Dev/Build Documentation/Physical Isolation

---

WARNING: Please don't forget reading the #Security and Support Status, Warnings and First time user chapter.

Introduction

Basic

A supported platform that can run Whonix. There are also others.

See also Physical Isolation #Security and Support Status.

The following instructions are for Non-Qubes-Whonix. For Qubes-Whonix see:
https://forums.whonix.org/t/physical-isolation-is-back-qubes-whonix-style

Technical Introduction

When setting up Whonix in the form of two Virtual Machines running on the same physical host, exploits targeting the VM implementation or the host can still break out of the torified Client VM and expose the IP of a user. Malware running on the host has full control over all VMs. To protect such attacks we need a different approach: In this context we called it Physical Isolation, because the gateway system is installed on separate hardware. This drastically reduces the TCB by more than the half.

In total we'll be installing and configuring two computers and set up an isolated point to point network between them (you could also set up a an ordinary, completely isolated, LAN behind the Whonix-Gateway). One computer acts as the client or "Whonix-Workstation", the other as a proxy or "Whonix-Gateway" which will transparently route all of the Whonix-Workstation's traffic through Tor.

The Whonix-Gateway on its own physical device can either run directly on hardware or inside a virtual machine. Both options have advantages and disadvantages. We recommend to use no additional Virtual Machine for the Whonix-Gateway.

The Whonix-Workstation should always be installed in a Virtual Machine: A VM hides hardware serial numbers. See also Recommendation to use multiple VM Snapshots.

The host operating system(s) should only be used for downloading operating system updating, hosting Whonix-Gateway or Whonix-Workstation and nothing else.

Bonus points if the physical systems are exclusively used for hosting Whonix, or if storage devices are separated for Whonix and non-Whonix use cases, to avoid a Whonix hard drive getting infected by a another operating system.

Warnings

WARNING: Less tested than VM builds. Needs your help for more rigid testing!

WARNING: Instructions are difficult. Only advanced Linux users can understand them.

WARNING: Dev/Build Anonymity has not been considered for this article.

WARNING: Do also read the warnings in the latest build instructions for VM images. Some of them, Don't add private files to Whonix's source code folder! and Check if the OpenPGP public keys are still up to date. also applies to the physical isolation page.

WARNING: This article currently lacks information about Whonix-Gateway's and Whonix-Workstation's MAC address. See also:

• Protocol-Leak-Protection and Fingerprinting-Protection
• Whonix in public networks / MAC Address
  

WARNING: Joanna Rutkowska, security researcher, founder and developer emeritus of Qubes OS has completed a research paper comparing the security of software compartmentalization vs. physically separated computers (pdf). It concluded that in some cases, notably for specific, desktop-related workflows, Physical Isolation might be less secure than Qubes' compartmentalized approach. (See also: Qubes-Whonix.)

Using spare hardware + Virtual Machine

Advantages:

• You can install a graphical host.
• Use the Whonix download version.
• You can use the graphical network manager on the host, for example to connect to WiFi.
• You can setup easily a VPN on the host. Tor will be tunneled through the VPN.

Disadvantages:

• Higher attack surface, because the Virtual Machine code get's involved.

Using spare hardware without Virtual Machine

Advantages:

• More secure, because less code is involved.

Disadvantages:

• Slightly more complicated setup
• More difficult to set up VPN
• More difficult to set up 3G networking compared to using a Windows host

Hardware

General

We recommend that you use two dedicated computers for Whonix that are never used for activities that could lead back to your identity. Alternatively you can use an already existing and otherwise used computer for the Whonix-Gateway. To offer some isolation you should disconnect all internal and external drives and boot from a eSATA, USB or another internal drive into a clean environment.

non-anonymous use

• non-anonymous box (leave it as it is, like you want)
• non-anonymous home dial up internet router (leave it as it is, like you want)

anonymous use

• Whonix-Gateway
  • This really does not have to be a big desktop computer or ordinary server. There are alternatives.
  • smartphone ,
  • UMPC
  • pad, tablet,
  • notebook, netbook,
  • Raspberry Pi: needs contributor, development thread
  • router ,
  • set top box,
  • etc.
  • how to utilize such a device as a linux server is beyond the scope of this guide, there are already better resources
• anonymous 3G modem (see below) or anonymous wifi adapter (see below)
• Whonix-Workstation
  • You get the idea. Use a device which suits you.

Before installing

Read and apply the Pre-Installation Security Advice.

