor

Fix permissions.

sudo chown --recursive debian-tor:debian-tor /home/user/debian-tor

sudo chown --recursive debian-tor:debian-tor /home/user/debian-tor

Allow login as user debian-tor by modifying it is default shell false to /bin/bash.

sudo usermod debian-tor -s /bin/bash

sudo usermod debian-tor -s /bin/bash

Login as user debian-tor.

sudo su debian-tor

sudo su debian-tor

Change directory into /home/debian-tor. (Do not use ~. )

cd /home/debian-tor

cd /home/debian-tor

Download and install Tor Browser.

update-torbrowser

update-torbrowser

Security warning: Do not start Tor Browser on Whonix-Gateway ™ for any purpose other than configuring Tor. Use Whonix-Workstation ™ to browse the web using Tor Browser.

Apply Whonix ™ Tor config to TBB.

cp /usr/share/tor/tor-service-defaults-torrc /home/debian-tor/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults

cp /usr/share/tor/tor-service-defaults-torrc /home/debian-tor/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults

TODO for developers:

• Install tb-updater by default on Whonix-Gateway ™?
• Install Tor Browser by default on Whonix-Gateway ™?

mv /home/debian-tor/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults /home/user/debian-tor

mv /home/debian-tor/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults /home/user/debian-tor

Eventual apparmor issues? Copy is better?

ln -s /usr/share/tor/tor-service-defaults-torrc /home/debian-tor/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults

ln -s /usr/share/tor/tor-service-defaults-torrc /home/debian-tor/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults

Future work:
Simplify this setup for users by installing this by default. Ticket: make TBB usable as "system Tor", so latest pluggable transports and the tor-launcher graphical user interface can be used in Whonix ™ ^[archive]

Footer

https ^[archive] | Mirror | Mirror |

Infrastructure

File Hosting

Files are still hosted on sourceforge.net.

Negative:

• No direct download links (hotlinking).
• No SSL.
• Advertisements.

Positive:

• Unlimited quota and traffic. (Although we should remove old releases from time to time ^[archive].)

Bug / Feature Request Tracker

Now hosted on github: https://github.com/Whonix/Whonix/issues ^[archive]

A bit suboptimal, since people have to create a second account just for github and it probably won't scale well enough in long term. Positive points are, that it works for many big projects such as Bitcoin and attracts a lot pull requests (for them). So let's see how that works.

Old Criteria and Plan for Web Hosting

Requirements for Good Hosting

Requirements

• Some webspace and sufficient traffic.
• Needs a wiki, a forum, a blog, a mailing list.
• We can either use free project hosting or own hosting.
• Tor friendly.
• No tracking scripts. (Google analytics etc.)
• Permit to sign up and to use the page exclusively over Tor.
• A wiki on that site (media wiki). (And spoilers.) (And flagged revisions.)
• A free SSL certificate.
• All parts off the website reachable over SSL without any warnings.
  • sourceforge.net does not offer that (SSL warnings).
  • startssl.com offers free SSL certificates. You simply have to prove, that you have control over the domain - but that's not possible with subdomains.
• Hosting and domain.
  • Censor resistant in sense of "Whonix ™ will not get deleted."
  • Free - if that is possible. No one is willing to pay and in the beginning there are no donations.
• We allow guest/anonymous postings (bug report, feedback, etc.) and moderate it very non-restrictive. (Allow any critique. Only delete off topic talk such as warez.)
  • It is still desired to have the less critical parts of the wiki open for guest edits.
  • Where no random trolls/crackers can modify anything important.
  • A wiki where guest edits are allowed only works when having a feature for Flagged revisions ^[archive] Sighted versions, where admins review changes and manually make the edited version the default visible page for everyone. To my knowledge, only mediawiki has such a feature.

Answered Questions

• Is there a free project hosting fulfilling all requirements?
  • Last time checked, no.

Links, that may be helpful

• Comparison of open source software hosting facilities ^[archive]

Ideal Hosting offers additionally...

• We better don't choose something based in non-free countries, such as US.
• Fully accessible by text mode browsers.
• Fully accessible without JavaScript.
• Optionally reachable by an onion service.

Reviewed Hosting Services

sourceforge.net

In past, all components of Whonix ™ were hosted on sourceforge.net. Whonix ™ still uses sourceforge.net as primary bulk file download service. Unfortunately, sourceforge does not provide direct download links (hotlinking).

The internal wiki, forum and the mailing list and download mirrors provided by sf.net provide unlimited traffic, which is very good.

The forum provided by sourceforge.net was not very well suited for Whonix ™. Most users are expected to post to the forums over Tor. sourceforge.net doesn't handle changing IP's very well. Registered users often had to post twice until their message got stored. And if they haven't stored their draft beforehand it was lost, which was really annoying. Positive points were, that the forum was viewable over SSL, but only for registered users. Let's say user's managed to successfully post a message, then it was still confusing because the message had to be manually moderated due to automatic spam scripts targeting Whonix ™ forum. Sourceforges wiki was unfortunately not viewable over SSL, which was very bad.

sf.net generally provides two different categories of hosting. Allura ^[archive] with "some" SSL, i.e. the wiki, forum, mailing list, download mirrors on the other hand project web ^[archive].

Project web (no SSL) has somewhat low limited traffic, but according to their support will be manually increased.

One of the major issues with sf.net is, that is does not support SSL everywhere. In past, the Contribute page contained a Vote chapter and one of the votes users are encouraged to, was Idea #721: Allow SSL for SourceForge pages whenever possible ^[archive]. Unfortunately, very few users voted.

A very strong point for sf.net is, that big files (virtual machine images) and unlimited traffic are allowed. Another strong one of course is, that sf.net allows Whonix ™ to be hosted on sf.net.

Sourceforge.net blocks users from "Cuba, Iran, North Korea, Sudan, Syria".

Other severe usability bugs:

• Improve Support for Tor Browser; option to disable IP check ^[archive]
• Prevent drafts from getting lost ^[archive]
• Long content pages broken ^[archive]

Google Code

• Google Code blocks users from "Cuba, Iran, North Korea, Sudan, Syria".
• No file downloads. ^[archive]

wikimedia / wikpedia

Last time we checked wikipedia (wikimedia) derivatives and wikia weren't Tor friendly.

savannah

• https://savannah.nongnu.org ^[archive] (with SSL) looked promising and they are expected to be gone soon or to do any other stupid stuff (banning countries etc.).
• They offer homepages, for example http://www.nongnu.org/qwe/ ^[archive] but seems like there are no subdomains (qwe.nongnu.org) with SSL (for nongnu.org). That's the minimum requirement.
• Support direct download links (hotlinking).
• Can't provide file hosting for Whonix ™, because it would cause too much traffic.

github

• Already using github as main git repository.
• github.com offers sub domains ^[archive], but they are not reachable over SSL.
• github triggers a ^[archive] scary ^[archive], error ^[archive] message. After either many pages trigger that error so it doesn't matter any more or until this message gets fixed in Tor Browser, we shouldn't use the github as issue tracker or website to avoid FUD. When that got somehow a non-problem, we could think about using github as issue tracker.
• How autocreate table of contents using markdown on github? But...
• Github also supports ^[archive] mediawiki syntax.
  • Seems it automatically creates a table of contents, good!
  • Bug: Mediawiki Pictures now shown in Github Wiki ^[archive], unless this bug gets fixed, we could think about using the github source code hosting as website, see example ^[archive].
  • We haven't found out yet how to use \[\[include ref=WikiHeader\]\] for github mediawiki pages. It is an important feature for Whonix ™ pages.
  • Looks like mediawiki support is just a gimmick. More advanced formatting like font size, syntax highlighting and so on doesn't work.
• No file hosting service.

gitorious

• Nice as a git mirror. In use ^[archive] as a git mirror.
• SSL for the whole page including the wiki.
• The wiki supports less features, no html (not that important) and no tables. The side bar takes too much space and leaves too less page for the wiki. The wiki is more suited for smaller documentation but not as a whole website replacement like Whonix ™ needs.
• No file hosting service.

self hosted onion service

• Adrelanos is not willing to do it.

free onion hosting service

• We could host a website on third party (free) onion service webspace service.
• Risky, because those services can go away any time without notice. - Looks like a valid risk, two just went down.
• Can they handle the load when we release a new version? Not talking about bandwidth. Just about page views.
• Clearnet users could only access them through onion.to and tor2web.
  • onion.to has a scary landing page.
  • tor2web does not yet appear in search engines ^[archive]

mirror.fsf.org

• http://mirror.fsf.org/ ^[archive]
• Providing direct download links (hotlinking).
• Probably it will not be possible. They have a quite firm policy (Guidelines for Free System Distributions ^[archive]) and if Debian didn't manage to fulfill it, surely Whonix ™ can't either.
• In theory, an option could be to base Whonix ™ on a distribution which is on their list already ^[archive], but that might not be doable for technical reasons. (Questions open up, such as: Are they in sync with Debian unstable? Are they in sync with Debian testing? How long does it take until they deploy updates from security.debian.org? How up to date are their packages? How are they different from Debian?)
• Whonix ™ contacted FSF to be their list. Thes declined, because Whonix ™ is not standalone. (Does not fulfill point "Complete Distros", since physical isolation users have to install Debian first.)

seul.org

• Sent registration request for seul.org. They don't accept new registrations, but Roger Dingledine (surprise, surprise) said in private mail, he's seeding Tails already and would volunteer to seed Whonix ™, if there was an announcement mailing list or if we mailed him new releases. Doing this.