Prerequisites

• System Requirements
• Whonix-Gateway: A device with at least two network adapters, at least one of them ethernet , capable of running Linux. It will run Debian.
• Whonix-Workstation: A device connected via ethernet to the Whonix-Gateway. It must only have this one NIC and no other network connectivity! Must be connected by wire. This will be the torified client system or Whonix-Workstation. It must be capable of running Debian.
• We recommend to use a VM as the client, the same Whonix-Workstation, that most non Physical Isolation users use.
• Host build environment has a working internet connection to Debian mirrors.
• General advice from Build Documentation about Build Security applies
• Optionally, it would be useful, if you knew how to open a second virtual console.

Host Preparation

• You need to build on Debian Stable (jessie). (How to obtain Debian safely: )
• Build dependencies and configurations get automatically applied, so you don't have to worry about that.
• It is recommended to set your terminal (for example Konsole) to unlimited scrollback, so you can watch the full build log.

How To Install Whonix-Gateway on Hardware (RECOMMENDED)

Get Debian

Download a Debian Stable/Jessie 32 bit installation iso. Detailed instructions doing so are unfortunately not part of this guide. However, the Debian page contains some help.

You can choose iso of any desktop environment (KDE, LXDE, Xfce, ...) but since you'll be using the command line, Debian Stable/Jessie network install (netinst) version is recommended (it is the most minimal).

(You could also use a Debian Stable/Jessie 64 bit installation iso, these instructions should also work, but it is less tested.)

Install Debian

In the installer boot menu of Debian Stable (Jessie) press "Install" and choose following settings:

Select a language: English
Select your location: United States
Configure the keyboard: (select yours)
Hostname: host
Domain name: (empty)
Root password: (set up a strong password)
Full name for the new user: user
Username for your account: user
Password for the new user: (choose a good password, different from root password)
Partitioning method: Guided - use entire disk (it is a good idea to set up cryptsetup encrypted LVM at this point)
Partitioning scheme: All files in one partition (select the listed device in the next step)
Partition disks/overview: Finish partitioning
Write changes to disk: Yes

Debian archive mirror country: Go back
Continue without a network mirror: Yes

Use a network mirror: No
Participate in the package usage survey: No
Software selection: None; deselect all options (using Space)
Install the GRUB boot loader: Yes (select the listed device in the next step)
Finish the installation: Continue

OPTIONAL.

If you are interested in seeing a visual walk-through of the minimal installation of Debian Stable Jessie, click on Expand on the right.

In the menu select "Install"

Set language as English.

Set location as United States.

Select your keyboard.

Installing additional content.

Network will auto-configure (hopefully).

Set the hostname to "host".

Leave the domain name empty.

Pick a strong root password.

Reenter the password.

Full name should should be "user".

Username should also be "user".

Enter a strong user password.

Reenter the password.

Network time procedure.

Use a guided partitioning method with the whole disk (FDE is a good idea if you plan to use physical isolation or as your main system).

Select the suggested disk.

Partition all files in one partition.

Finish partitioning.

Confirm the changes.

It takes a few minutes to get the base system installed.

We don't need any extra packages so don't select a mirror, "Go back".

Confirm that you want to continue without a mirror.

Configuring apt.

"No thanks" to survey participation.

Deselect (no star) the given option (using Space).

Install GRUB.

Select your disk.

Finishing the installation.

Done! The system will reboot.

OS screen.

Login screen.

OPTIONAL - CUSTOMIZING FULL DISK ENCRYPTION

If you are interested in configuring a custom encryption algorithm to enhance security during the minimal installation of Debian Stable Jessie, click on Expand on the right.

1. Under "Partitioning method", select Manual

2. Select the disk you are installing to and press enter, then select <Yes> to create a new empty partition table.

3. Select the "FREE SPACE" of the drive you are installing to, press Enter, "Create a new partition" should already be selected; press Enter again.

4. Now create a boot partition. This is the unencrypted partition your system boots from. The standard is 254.8 MB. Type "254.8 MB" (without the quotes) and press Enter.

5. Under "Type for the new partition:", Primary should already be selected, press Enter again; Under "Location for the new partition: "Beginning" should already be selected, press Enter again to go to the Partition settings screen.

Use the following settings for your boot partition:

Use as:         Ext2 file system

Mount point:       /boot
Mount options:    noatime
Label:                 none
Reserved blocks:  5%
Typical Usage:     standard
Bootable flag:      on    

Then select "Done setting up the partition" and press Enter, you will be brought back to the main partitioning menu.

6. Select "Configure encrypted volumes" and press Enter, then select <Yes> when asked to write the changes to disk and configure encrypted volumes.

7. Create encrypted volumes should already be selected, press Enter and select the free space of the drive you are installing to by pressing the spacebar, then select <Continue> and press Enter again. Additional components will load, then you will be brought to the configuration page for your encrypted partition. Here you can customize your encryption settings.