Conclusion

In summary there where no open source hosting sites, which offer SSL everywhere and unlimited download of big files. An open source hosting facility providing free webspace and SSL everywhere would be much desirable, but doesn't exist.

Hosting Services to be reviewed

General Questions

• Download traffic?
• Quota?
• Direct download links (hotlinking) possible?
• Optional: SSL downloads?

Mirror Providers

There are a few lists

• http://sourceforge.net/apps/trac/sourceforge/wiki/Mirrors#MirrorProviders ^[archive]
• http://mirror.slitaz.org/mirrors ^[archive]
• http://www.freebsd.org/doc/handbook/mirrors-rsync.html ^[archive]
• http://www.debian.org/distrib/archive ^[archive]

of mirror providers. We could contact them and ask if there were willing to provide direct download links (hotlinking) (+SSL) for Whonix ™.

When they are able to sponsor sourceforge, in comparison, sponsoring Whonix ™ would be only peanuts to them. The question is, if they provide service for individual requests.

codeplex

• Seem to offer direct download links. Just stored some random download links to see how long the direct link is valid.
• https://kinectmultipoint.codeplex.com/downloads/get/692328 ^[archive]
• http://download-codeplex.sec.s-msft.com/Download/Release?ProjectName=kinectmultipoint&DownloadId=692328&FileTime=130174287196930000&Build=20602 ^[archive]

bitbucket

• Seem to offer direct download links. Just stored some random download links to see how long the direct link is valid.
• https://bitbucket.org/pypy/pypy/downloads ^[archive]
• http://cdn.bitbucket.org/pypy/pypy/downloads/pypy-2.1-beta1-arm-armhf-raspbian.tar.bz2 ^[archive]

autistici

https://vpn.autistici.org ^[archive] could be asked, if they were willing to act as webseed.

alioth

http://alioth.debian.org ^[archive] could be asked, if they accepted Whonix ™ as a new project, related enough to Debian, then they might be used as webseed.

Links, that may be helpful

• Comparison of open source software hosting facilities ^[archive]

Asked

• http://linux.psu.ru/ ^[archive] linux at psu.ru
  • November 2013: wants to test Whonix ™ for a few months and then decide

• November 2013: mirror.aarnet.edu.au
  • asked where their sourceforge folder is
  • and if they tell us: asked if we may use them as master mirror for other mirrors

• November 2013: mirrorservice.org
  • asked if we are allowed to directly download from them
  • asked if we may use them as master mirror for other mirrors

Answer:

We have no problem with you direct linking to us or you suggesting other
sites using us to mirror from (we offer rsync too).

But bear in mind that the data in that mirror is controlled by
SourceForge. They don't ship all files to all mirrors - each mirror
specifies how much data it can take, and they put stuff on up to that
limit based on popularity (presumably). Their delivery mechanism knows
which files are on which mirrors, so end users don't get pointed at a
mirror that doesn't contain the file they're after.

So it is possible that we may not have a complete copy of all your files,
and it may change in the future without any intervention from us.

If you're happy with that situation then go ahead and link to us.

Answer to follow up email:

We don't have any upload facilities I'm afraid. We only offer downloads.

One solution is to run a private rsync server yourselves that only
certain mirrors can access. It doesn't have to be that quick.

You may find other mirrors do offer an upload facility though.

• November 2013: switch.ch
  • asked for an upload account
  • asked for master rsync capabilities

Answer:

Dear Sir 

Thank you for your e-mail of 25th November 2013 regarding {{project_name}}. 

Sorry, we are not interested in your offer.

Forum Header

<center><b>Welcome to the new {{project name}} forums!</b></center>
<center><b>As part of the transition, everyone will have to reset their passwords, as they didn't come over in the transisition process. (<a href=https://forums.whonix.org/t/discourse-bug-report-thread/1612>forum thread</a>)</b></center>

Whonix ™ APT Repository URI Sourceforge

To use the sourceforge location uri rather than mirror.whonix.de uri, use the following command line switch. Example.

sudo whonix_repository --baseuri http://sourceforge.net/projects/whonixdevelopermetafiles/files/internal/ --repository testers --enable

sudo whonix_repository --baseuri http://sourceforge.net/projects/whonixdevelopermetafiles/files/internal/ --repository testers --enable

XChat

All HexChat plugins have been deactivated (hardening) and deactivated using dpkg-divert. To re-enable them, use one of the following commands depending on which plugin you need.

sudo dpkg-divert --rename --remove /usr/lib/xchat/plugins/python.so

sudo dpkg-divert --rename --remove /usr/lib/xchat/plugins/python.so

sudo dpkg-divert --rename --remove /usr/lib/xchat/plugins/tcl.so

sudo dpkg-divert --rename --remove /usr/lib/xchat/plugins/tcl.so

sudo dpkg-divert --rename --remove /usr/lib/xchat/plugins/perl.so

sudo dpkg-divert --rename --remove /usr/lib/xchat/plugins/perl.so

Those commands are reverted when Whonix ™ Debian Packages get updated. TODO: Document how to prevent that.

VPN sysvinit

sysvinit: (Legacy. Prefer the systemd method below.)

Repository Location URI

There are two repository location URI's.

• mirror.whonix.de
  • Default: yes.
  • Download speed: fast.
  • Agility: After uploading new packages, it takes ~1 hour until all mirrors on the mirror.whonix.de mirror system upgraded.
  • Target audience: most users.
• sourceforge
  • Default: no.
  • Download speed: slow.
  • Agility: After uploading new packages, packages are available almost instantly.
  • Target audience: developers, perhaps testers.

To use the whonix.org location uri rather than mirror.whonix.de uri, use the following command line switch. Example.

VPN DNS Configuration

Currently only manual.

Open file /etc/resolv.conf in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security ^[archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/resolv.conf

sudoedit /etc/resolv.conf

Comment out.

#nameserver 10.152.152.10

Add.

## Riseup.net OpenVPN DNS server
nameserver 172.27.100.1

If you are not using riseup, you need to replace 172.27.100.1 and enter the virtual LAN IP address of your VPN providers DNS server. You might be able to obtain it from your VPN provider. You can also try to infer it after successfully connecting to the VPN from running "sudo route". The first destination default gateway should function as DNS server also.

Save.

If you want to be sure, that /etc/resolv.conf does not get overwritten by other packages. (Such as DHCP or resolvconf.)

sudo chattr +i /etc/resolv.conf

sudo chattr +i /etc/resolv.conf

If you ever want to remove it, use -i.

(A more usable way is TODO research, help welcome. As possible starting point, see footnote. )

merged chroot-scripts

anon-shared-build-apt-sources-tpo

./packages/anon-shared-build-apt-sources-tpo/usr/lib/anon-dist/chroot-scripts-post.d/40_add_torprojects_key
./packages/anon-shared-build-apt-sources-tpo/usr/lib/anon-dist/chroot-scripts-post.d/50_update_tpo_package_list
./packages/anon-shared-build-apt-sources-tpo/usr/lib/anon-dist/chroot-scripts-post.d/60_install_deb.torproject.org-keyring

• Details: Adds The Tor Projects's (TPO) APT repository to Anonymity Linux Distributions during build. - Useful, because TPO's repository sometimes contains better/more recent versions of Tor, obfsproxy, torsocks, etc.
• Used by default in Whonix ™ build script: Yes.
• Negligible for Whonix ™ installations from repository: Not essential, but probably better not neglected.
• Convertible into postinst script: If you have any ideas? Running "apt-get update" to include TPO's repository while from within a maintainer script apt-get/dpkg is already running is not possible.
• package: https://github.com/Whonix/anon-shared-build-apt-sources-tpo ^[archive]
• script:
  • https://github.com/Whonix/anon-shared-build-apt-sources-tpo/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/40_add_torprojects_key ^[archive] (Converted to postinst script in Whonix ™ 13)
  • https://github.com/Whonix/anon-shared-build-apt-sources-tpo/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/50_update_tpo_package_list ^[archive]
  • https://github.com/Whonix/anon-shared-build-apt-sources-tpo/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/60_install_deb.torproject.org-keyring ^[archive]

anon-gw-build-upgrade-tor

./packages/anon-gw-build-upgrade-tor/usr/lib/anon-dist/chroot-scripts-post.d/70_update_tor_and_obfsproxy

• Details: Upgrading Tor on Anonymity Distributions from The Tor Project's APT repository, because that sometimes contains better/more recent versions of Tor.
• Used by default in Whonix ™ build script: Yes.
• Negligible for Whonix ™ installations from repository: Not essential, but probably better not neglected.
• Convertible into postinst script: If you have any ideas? Requires that the #anon-shared-build-apt-sources-tpo chroot-script has been already applied. Running "apt-get install" from a maintainer script while dpkg/apt-get is running is impossible.
• package: https://github.com/Whonix/anon-gw-build-upgrade-tor ^[archive]
• script: https://github.com/Whonix/anon-gw-build-upgrade-tor/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/70_update_tor_and_obfsproxy ^[archive]

anon-shared-build-upgrade-torsocks

./packages/anon-shared-build-upgrade-torsocks/usr/lib/anon-dist/chroot-scripts-post.d/70_update_torsocks

• Details: Upgrading torsocks on Anonymity Distributions from The Tor Projects repository because that sometimes contains better/more recent versions of torsocks (which is required for Stream Isolation and by uwt ^[archive].
• Used by default in Whonix ™ build script: Yes.
• Negligible for Whonix ™ installations from repository: Not essential, but probably better not neglected.
• Convertible into postinst script: Same situation as #anon-gw-build-upgrade-tor.
• package: https://github.com/Whonix/anon-shared-build-upgrade-torsocks ^[archive]
• script: https://github.com/Whonix/anon-shared-build-upgrade-torsocks/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/70_update_torsocks ^[archive]

anon-shared-build-ban-nonfree

./packages/anon-shared-build-ban-nonfree/usr/lib/anon-dist/chroot-scripts-post.d/75_vrms

• Details: Check for nonfree packages during build of Anonymity Distributions to make sure none are installed - for legal reasons.
• Used by default in Whonix ™ build script: Yes.
• Negligible for Whonix ™ installations from repository: Up to you.
• Convertible into postinst script: Probably not? For this script to have a chance of being effective, it must run after installation of all packages is done.
• package: https://github.com/Whonix/anon-shared-build-ban-nonfree ^[archive]
• script: https://github.com/Whonix/anon-shared-build-ban-nonfree/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/75_vrms ^[archive]

anon-shared-build-inst-tb

./packages/anon-shared-build-inst-tb/usr/lib/anon-dist/chroot-scripts-post.d/70_torbrowser

• Short description: installs Tor Browser during build
• Details: Installs Tor Browser in Anonymity Linux Distributions during build using tb-updater ^[archive]. (Only interesting for own custom builds that are not supposed to be redistributed.)
• Used by default in Whonix ™ build script: No. [Used by qubes-template-whonix ^[archive] by default: Yes.]
• Negligible for Whonix ™ installations from repository: Yes.
• Convertible into postinst script: Not required, because not used by default in Whonix ™ build script and because for legal reasons it is best if users download TBB themselves.
• package: https://github.com/Whonix/anon-shared-build-inst-tb ^[archive]
• script: https://github.com/Whonix/anon-shared-build-inst-tb/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/70_torbrowser ^[archive]

anon-shared-build-log-build-version

./packages/anon-shared-build-log-build-version/usr/lib/anon-dist/chroot-scripts-post.d/70_log_build_version

• Details: Logs build version during build. TODO: Why important.
• Used by default in Whonix ™ build script: Yes.
• Negligible for Whonix ™ installations from repository: Ideally, no.
• Convertible into postinst script:
• package: https://github.com/Whonix/anon-shared-build-log-build-version ^[archive]
• script: https://github.com/Whonix/anon-shared-build-log-build-version/blob/master/usr/lib/anon-dist/chroot-scripts-post.d/70_log_build_version ^[archive] (Deprecated in Whonix ™ 13. Replaced by anon-base-files postinst.)

flashproxy

Untested!
Might work. In short: just forget about it.

Flash Proxy Bridges. This has NOTHING to do with Adobe Flash.

If you would like to see the unfinished documentation, please press on expand on the right.

Should work in Whonix-Gateway ™ as well, but require some fiddling. See also Forum topic ^[archive].

1. Set up a Port Forwarding from your Router to your Computer

https://trac.torproject.org/projects/tor/wiki/FlashProxyHowto#Settingupportforwarding ^[archive]

2. Enable port forwarding from your host operating system to Whonix-Gateway ™. Enter this command in a terminal on the host.

Qubes:

TODO

part of the solution might be:
https://www.qubes-os.org/doc/qubes-firewall/#tocAnchor-1-1-5 ^[archive]

KVM:

TODO

VirtualBox:

VBoxManage modifyvm "Whonix-Gateway" --natpf1 "9000",tcp,127.0.0.1,9000,,9000

VBoxManage modifyvm "Whonix-Gateway" --natpf1 "9000",tcp,127.0.0.1,9000,,9000

3. Modify Whonix-Gateway ™ User Firewall Settings

Note: If no changes have yet been made to Whonix Firewall Settings, then the Whonix User Firewall Settings File /usr/local/etc/whonix_firewall.d/50_user.conf appears empty (because it does not exist). This is expected.

If using Qubes-Whonix ™, complete these steps.
In Whonix-Gateway ™ AppVM. Make sure folder /usr/local/etc/whonix_firewall.d exists.

sudo mkdir -p /usr/local/etc/whonix_firewall.d

sudo mkdir -p /usr/local/etc/whonix_firewall.d

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ AppVM (commonly called sys-whonix) → Whonix User Firewall Settings

If using a graphical Whonix-Gateway ™, complete these steps.

Start Menu → Applications → Settings → User Firewall Settings

If using a terminal-only Whonix-Gateway ™, complete these steps.

In Whonix-Gateway ™, open the whonix_firewall configuration file in an editor.

sudoedit /usr/local/etc/whonix_firewall.d/50_user.conf

sudoedit /usr/local/etc/whonix_firewall.d/50_user.conf

For more help, press on Expand on the right.

Note: This is for informational purposes only! Do not edit /etc/whonix_firewall.d/30_whonix_gateway_default.conf.

Note: The Whonix Global Firewall Settings File /etc/whonix_firewall.d/30_whonix_gateway_default.conf contains default settings and explanatory comments about their purpose. By default, the file is opened read-only and is not meant to be directly edited. Below, it is recommended to open the file without root rights. The file contains an explanatory comment on how to change firewall settings.

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration,
## which will override the defaults found here. When Whonix is updated, this
## file may be overwritten.

See also Whonix modular flexible .d style configuration folders.

To view the file, follow these instructions.

If using Qubes-Whonix ™, complete these steps.

Qubes App Launcher (blue/grey "Q") → Template: whonix-gw-15 → Whonix Global Firewall Settings

If using a graphical Whonix-Gateway ™, complete these steps.

Start Menu → Applications → Settings → Global Firewall Settings

If using a terminal-only Whonix-Gateway ™, complete these steps.

In Whonix-Gateway ™, open the whonix_firewall configuration file in an editor.

nano /etc/whonix_firewall.d/30_whonix_gateway_default.conf

nano /etc/whonix_firewall.d/30_whonix_gateway_default.conf

4. Add the following content.

GATEWAY_ALLOW_INCOMING_FLASHPROXY=1
FLASHPROXY_PORT=9000

GATEWAY_ALLOW_INCOMING_FLASHPROXY=1 FLASHPROXY_PORT=9000

5. Save.

6. Reload Whonix-Gateway ™ Firewall.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named sys-whonix) → Reload Whonix Firewall

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → System → Reload Whonix Firewall

If you are using a terminal-only Whonix-Gateway ™, run.

sudo whonix_firewall

sudo whonix_firewall

7. Install flashproxy.

sudo apt-get install flashproxy-client

sudo apt-get install flashproxy-client

8. Open /usr/local/etc/torrc.d/50_user.conf.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named sys-whonix) → Tor User Config (Torrc)

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → Settings → /usr/local/etc/torrc.d/50_user.conf

If you are using a terminal-only Whonix-Gateway ™, complete the following steps.

sudo nano /usr/local/etc/torrc.d/50_user.conf

sudo nano /usr/local/etc/torrc.d/50_user.conf

9. Add.

UseBridges 1

# The address and port are ignored by the client transport plugin.
Bridge flashproxy 0.0.1.0:1 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD
Bridge flashproxy 0.0.1.0:2 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD
Bridge flashproxy 0.0.1.0:3 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD
Bridge flashproxy 0.0.1.0:4 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD
Bridge flashproxy 0.0.1.0:5 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD

# Change the second number here (9000) to the number of a port that can
# receive connections from the Internet (the port for which you
# configured port forwarding).
ClientTransportPlugin flashproxy exec /usr/bin/flashproxy-client --register :0 :9000

UseBridges 1 # The address and port are ignored by the client transport plugin. Bridge flashproxy 0.0.1.0:1 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD Bridge flashproxy 0.0.1.0:2 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD Bridge flashproxy 0.0.1.0:3 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD Bridge flashproxy 0.0.1.0:4 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD Bridge flashproxy 0.0.1.0:5 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD # Change the second number here (9000) to the number of a port that can # receive connections from the Internet (the port for which you # configured port forwarding). ClientTransportPlugin flashproxy exec /usr/bin/flashproxy-client --register :0 :9000

10. Save.

11. Reload Tor.

After editing /usr/local/etc/torrc.d/50_user.conf, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named 'sys-whonix') → Reload Tor

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → Settings → Reload Tor

If you are using a terminal-only Whonix-Gateway ™, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo service tor@default reload

sudo service tor@default reload

Check Tor's daemon status.

sudo service tor@default status

sudo service tor@default status

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

12. Done.

scramblesuit

Quote intrigeri ^[archive] (Tails developer):

On tor-talk we've been told "You shouldn't prioritise ScrambleSuit because it is superseded by obfs4", and there are now pressing plans in the Tor Project to deprecate obfs2 and obfs3 in favour of obfs4. Hence rejecting this ticket, and focusing on #7980 ^[archive] [obfs4 support] instead.