Use as:      physical volume for encryption
Encryption method:   Device-mapper (dm-crypt)

Encryption: twofish 
[Recommend "twofish" and "serpent" as alternatives. "Serpent" is the slowest and only recommended if you have a fast system (and a fast drive), as it creates a lot of system overhead. "Twofish" is an algorithm created by Bruce Schneier, and is a lot faster, computationally-speaking. For most use-cases, "twofish" should be sufficient as an alternative algorithm]
Key size:     256 (leave as-is)
IV algorithm:  xts-plain64 
[for most use-cases, xts-plain64 should be sufficient. Do not change this unless you know what you are doing. You could inadvertently create a security hole]
Encryption key: Passphrase (leave as-is)
Erase data: yes (this will wipe the partition)
Bootable flag: off  

8. After you have completed your configuration, select "Done setting up this partition", and press Enter, then select <Yes> and press enter to write the changes to disk, then on the next screen select "Finish", and press Enter.

9. It is highly recommended that you erase the partition before you continue. Please note this may take a while for large drives. If you have already securely wiped your device before starting this installation, you can skip this step. To erase the partition, select <Yes> and press enter.

10. Choose a strong password. This password should be at LEAST 26 characters, including symbols. Remember: the stronger your password, the stronger your encryption. The weaker the password, the weaker your encryption. After entering your password and confirming it, you will be brought back to the main partitioning menu.

11. Under your new "Encrypted volume" (which should be at the top of the list), highlight the partition that was just created under it (it should say ext4), and press Enter. Under "Use as:", change this to "physical volume for LVM", and press Enter, then select "Done setting up the partition", and press Enter again to be brought back to the main partitioning menu.

12. Now select "Configure the Logical Volume Manager" and press Enter.

13. Highlight "Create volume group", and press Enter. Under "Volume group name:", enter HOST_VG, and press Enter.

14. Use the spacebar to select your encrypted partition, then select <Continue> and press Enter.

(Optional) SWAP USERS:

O1. Now create your swap partition. Highlight "Create logical volume" and press Enter, then select HOST_VG and press Enter again. Type SWAP, press Enter.

O2. Enter your volume size (2.5 GB is usually a good standard size for most systems) then select <Continue> and press Enter.

15. Highlight "Create logical volume" and press Enter, then select HOST_VG and press Enter again. Type ROOT, press Enter.

16. Under the "Logical volume size:", your entire volume should already be displayed, press Enter again.

17. Highlight "Finish", then press Enter to be brought back to the main partitioning menu.

18. You should see your new partition for ROOT displayed on this screen [LVM VG HOST_VG, LV ROOT - xxx.x GB Linux device-mapper (linear)]. Select the partition underneath the heading and press Enter

19. Change "do not use" to the filing system of your choice. Ext4 is good for most installations. XFS is more suitable for filesystems on top of encryption and is more robust with better performance. For the purposes of this documentation, the following configuration is provided:

Use as:             XFS journaling file system

Mount point:     / 
Mount options: defaults
Label:               none

20. Once you're done, select "Done setting up this partition", and press Enter to return to the main partitioning menu.

(Optional) SWAP USERS:

O1. You should see your new partition for SWAP displayed on this screen [LVM VG HOST_VG, LV SWAP - 2.5 GB Linux device-mapper (linear)]. Select the partition underneath the heading and press Enter.

O2. Change "do not use" to "swap area", and press Enter. Then select "Done setting up the partition" to return to the main partitioning menu.

21. Highlight "Finish partitioning and write changes to disk" and press Enter, then select <Yes> when asked to confirm the changes. Your installation will continue automatically.

Network Configuration

The external interface (usually eth0) may need to be configured according to the requirements of your local network, e.g. static or simply left to use dhcp if the gateway is connected to a dhcp capable router. For wlan follow the upstream documentations: debian wiki, Ubuntu help.

Make sure the internet is working.

Logon and upgrade Debian

Logon, install all security updates and reboot.

## (host) login with "root"
root

## Add a new repository source.
echo "deb http://ftp.us.debian.org/debian stable main" >> /etc/apt/sources.list

## Refresh package lists and upgrade
apt-get update && apt-get dist-upgrade -y

Preparation

Install sudo and git.

## Install "sudo" and git.
apt-get install sudo git -y

You must build as user "user" and that user must be a member of the "sudo" group. Rebooting applies the changes.

## Add "user" to "sudo" group
addgroup user sudo

## Reboot the system
shutdown -r now

## (host) login with "user"
user

Optional:
You may want to take an image of your installation in case the build script fails in the middle.

Get the Signing Key

This chapter is recommended for better security, but is not strictly required. (See Trust)

Download the key.

[select code]

curl --tlsv1.3 --proto =https -o patrick.asc https://www.whonix.org/patrick.asc

curl --tlsv1.3 --proto =https -o patrick.asc https://www.whonix.org/patrick.asc

Check fingerprints/owners without importing anything.