Also see Tor Announcement under heading "obfs4 and scramblesuit" ^[archive]

ClientTransportPlugin obfs2,obfs3,scramblesuit exec /usr/bin/obfsproxy managed
Bridge scramblesuit 141.201.27.48:420 gliberish password=more-gliberish

ClientTransportPlugin obfs2,obfs3,scramblesuit exec /usr/bin/obfsproxy managed Bridge scramblesuit 141.201.27.48:420 gliberish password=more-gliberish

AppArmor issue. Probably not been reported anywhere yet.

audit: type=1400 audit(1439818522.818:9): apparmor="DENIED" operation="mkdir" profile="/usr/bin/obfsproxy" name="/var/lib/tor/pt_state/scramblesuit/" pid=11163 comm="obfsproxy" requested_mask="c" denied_mask="c" fsuid=106 ouid=106

Bridges

obfs3

Example of using obfs3 bridges: You cannot use the example bridge 141.201.27.48:420 below, because it is only an example. You still need to find your own bridges as explained in the section above, titled Finding a bridge and choosing the right protocol.

UseBridges 1
ClientTransportPlugin obfs2,obfs3 exec /usr/bin/obfsproxy managed
bridge obfs3 141.201.27.48:420 4352e58420e68f5e40bf7c74faddccd9d1349413

UseBridges 1 ClientTransportPlugin obfs2,obfs3 exec /usr/bin/obfsproxy managed bridge obfs3 141.201.27.48:420 4352e58420e68f5e40bf7c74faddccd9d1349413

obfs4

Example using obfs4 bridges.

You cannot use the example bridge 141.201.27.48:420 below, because it is only an example. You still need to find your own bridges as explained in the section above, titled Finding a bridge and choosing the right protocol.

UseBridges 1
ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed
bridge obfs4 161.217.177.95:10703 B3B8009D01BB7E5FDFAEC cert=4RaIqGiOytEXm6Hw iat-mode=0

UseBridges 1 ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy managed bridge obfs4 161.217.177.95:10703 B3B8009D01BB7E5FDFAEC cert=4RaIqGiOytEXm6Hw iat-mode=0

CVE-2016-1252

Deprecated/CVE-2016-1252

Dev/Mirrors

Original discussion: https://github.com/Whonix/Whonix/issues/96 ^[archive]

List of all mirrors.

dig mirror.whonix.de ANY +noall +answer

Test.

curl -H 'Host: mirror.whonix.de' -k http://109.230.212.53/whonixdevelopermetafiles/internal/news_v4/whonix_news.tar.xz.asc

curl -H 'Host: mirror.whonix.de' -k http://109.230.212.53/whonixdevelopermetafiles/internal/news_v4/whonix_news.tar.xz.asc

issues

• ssl support: https://phabricator.whonix.org/T145 ^[archive]
• onion support
• lag until global dns is updated (when mirrors [temporarily] do not work)
• lag after uploading files
• cannot have any kind of download statistics
• mirrors are less trusted than whonix.org server

Moving away from mirror network to whonix.org:
https://www.whonix.org/blog/upcoming-usability ^[archive]

Firejail

3. Optional - edit janondisttorbrowser.desktop in an editor with root rights.

Open file /usr/share/applications/janondisttorbrowser.desktop in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security ^[archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /usr/share/applications/janondisttorbrowser.desktop

sudoedit /usr/share/applications/janondisttorbrowser.desktop

4. Optional - prepend the Exec= line with "firejail"

   Exec=firejail torbrowser %u

Save and exit.

Note:

3. Optional - edit firefox-esr.desktop in an editor with root rights:

Open file /usr/share/applications/firefox-esr.desktop in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security ^[archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /usr/share/applications/firefox-esr.desktop

sudoedit /usr/share/applications/firefox-esr.desktop

4. Optional - prepend the Exec= line with "firejail"

   Exec=firejail /usr/lib/firefox-esr/firefox-esr %u

Note: Instead of launching sand-boxed applications from the terminal, both Whonix ™ and Qubes-Whonix ™ users can edit the relevant .desktop file that launches a process and prepend the executable path with the firejail command. This process can be repeated with every .desktop application file if desired.

onionshare from git with Debian jessie

Developers only!

Preparation

You need newer control port filter / upgrade to Whonix ™ 14 developers-only. You get it by upgrading to Whonix ™ 14 developers-only.

Upgrade both Whonix-Gateway ™ and Whonix-Workstation ™ to Whonix ™ 14 developers-only. For instructions see: Upgrading_Whonix ™_13_to_Whonix ™_14

Or use Whonix ™ 13.0.0.1.4 developers-only from https://forums.whonix.org/t/whonix-13-0-0-1-4-developers-only/3486/3 ^[archive] or newer (if existing).

Configure Control Port Filter Proxy

On Whonix-Gateway ™.

Control Port Filter Proxy needs some adjustments.

sudo cp /usr/share/tor-controlport-filter-merger/examples/40_onionshare.yml /etc/tor-controlport-filter-merger.d/

sudo cp /usr/share/tor-controlport-filter-merger/examples/40_onionshare.yml /etc/tor-controlport-filter-merger.d/

Restart Control Port Filter Proxy.

sudo service tor-controlport-filter restart

sudo service tor-controlport-filter restart

Configure Whonix-Workstation ™ Firewall

Inside Whonix-Workstation ™.

Modify Whonix-Workstation ™ User Firewall Settings

Note: If no changes have yet been made to Whonix Firewall Settings, then the Whonix User Firewall Settings File /etc/whonix_firewall.d/50_user.conf appears empty (because it does not exist). This is expected.

If using Qubes-Whonix ™, complete these steps.
In Whonix-Workstation ™ AppVM. Make sure folder /usr/local/etc/whonix_firewall.d exists.

sudo mkdir -p /usr/local/etc/whonix_firewall.d

sudo mkdir -p /usr/local/etc/whonix_firewall.d

Qubes App Launcher (blue/grey "Q") → Whonix-Workstation ™ AppVM (commonly called anon-whonix) → Whonix User Firewall Settings

If using a graphical Whonix-Workstation ™, complete these steps.

Start Menu → Applications → System → User Firewall Settings

If using a terminal-only Whonix-Workstation ™, complete these steps.

Open /usr/local/etc/whonix_firewall.d/50_user.conf with root rights.

sudoedit /usr/local/etc/whonix_firewall.d/50_user.conf

sudoedit /usr/local/etc/whonix_firewall.d/50_user.conf

For more help, press on Expand on the right.

Note: This is for informational purposes only! Do not edit /etc/whonix_firewall.d/30_whonix_workstation_default.conf.

The Whonix Global Firewall Settings File /etc/whonix_firewall.d/30_whonix_workstation_default.conf contains default settings and explanatory comments about their purpose. By default, the file is opened read-only and is not meant to be directly edited. Below, it is recommended to open the file without root rights. The file contains an explanatory comment on how to change firewall settings.

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration,
## which will override the defaults found here. When Whonix is updated, this
## file may be overwritten.

See also Whonix modular flexible .d style configuration folders.

To view the file, follow these instructions.

If using Qubes-Whonix ™, complete these steps.

Qubes App Launcher (blue/grey "Q") → Template: whonix-ws-15 → Whonix Global Firewall Settings

If using a graphical Whonix-Workstation ™, complete these steps.

Start Menu → Applications → Settings → Global Firewall Settings

If using a terminal-only Whonix-Workstation ™, complete these steps.

In Whonix-Workstation ™, open the whonix_firewall configuration file in an editor.

nano /etc/whonix_firewall.d/30_whonix_workstation_default.conf

nano /etc/whonix_firewall.d/30_whonix_workstation_default.conf

Add.

EXTERNAL_OPEN_PORTS+=" $(seq 17600 17659) "

EXTERNAL_OPEN_PORTS+=" $(seq 17600 17659) "

Save.

Reload Whonix-Workstation ™ Firewall.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Workstation ™ AppVM (commonly named anon-whonix) → Reload Whonix Firewall

If you are using a graphical Whonix-Workstation ™, complete the following steps.

Start Menu → Applications → System → Reload Whonix Firewall

If you are using a terminal-only Whonix-Workstation ™, run.

sudo whonix_firewall

sudo whonix_firewall

enable backports

Add Debian Jessie Backports to repos sources lists.

sudo su -c "echo -e 'deb http://http.debian.net/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list"

sudo su -c "echo -e 'deb http://http.debian.net/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list"

Install Dependencies

Update the package lists.

sudo apt-get update

sudo apt-get update

Install the dependencies from jessie-backports.

sudo apt-get install --no-install-recommends -t jessie-backports python3-stem python3-flask python3-pyqt5 python-nautilus

sudo apt-get install --no-install-recommends -t jessie-backports python3-stem python3-flask python3-pyqt5 python-nautilus

Install onionshare

You need to use onionshare 0.9.1 or above, because it has the required support for ephemeral Tor onion services. Install it from git.

git clone https://github.com/micahflee/onionshare.git

git clone https://github.com/micahflee/onionshare.git

Start onionshare - regular

cd onionshare

cd onionshare

cd dev_scripts

cd dev_scripts

./onionshare /usr/bin/nano

./onionshare /usr/bin/nano

Start onionshare - stealth

sudo su -c "echo -e 'deb http://http.debian.net/debian stretch main' > /etc/apt/sources.list.d/stretch.list"
sudo apt-get update
sudo apt-get install --no-install-recommends -t stretch python3-stem

sudo su -c "echo -e 'deb http://http.debian.net/debian stretch main' > /etc/apt/sources.list.d/stretch.list" sudo apt-get update sudo apt-get install --no-install-recommends -t stretch python3-stem

./onionshare --stealth /usr/bin/nano

./onionshare --stealth /usr/bin/nano

Hack to get onionshare with stealth Onion Services Support

Developers only.

#!/bin/bash

set -x
set -e

sudo su -c "echo -e 'deb http://http.debian.net/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list"

sudo su -c "echo -e 'deb http://http.debian.net/debian stretch main' > /etc/apt/sources.list.d/stretch.list"

sudo apt-get update

sudo apt-get install --yes --no-install-recommends -t jessie-backports python3-stem python3-flask python3-pyqt5 python-nautilus

sudo apt-get install --yes --no-install-recommends -t stretch python3-stem

## build dependencies
sudo apt-get install -y build-essential fakeroot python3-all python3-stdeb dh-python  python3-flask python3-stem python3-pyqt5 python-nautilus python3-nose

echo 'EXTERNAL_OPEN_PORTS+=" $(seq 17600 17659) "' | sudo tee /etc/whonix_firewall.d/50_user.conf

sudo whonix_firewall

cd onionshare

./install/build_deb.sh 

sudo dpkg -i deb_dist/onionshare_0.9.2-1_all.deb

true $?

Current Status

TODO

Forum discussion:
https://forums.whonix.org/t/feature-request-onionshare-support ^[archive]

Timesync

Hardware clock: Set to UTC. OpenSSL (used by Tor) leaks it, but that is of no concern. Tor is running on Linux and Linux is expected to be run in UTC. Therefore there is no point to set it to the local time zone of the user.

• • An adversary could guess if someone is running an onion service with constant clock adjustments, that it is hosted inside a Whonix-Workstation ™. It is unknown if the clock adjustments by sdwdate are big enough to enable an adversary to guess that.
    • TODO: Open question... "ntpd adjusts the clock in small steps so that the timescale is effectively continuous and without discontinuities" - is that possible with a sdwdate like approach as well? -> Working on sclockadj ^[archive].

• • Running sdwdate also every [ 1440 minutes + random(0-1440) ]. Not running this every hour at a random time, because Tor does not like clock jumps. [deprecated because sclockadj] When testing this, there were cases where the clock jumped about 800 seconds, which caused Tor to expire circuits, which caused connection interrupts.
  • TODO: Open question... How often should sdwdate run on Whonix-Gateway ™? Every hour is a bad idea, as we see above. Not running it again when some people may run Whonix-Gateway ™ for days or weeks is not good either, since the clock can drift. Maybe it should run wait 24 hours and then wait a random amount of minutes within 24 hours? -> Will be solved when sclockadj ^[archive] gets finished.

• • • The entry guard or bridge can see the time through TCP timestamp.
    • Continuous clock jumps could help the entry guard or bridge guessing, that a Whonix-Gateway ™ is connected.
    • TODO: Open question... "ntpd adjusts the clock in small steps so that the timescale is effectively continuous and without discontinuities" - is that possible with a sdwdate like approach as well? -> Will be solved when sclockadj ^[archive] gets finished.

• sdwdate is designed to be as secure as TLS (RFC 2246) but of course the security of TLS is often reduced to whichever CA racket you believe is trustworthy. By default, sdwdate uses curl that by default trusts your local CA root store - so when any of these companies assist in a MITM attack, malicious time information could be feed into your system.

Qubes-Whonix ™ Manual Installation

2. Install Whonix-Gateway ™ and Whonix-Workstation ™ TemplateVM

Write down this command inside the konsole , then hit "Enter".

sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-gw qubes-template-whonix-ws

sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-gw qubes-template-whonix-ws

3. Make sure inactive VMs are shown

Start Qubes VM Manager (QVMM).

In Qubes VM Manager, if you do not see whonix-… in the list, use the “View” menu to toggle the setting “Show/Hide inactive VMs”.

After finishing the download process , you should see whonix-ws and whonix-gw.

4. Enable AppArmor (optional, testers-only security enhancement) The following steps should be completed in dom0 for both whonix-gw-15 and whonix-ws-15 TemplateVMs. After these settings are applied to the Whonix ™ templates, the sys-whonix (ProxyVM) and anon-whonix (AppVM) will inherit the AppArmor kernel settings.

It is unnecessary to recreate the sys-whonix and anon-whonix TemplateBasedVMs to benefit from the new kernel parameters. It is also important to verify AppArmor is active in the sys-whonix and anon-whonix VMs after making these changes.

Whonix-Gateway ™

1. Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") → System Tools → Xfce Terminal

2. List the current kernel parameters.

qvm-prefs -g whonix-gw-15 kernelopts

qvm-prefs -g whonix-gw-15 kernelopts

Qubes R4 and later releases will show.

nopat

3. Keep the existing kernel parameters and add apparmor=1 security=apparmor.

For example.

qvm-prefs -s whonix-gw-15 kernelopts "nopat apparmor=1 security=apparmor"

qvm-prefs -s whonix-gw-15 kernelopts "nopat apparmor=1 security=apparmor"

qvm-prefs -s sys-whonix kernelopts "nopat apparmor=1 security=apparmor"

qvm-prefs -s sys-whonix kernelopts "nopat apparmor=1 security=apparmor"

4. List the current kernel parameters again (hit the up arrow key twice; it is unnecessary to type the command again).

qvm-prefs -g whonix-gw-15 kernelopts

qvm-prefs -g whonix-gw-15 kernelopts

The output should show AppArmor is part of the new kernel parameters. For example.

nopat apparmor=1 security=apparmor

5. Start the sys-whonix ProxyVM and confirm AppArmor is now active.

sudo aa-status --enabled ; echo $?

sudo aa-status --enabled ; echo $?

The output should show.

0

Whonix-Workstation ™

1. Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") → System Tools → Xfce Terminal

2. List the current kernel parameters.

qvm-prefs -g whonix-ws-15 kernelopts

qvm-prefs -g whonix-ws-15 kernelopts

Qubes R4 and later releases will show.

nopat

3. Keep the existing kernel parameters and add apparmor=1 security=apparmor.

For example.

qvm-prefs -s whonix-ws-15 kernelopts "nopat apparmor=1 security=apparmor"

qvm-prefs -s whonix-ws-15 kernelopts "nopat apparmor=1 security=apparmor"

qvm-prefs -s anon-whonix kernelopts "nopat apparmor=1 security=apparmor"

qvm-prefs -s anon-whonix kernelopts "nopat apparmor=1 security=apparmor"

4. List the current kernel parameters again (hit the up arrow key twice; it is unnecessary to type the command again).

qvm-prefs -g whonix-ws-15 kernelopts

qvm-prefs -g whonix-ws-15 kernelopts

The output should show AppArmor is part of the new kernel parameters. For example.

nopat apparmor=1 security=apparmor

5. Start the anon-whonix AppVM and confirm AppArmor is now active.

sudo aa-status --enabled ; echo $?

sudo aa-status --enabled ; echo $?

The output should show.

0

5. Create Whonix-Gateway ™ ProxyVM

Qubes VM Manager -> Create AppVM

Then change the settings as it shown below. (You can choose any name and color you like.)

6. Create Whonix-Workstation ™ AppVM

Qubes VM Manager -> Create AppVM

[[File:Create_Qubes-Whonix ™ Whonix-Workstation ™_AppVM2.png]]

7. TemplateVM proxy settings

a) Attach Whonix ™ TemplateVMs to a Whonix-Gateway ™ ProxyVM (commonly called sys-whonix)

Qubes VM Manager -> one left click on TemplateVM whonix-gw -> VM-Settings

NetVM: -> sys-whonix -> OK

b) Attach Whonix ™ TemplateVMs to a Whonix-Workstation ™ appVM (commonly called ws-whonix)

Qubes VM Manager -> one left click on TemplateVM whonix-ws -> VM-Settings

then

NetVM: -> sys-whonix -> OK

Why is KDE (big) the default desktop environment? Why not use a minimal DE?

This answer is outdated by now.

development discussion:
https://forums.whonix.org/t/updating-whonix-from-jessie-to-stretch-migration-to-gnome-shell-port-to-gnome-ish-applications ^[archive]

This was a difficult development path decision. Many people, including Patrick Schleizer, didn't like the old Openbox interface in TorBOX (deprecated project name) 0.1.3 because it was too inconvenient, non-intuitive, uncommon, difficult, etc. There is no rational unarguable choice for the best desktop.

MATE has not been chosen, because there are no packages in Debian repositories. GNOME2 is deprecated and only a fraction of GNOME2 users like GNOME3. Other desktops (LXDE, XFCE, Openbox) are less widespread, not so pretty, and in some opinions harder to use (even difficult to create a desktop shortcut), thus not attracting many users.

Choosing KDE is a personal preference by Whonix ™ developer Patrick Schleizer. KDE has one advantage, the only developer likes it and remains interested to maintain and develop Whonix ™ further.

You are free to uninstall KDE and install any other desktop environment of your own choice.

This is a non-ideal situation. Inspired by select your webbrowser ^[archive], it would be ideal if Whonix ™ would offer to choose which desktop to install but unfortunately, such a wizard does not exist yet ^[archive]. There are no development resources to implement such a solution. Help is welcome.

If there were contributors, we could maybe also include other desktop environments by default or offer alternative Whonix ™ builds with different default desktop environments or ideally implement a "choose your desktop" option after first boot of Whonix ™.

Please also read #Why are the Whonix ™ images so big? above, the same applies here.

See also Other Desktop Environments for workarounds/alternatives.

Tor Messenger

Installation instructions.

1. Navigate to https://trac.torproject.org/projects/tor/wiki/doc/TorMessenger#Downloads ^[archive] and download Tor Messenger and the associated (.asc) file signature. Store it in /home/user/.
2. Read http://expyuzz4wqqyqhjn.onion/docs/signing-keys.html ^[archive] to learn which PGP keys sign which packages.
3. Read http://expyuzz4wqqyqhjn.onion/docs/verifying-signatures.html ^[archive] and learn how to perform GPG verification. Download and import the necessary keys.
4. Verify the Tor Messenger download.
5. Navigate to /home/user/ with the file manger. Dolphin example: Dolphin → View → Show Hidden Files
6. If the old version of Tor Messenger is still open, close it.
7. Rename the old /home/user/tor-messenger_en-US to something else.
8. Extract Tor Messenger: Right-click on the downloaded archive → extract → extract archive here
9. The process is complete.
10. To start Tor Messenger:

• If intending to use a graphical user interface: Start Tor Messenger from the start menu.
• If intending to use a terminal, run the following command.

start-tor-messenger

start-tor-messenger

For usage instructions refer to this ^[archive] guide.

Usage of Tor Messenger in Whonix ™ should not differ from usage of Tor Messenger outside of Whonix ™. Already pre-configured for Stream Isolation, no manual settings changes required.

Forum discussion ^[archive]

Qubes-Whonix ™ Build

Build Qubes-Whonix ™ Templates - Old

make get-sources

./setup

override.conf

VERBOSE = 3
DEBUG = 1
REPO_PROXY = http://127.0.0.1:3142
CHECK_BRANCH = 1

BRANCH_template_whonix = master
GIT_URL_template_whonix = https://github.com/adrelanos/qubes-template-whonix.git

Again required?

./setup

make prepare-merge

Another time.

make prepare-merge

make qubes-vm

make templates --debug=v

Build Qubes-Whonix ™ Templates - New

Requires a Qubes Fedora TemplateBasedAppVM.

(Also possible in a Qubes Fedora template based StandaloneVM.)

Create developers-only images.

sudo dnf install git createrepo rpm-build rpm-sign make python-sh rpmdevtools rpm-sign dialog dpkg-dev debootstrap apt-cacher-ng

DISTS_VM="whonix-gateway whonix-workstation" \
COMPONENTS="linux-template-builder builder builder-debian template-whonix" \
BUILDER_PLUGINS="builder-debian template-whonix" \
USE_QUBES_REPO_VERSION=3.2 \
USE_QUBES_REPO_TESTING=1 \
VERBOSE=3 \
DEBUG=1 \
REPO_PROXY=http://127.0.0.1:3142 \
BRANCH_template_whonix=master \
GIT_URL_template_whonix=https://github.com/adrelanos/qubes-template-whonix.git \
make get-sources --debug=v

DISTS_VM="whonix-gateway whonix-workstation" \
COMPONENTS="linux-template-builder builder builder-debian template-whonix" \
BUILDER_PLUGINS="builder-debian template-whonix" \
USE_QUBES_REPO_VERSION=3.2 \
USE_QUBES_REPO_TESTING=1 \
VERBOSE=3 \
DEBUG=1 \
REPO_PROXY=http://127.0.0.1:3142 \
BRANCH_template_whonix=master \
GIT_URL_template_whonix=https://github.com/adrelanos/qubes-template-whonix.git \
make template --debug=v

Marek can build testers-only and stable Qubes-Whonix ™ images. See: https://github.com/QubesOS/qubes-issues/issues/2228 ^[archive]

Sandboxed Tor Browser

Introduction

The sandboxed Tor Browser is currently only available for 64-bit Linux users.

Testers only! There are unresolved issues which affect fingerprinting and security, and as of June 2018, a decision has been made to abandon the project.

#Tor Browser Hardened
The "hardened" Tor Browser has been deprecated and major features like Selfrando memory randomization are now part of the alpha series and planned for eventual mainline adoption. Consequently, The Tor Project recommends users seeking a higher security solution should default to the sandboxed Tor Browser:

While the Sandboxed Tor Browser is currently in an experimental state itself, we feel that it provides much better safeguards against exploitation than the features we shipped in the hardened series.

A sandbox is a secure environment for running Tor Browser which mitigates exploit vectors which would otherwise deanonymize the user or infect their computer. For instance, sandboxing reduces the opportunities for an attacker to easily identify real IP and MAC addresses, install malware, or browse user files. In simple terms, Tor Browser runs in a limited awareness container that is prevented from interacting with the rest of the user's computer. The spate of recent attacks on Tor Browser in the wild suggest this is a sensible approach for cautious users or those facing significant risks.

The Tor Browser sandbox is compatible with either the stable or alpha Tor Browser series, but it is incompatible with grsec kernels.

Sandboxing Effects on Tor Browser Functionality

Sandboxing improves security, but some functionality is lost inadvertently or by design. Also, some functions like sound must be optionally configured. In early 2018, broken items include:

• Foreign language support ^[archive].
• The meek pluggable transport ^[archive].
• Manual checks for Tor Browser updates ^[archive].

The Tor Browser sandbox is unlikely to ever support:

• The FTE pluggable transport.
• Hardware-accelerated 3D rendering due to the inherent hardware access risks.
• Printing, except to a file - this removes any risky network interface in the container.
• Connections outside of the Tor network.
• Compatibility of Tor Browser with a grsec kernel (due to ASAN/Pax conflicts).
• Installing or updating of add-ons - extensions are exposed as read-only files to Tor Browser running in a container.

Manual configuration changes are required for audio support and the Tor circuit display (already disabled in Whonix ™). Users are not recommended to enable sound, as this opens up potential attack vectors for advanced adversaries to read files from the filesystem.

Users are unable to install additional add-ons that are not bundled by default with Tor Browser. By design, fonts are limited to a minimal set that are bundled with Tor Browser, and plug-ins like Flash or Silverlight will not work.

Sandboxing Tor Browser in Whonix ™

Warning: These instructions are alpha and require a 64-bit version of Whonix ™ (Whonix ™ 14) to work. Testers or advanced users only!

Tor Browser Sandbox Dependencies

Two dependencies are required in order to install and run the sandbox in Whonix:

• Bubblewrap (>= 0.1.3) from Debian stretch.
• A newer (Whonix ™-14) version of the control-port-filter-python for Tor cookie control protocol authentication.

1. Boot Whonix-Workstation ™

Qubes-Whonix ™: boot the Whonix-Workstation ™ TemplateVM (whonix-ws).

2. Update the Package Lists and Install Bubblewrap

sudo apt-get update

sudo apt-get update

sudo apt-get install bubblewrap

sudo apt-get install bubblewrap

Note:

• golang is not needed unless manually building the sandbox from source.
• lib-seccomp dependencies are no longer required since v0.0.3 of the sandbox.
• Libnotify4 is already installed in the Whonix ™ 14 template.
• The Adwaita Gtk+-2.0 theme is not installed by default - advanced users can choose to optionally install it at this step as follows: sudo apt-get install gnome-themes-standard

Download Tor Browser Sandbox

1. Download the Sandbox Binary and Key File

For later releases, the Tor Project sandbox binaries and key files can be found here ^[archive].

In the Whonix-Workstation ™ (Qubes-Whonix ™: anon-whonix), open a terminal and run.

curl --remote-name http://rqef5a5mebgq46y5.onion/torbrowser/8.0a5/sandbox-0.0.16-linux64.zip

curl --remote-name http://rqef5a5mebgq46y5.onion/torbrowser/8.0a5/sandbox-0.0.16-linux64.zip

Download the signature file.

curl --remote-name http://rqef5a5mebgq46y5.onion/torbrowser/8.0a5/sandbox-0.0.16-linux64.zip.asc

curl --remote-name http://rqef5a5mebgq46y5.onion/torbrowser/8.0a5/sandbox-0.0.16-linux64.zip.asc

2. Download the Tor Project Signing Key and Verify the Zip File

In the terminal, run.

gpg --recv-keys "EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290"

gpg --recv-keys "EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290"

gpg --verify sandbox-0.0.16-linux64.zip.asc

gpg --verify sandbox-0.0.16-linux64.zip.asc

The output should show a good signature from the Tor developers and be similar to this.

gpg: Signature made Tue 24 Jan 2015 09:29:09 AM CET using RSA key ID D40814E0
gpg: Good signature from "Tor Browser Developers (signing key) "
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290

If a bad signature warning is received, delete the files, rotate the Tor circuits, and download them again.

3. Unzip the Sandbox

In the terminal, run.

unzip sandbox-0.0.16-linux64.zip

unzip sandbox-0.0.16-linux64.zip

Launch Sandboxed Tor Browser

To start the sandbox, open a terminal and run.

cd sandbox

cd sandbox

./sandboxed-tor-browser

./sandboxed-tor-browser

When prompted, select the preferred Tor Browser version to use in Whonix-Workstation ™. Both the stable and alpha Tor Browser releases have been tested to work in Whonix ™ 14. To check the sandboxed-tor-browser is correctly using the system Tor process run.

env

env

The output should show.

TOR_CONTROL_IPC_PATH=/var/run/anon-ws-disable-stacked-tor/127.0.0.1_9151.sock

Is set as an environment variable.

Important notes:

• sandboxed-tor-browser is also a Tor Browser downloader similar to tb-updater / torbrowser-launcher.
• Whonix ™ network settings are auto-detected as system Tor. There is no need to manually configure settings.
• 32-bit support has been deprecated since v0.0.2 of the sandbox.
• 64-bit only support since sandbox v0.0.3 means it is only compatible with Whonix ™ 14 and later releases.

Download the Whonix ™ Templates

Only the testers version of Whonix ™ requires manual downloading of templates with qubes-dom0-update, which downloads Whonix ™ from Qubes' dom0 templates-community-testing repository. Users who wish to reinstall the templates should add --action=reinstall.

Download Whonix-Gateway ™ (whonix-gw-15) TemplateVM.

sudo qubes-dom0-update --enablerepo=qubes-templates-community-testing qubes-template-whonix-gw-15

sudo qubes-dom0-update --enablerepo=qubes-templates-community-testing qubes-template-whonix-gw-15

Download Whonix-Workstation ™ (whonix-ws-15) TemplateVM.

sudo qubes-dom0-update --enablerepo=qubes-templates-community-testing qubes-template-whonix-ws-15

sudo qubes-dom0-update --enablerepo=qubes-templates-community-testing qubes-template-whonix-ws-15

Use Bridges in Whonix ™ 13

This section will explain how to use obfuscated bridges in Whonix ™ 13. Click the expand button for further instructions.

obfs2, obfs3 and obfs4 are the three bridge options available in Whonix ™ 13.

Tip: Until Whonix ™ 14 is released, no wizard is available to help set up bridges before connecting to Tor. The graphical tor-launcher (screenshots) that is associated with The Tor Project's Tor Browser cannot be used in Whonix ™.

To use Tor bridges in Whonix ™ 13, users must edit the /usr/local/etc/torrc.d/50_user.conf file in Whonix-Gateway ™ (sys-whonix).

Step 1: Access /usr/local/etc/torrc.d/50_user.conf to Add Bridges

Open /usr/local/etc/torrc.d/50_user.conf.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named sys-whonix) → Tor User Config (Torrc)

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → Settings → /usr/local/etc/torrc.d/50_user.conf

If you are using a terminal-only Whonix-Gateway ™, complete the following steps.

sudo nano /usr/local/etc/torrc.d/50_user.conf

sudo nano /usr/local/etc/torrc.d/50_user.conf

Step 2: Edit /usr/local/etc/torrc.d/50_user.conf

Open /usr/local/etc/torrc.d/50_user.conf in an editor, then copy and paste the following text to enable the use of obfs2, obfs3 and obfs4 bridges.

UseBridges 1
ClientTransportPlugin obfs2,obfs3,obfs4 exec /usr/bin/obfs4proxy

UseBridges 1 ClientTransportPlugin obfs2,obfs3,obfs4 exec /usr/bin/obfs4proxy

Now add the bridge IP addresses that were sourced in the Finding a Bridge and Choosing the Right Protocol section.

Copy and paste the IP addresses to the very bottom of /usr/local/etc/torrc.d/50_user.conf, after the ClientTransportPlugin entries. Users must ensure "bridge" appears at the beginning of each line.

In the obfs3 and obfs4 examples below:

• Do not copy and paste this list of bridge entries to the torrc file. They will not work.
• Users must retrieve obfs3 bridges ^[archive] or obfs4 bridges ^[archive] from The Tor Project before editing this file.
• Use either the obfs3 or obfs4 protocol, not both.
• Capitalization in the torrc file matters. For example, bridges will not connect if users type "Bridge" instead of "bridge".

Obfs3 example text to add to /usr/local/etc/torrc.d/50_user.conf.

bridge obfs3 109.195.132.77:22321 4352e58420e68f5e40bf7c74faddccd9d1349413
bridge obfs3 55.32.27.22:38123  4352e58420e68f5e40bf7c74faddccd9d1349413
bridge obfs3 192.24.131.513:62389 4352e58420e68f5e40bf7c74faddccd9d1349413

bridge obfs3 109.195.132.77:22321 4352e58420e68f5e40bf7c74faddccd9d1349413 bridge obfs3 55.32.27.22:38123 4352e58420e68f5e40bf7c74faddccd9d1349413 bridge obfs3 192.24.131.513:62389 4352e58420e68f5e40bf7c74faddccd9d1349413

Obfs4 example text to add to /usr/local/etc/torrc.d/50_user.conf.

bridge obfs4 192.235.207.85:42086 0EEB10BF4B4FAF56D46E cert=oue8sYYw5wi4n3mf2WDOg iat-mode=0
bridge obfs4 161.217.177.95:10703 B3B8009D01BB7E5FDFAEC cert=4RaIqGiOytEXm6Hw iat-mode=0

bridge obfs4 192.235.207.85:42086 0EEB10BF4B4FAF56D46E cert=oue8sYYw5wi4n3mf2WDOg iat-mode=0 bridge obfs4 161.217.177.95:10703 B3B8009D01BB7E5FDFAEC cert=4RaIqGiOytEXm6Hw iat-mode=0

After /usr/local/etc/torrc.d/50_user.conf editing is finished, save and exit.

<Ctrl-X> --> press Y --> <Enter>

The sample text for a complete obfs4 torrc file is below. Check your file is similar, except for the specific bridge entries.

# This file is part of Whonix
# Copyright (C) 2012 - 2013 adrelanos
p# See the file COPYING for copying conditions.

# Use this file for your user customizations.
# Please see /usr/local/etc/torrc.d/50_user.conf.examples for help, options, comments etc.

# Anything here will override {{project name}} own Tor config customizations in /usr/share/tor/tor-service-defaults-torrc

# Enable Tor through whonixsetup or manually uncomment "DisableNetwork 0" by
# removing the # in front of it.
DisableNetwork 0
UseBridges 1
ClientTransportPlugin obfs2,obfs3,obfs4 exec /usr/bin/obfs4proxy

bridge obfs4 192.235.207.85:42086 0EEB10BF4B4FAF56D46E cert=oue8sYYw5wi4n3mf2WDOg iat-mode=0
bridge obfs4 34.218.26.20:43263 DD21A551767816A0C9495 cert=7qzS6KASquPvJU82Fm7qoJw iat-mode=0
bridge obfs4 161.217.177.95:10703 B3B8009D01BB7E5FDFAEC cert=4RaIqGiOytEXm6Hw iat-mode=0

Step 3: Enable Tor

Follow this procedure if it has not been previously completed.

Enable Tor using Anon Connection Wizard (easiest option).

Start Anon Connection Wizard.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named sys-whonix) → Anon Connection Wizard

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → System → Anon Connection Wizard

If you are using a terminal Whonix-Gateway ™, type.

lxsudo anon-connection-wizard

lxsudo anon-connection-wizard

Choose the Enable Tor option. Press next.

Step 4: Have /usr/local/etc/torrc.d/50_user.conf Changes Take Effect

Reload Tor.

After editing /usr/local/etc/torrc.d/50_user.conf, Tor must be reloaded for changes to take effect.

Note: If Tor does not connect after completing all these steps, then a user mistake is the most likely explanation. Recheck /usr/local/etc/torrc.d/50_user.conf and repeat the steps outlined in the sections above. If Tor then connects successfully, all the necessary changes have been made.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway ™ ProxyVM (commonly named 'sys-whonix') → Reload Tor

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start Menu → Applications → Settings → Reload Tor

If you are using a terminal-only Whonix-Gateway ™, click HERE for instructions.

Complete the following steps.

Reload Tor.

sudo service tor@default reload

sudo service tor@default reload

Check Tor's daemon status.

sudo service tor@default status

sudo service tor@default status

It should include a a message saying.

Active: active (running) since ...

In case of issues, try the following debugging steps.

Check Tor's config.

sudo -u debian-tor tor --verify-config

sudo -u debian-tor tor --verify-config

The output should be similar to the following.

Sep 17 17:40:41.416 [notice] Read configuration file "/usr/local/etc/torrc.d/50_user.conf".
Configuration was valid

Permissions on directory /var/run/tor are too permissive Error

To discover if you are affected by the Permissions on directory /var/run/tor are too permissive error, run the following command inside Whonix-Gateway ™ (Qubes-Whonix ™: sys-whonix).

sudo cat /var/run/tor/log | grep -i permissive

If a user is affected, a warning similar to the following will appear.

Aug 03 17:36:33.000 [warn] Permissions on directory /var/run/tor are too permissive.

Currently there is only one workaround, which needs to be manually applied after every reboot.

sudo chmod --recursive 700 /var/run/tor

sudo chmod --recursive 700 /var/run/tor

Meta Package Missing Warning

The following warning...

It most likely happened after Whonix ™ 12 to Whonix ™ 13 upgrades. In that case, please upgrade using the proper instructions for Upgrading Whonix ™ 12 to Whonix ™ 13.

Unexpected timedatectl NTP Result

When sys-whonix launches in Qubes-Whonix ™ 13, a false positive warning appears stating:

ERROR: Systemd Clock Check Result: 
Unexpected results by timedatectl. 
timedatectl_output_pretty: 
Local time: Fri 2018-01-12 14:04:59 UTC
Universal time: Fri 2018-01-12 14:04:59 UTC
RTC time: Fri 2018-01-12 14:04:06
Time zone: Etc/UTC (UTC, +0000)
NTP enabled: yes 
NTP synchronized: no
RTC in local TZ: no
DST active: n/a
It is generally recommended to keep the default as per {{project name}} Design. [1] If you did not change timezone related settings, please report this {{project name}} bug. If you know what you are doing and changed this on purpose, feel free to disable this check. [2] 

[1] https://www.whonix.org/wiki/Dev/Design-Shared#timezone 
[2] Create a file /etc/whonix.d/50_whonixcheck_user and add: 
whonixcheck_skip_functions+=" check_systemd_clock "

Although NTP is enabled, it is inactive (dead) and does not pose any threat to anonymity. This problem has been rectified in the Whonix ™ 14 release ^[archive].

Translations Coordinator

The tasks of a Translations Coordinator ^[archive] include:

• Joining the Whonix ™ team on https://www.whonix.org ^[archive]
• Reading the translation extensions documentation for mediawiki.
• Getting new translators started.
• Perhaps translating text into your own native language.
• Coordinating translations.

This is a volunteer position.

Whonix ™ Warrant Canary

Some users may wonder why Whonix ™ does not maintain a warrant canary to warn the community of the potential existence of a secret subpoena like a number of other high-profile organizations, including Qubes OS ^[archive]. This decision has been taken for several reasons.

Firstly, a warrant canary is an imperfect mechanism since it does not provide definitive information. As Canary Watch ^[archive] notes:

Yet, in our time working with Canary Watch we have seen many canaries go away and come back, fail to be updated, or disappear altogether along with the website that was hosting it. Until the gag orders accompanying national security requests are struck down as unconstitutional, there is no way to know for certain whether a canary change is a true indicator. Instead the reader is forced to rely on speculation and circumstantial evidence to decide what the meaning of a missing or changed canary is.

The implication is that if the Whonix ™ team forgot to update the canary for innocuous reasons, this would cause a false alarm and lead to undue anxiety in the community. Similar effects could be expected if the wording changed slightly, if the canary changed location, or if it disappeared entirely before reemerging.

Another reason a warrant canary has not been introduced relates to free speech. Worried users argue that a National Security Letter (NSL) ^[archive] or similar authority might lead to:

• Vulnerabilities being forcibly introduced into code or during package upgrades.
• A backdoored binary version of Whonix ™ software.
• The forcible handing over of the private Whonix ™ signing keys.

These possibilities have been discussed in the following Whonix ™ Forum Thread ^[archive]. In general, it appears that since code has been legally established as speech, and free speech cannot be hindered, there is no legal basis to compel backdoors in either the source code or binary versions.

Finally, there is serious doubt about the actual effectiveness of any legal order that might be served on the Whonix ™ project. For instance, a NSL seeking "relevant information" related to national security investigations would yield little information because most visitors to the forums or wiki are using Tor already, and neither software is configured to log anything about these visits. In the case of hypothetical, malicious changes to source code, the existence of the code in the public domain already provides some protection against this threat, since it would likely be detectable.

Hosting a Whonix Mirror

The rest of this page is OUTDATED.

Please ignore this for now.

(Kept for historic purposes.)

Requirements

Running a Whonix ™ mirror can be immensely helpful, but it also takes some knowledge, proper configuration and adequate resources to be truly useful. The following are necessary:

• A server with a publicly accessible IP address. You might already have one of these, but lowendbox ^[archive] often has decent boxes at low prices. Look for those with higher bandwidth caps, as you will be serving a lot of data (~2 GB for a download of Workstation+Gateway for Whonix ™ 14). The load on your individual mirror will decrease as more mirrors are added. If you exceed the allocated bandwidth, then depending on the provider, additional charges may be incurred or the service could even be terminated; be careful and overestimate bandwidth requirements.
• SSH root access to that server (sudo is fine).
• Recommended: Debian buster ^[archive] as the operating system. Other distributions are possible, but this guide is written using stretch.

Install Apache

First, install Apache.

sudo apt-get install apache2

sudo apt-get install apache2

This will create the directory structure where we will put our mirrored copy of Whonix ™, as well as install Apache in order to serve the mirrored content.

Getting Whonix ™

Install rsync.

sudo apt-get install rsync

sudo apt-get install rsync

Then get Whonix ™ from the rsync master.

sudo rsync -rtvp --delete rsync://rsync.whonix.org/whonix /var/www/whonix

sudo rsync -rtvp --delete rsync://rsync.whonix.org/whonix /var/www/whonix

This will put the contents of http://rsync.whonix.org/ ^[archive] in your server's directory /var/www/whonix

Automating Updates from Master

To ensure your mirror is up-to-date whenever a new version of Whonix ™ is released, add an entry to the crontab to check for updates every hour.

sudo crontab -e

sudo crontab -e

In Debian stretch, crontab will be visible (open) in nano. Hit "Page Down" or the down cursor key until you are on the last line (below "m h dom mon dow command") and enter:

0 *   *   *   *    rsync -rtp --delete rsync://rsync.whonix.org/whonix /var/www/whonix

0 * * * * rsync -rtp --delete rsync://rsync.whonix.org/whonix /var/www/whonix

The numbers do not have to line up exactly with the heading, but this makes it easier to read.

Serving the Mirror Content

Paste the following text into /etc/apache2/sites-available/download.whonix.org.conf

#
#  download.whonix.org (/etc/apache2/sites-available/download.whonix.org.conf)
#
<VirtualHost *:80>
        ServerAdmin <YourContactEmail>EDIT THIS
        ServerName download.whonix.org
        DocumentRoot /var/www/whonix/
        # Logfile
        ErrorLog /var/log/apache2/whonix/error.log
</VirtualHost>

# # download.whonix.org (/etc/apache2/sites-available/download.whonix.org.conf) # <VirtualHost *:80> ServerAdmin <YourContactEmail>EDIT THIS ServerName download.whonix.org DocumentRoot /var/www/whonix/ # Logfile ErrorLog /var/log/apache2/whonix/error.log </VirtualHost>

Make the directory for the new logs.

sudo mkdir /var/log/apache2/whonix

sudo mkdir /var/log/apache2/whonix

After entering your contact email (it will throw errors otherwise), enable the site.

sudo a2ensite download.whonix.org.conf

sudo a2ensite download.whonix.org.conf

A prompt will appear to reload apache.

sudo service apache2 reload

sudo service apache2 reload

Stripping User IPs

While the config file above does not have an access log, user IPs can still be logged in error.log It is therefore recommended to install mod-removeip to make Apache "blind" to the IP addresses of users.

Install mod-removeip.

sudo apt-get install libapache2-mod-removeip

sudo apt-get install libapache2-mod-removeip

Activate it.

sudo a2enmod removeip

sudo a2enmod removeip

Reload Apache.

sudo service apache2 restart

sudo service apache2 restart

Test the Mirror

Replace 109.230.212.54 below with the IP of your server.

curl -H "Host: download.whonix.org" 109.230.212.54

curl -H "Host: download.whonix.org" 109.230.212.54

The output should appear similar to this.

<html>
<head><title>Index of /</title></head>
<body bgcolor="white">
<h1>Index of /</h1><hr><pre><a href="../">../</a>
<a href="9/">9/</a>                                                 10-Oct-2014 13:56                   -
<a href="9.2/">9.2/</a>                                               27-Sep-2014 12:46                   -
<a href="9.3/">9.3/</a>                                               18-Oct-2014 01:49                   -
<a href="WikiBackups/">WikiBackups/</a>                                       15-Apr-2014 01:17                   -
\</pre\><hr></body>
</html>

Getting the Mirror Added

Email the IP address of your new mirror to Patrick Schleizer, and you will be notified when it has been added to the rotation. Due to the way DNS propagates, it may take up to 24 hours before your system starts seeing traffic.

Thank you for your support!

Optional Customization

It is possible to customize the header and footer of your directory listing as explained here ^[archive]. Feel free to have something like "Mirror provided by <link to your blog or company>", but please do not go overboard. Mirrors with blatant banner ads or user-tracking scripts will be rejected.

Offline Documentation - PDFBook

The instructions below to create a Whonix ™ Wiki PDF are currently non-functional.

• https://forums.whonix.org/t/pdfbook-broken-the-offline-documentation-isnt-loading/8350 ^[archive]
• https://phabricator.whonix.org/T933 ^[archive]
• https://forums.whonix.org/t/offline-documentation-discussion/413 ^[archive]

The Whonix ™ Wiki has a PdfBook extension installed. This enables users to create a non-polished collection of all Whonix ™ documentation.

To generate a PDF, follow this link:

https://www.whonix.org/w/index.php?title=Category:Documentation&action=pdfbook ^[archive]

At the time of writing, a 16.6MB file is created. The result is readable but needs some cleanup. Translated pages are included, but will sometimes present with broken, nonsensical characters. The links are absolute and not relative, meaning users are redirected to the online site instead of internal chapters in the file. To avoid this, use the search function instead.

Footnotes

---

Whonix ™ is Supported by Evolution Host DDoS Protected VPS. Stay private and get your VPS with Bitcoin or Monero.

---

Jobs in USA

---

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

---

Follow:

Donate:

Share: Twitter | Facebook

Did you know that Whonix could provide protection against backdoors ^[archive]? See Verifiable Builds ^[archive]. Help is wanted and welcomed.

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee ^[archive] of the Open Invention Network ^[archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian ^[archive]. Debian is a registered trademark ^[archive] owned by Software in the Public Interest, Inc ^[archive].

Whonix ™ is produced independently from the Tor® ^[archive] anonymity software and carries no guarantee from The Tor Project ^[archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.