[select code]

gpg --with-fingerprint patrick.asc

gpg --with-fingerprint patrick.asc

Verify it shows the following.

pub  4096R/2EEACCDA 2014-01-16 Patrick Schleizer <adrelanos@riseup.net>
      Key fingerprint = 916B 8D99 C38E AF5E 8ADC  7A2A 8D66 066A 2EEA CCDA
sub  4096R/CE998547 2014-01-16 [expires: 2016-10-05]
sub  4096R/119B3FD6 2014-01-16 [expires: 2016-10-05]
sub  4096R/77BB3C48 2014-01-16 [expires: 2016-10-05]

If it checks out, import the key.

[select code]

gpg --import patrick.asc

gpg --import patrick.asc

It isn't safe to only get the signing key from one source for the download you want to verify. For better security, learn more about the Whonix Signing Key.

Get the Source Code

Install git and curl.

sudo apt-get install git curl

Get source code including git submodules (Whonix 13 / Jessie).

git clone --recursive https://github.com/Whonix/Whonix

Get source code including git submodules (Whonix 14 / Stretch), which is faster than the above command.

git clone --jobs=200 --recursive https://github.com/Whonix/Whonix

Remember it is Whonix, not whonix! If prompted for a username for github, you have mistyped the web address.

Shift to the source folder.

cd Whonix

OpenPGP Verify the Source Code

This chapter is recommended for better security, but is not strictly required.

Retrieve a list of available git tags.

git tag

Verify the chosen tag to build.

## ... Replace with tag you want to build.
git verify-tag 13.0.0.1.4-stable

The output should look similar to this.

object 1844108109a5f2f8bddcf2257b9f3675be5cfb22
type commit
tag 13.0.0.1.4
tagger Patrick Schleizer <adrelanos@riseup.net> 1392320095 +0000

.
gpg: Signature made Thu 13 Feb 2014 07:34:55 PM UTC using RSA key ID 77BB3C48
gpg: Good signature from "Patrick Schleizer <adrelanos@riseup.net>" [ultimate]

The warning.

gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.

Is explained on the Whonix Signing Key page and can be safely ignored.

By convention, git tags should point to signed git commits. (forum discussion) It is advisable to verify the signature of the git commit as well (replace 13.0.0.1.4 with the actual git tag being verified).

git verify-commit 13.0.0.1.4-stable^{commit}

The output should look similar to this.

commit 5aa1c307c943be60e7d2bfa5727fa5ada3a79c4a
gpg: Signature made Sun 07 Dec 2014 01:22:22 AM UTC using RSA key ID 77BB3C48
gpg: Good signature from "Patrick Schleizer <adrelanos@riseup.net>" [ultimate]
Author: Patrick Schleizer <adrelanos@riseup.net>
Date:   Sun Dec 7 01:22:22 2014 +0000

    .

Choose Version

Use git checkout to select the preferred version (or git branch) to build.

In order to build a specific git tag.

git checkout 13.0.0.1.4-stable

Replace 13.0.0.1.4 with the actual version chosen for the build: the stable, testers-only or developers version. Common sense is required when choosing the right version number. For example, the latest available version number is not necessarily the most stable or suitable. To learn more about current Whonix versions, follow the Whonix News Blog.

Clean Up and Sanitize

This step is also important for security.

Retrieve the list of extraneous files and folders.

git clean -ndff

See if the output looks sane; it generally should, unless Whonix source code is modified by advanced users (who understand git better anyhow). If the output looks like the following, everything is fine.

Would remove packages/apparmor-profile-gwenview/
Would remove packages/kde-privacy/

Remove these folders.

git clean -dff

The output should show.

Removing packages/apparmor-profile-gwenview/
Removing packages/kde-privacy/

Be sure to check out the right commit for each git submodule.

git submodule update --init --recursive

Check there are no extraneous files. This is important for security.

git status

The output should show the following:

nothing to commit (working directory clean)

If the directory is not clean, the extra files should be removed first.

Build Configuration (Optional)

Note: All of the following build configuration steps are optional.

Introduction

Usually the build configuration does not need to be changed. Whonix built from source code comes with safe defaults. Whonix's APT Repository will not be used.

The most interesting build configurations (Terminal-Only, NoDefaultApps etc.) are documented in the following chapters.

If you are interested, click on Expand on the right.

If build configurations were used earlier, it might be better to delete the build configuration folder. A few example filenames may have changed since the last build.

sudo rm -r /etc/whonix_buildconfig.d

Alternatively, experts can manually examine the /etc/whonix_buildconfig.d folder and change its contents to suit their preferences.

/etc/whonix_buildconfig.d is a modular flexible .d style configuration folder.

Less popular build configurations are documented in the buildconfig.d folder and on the Dev/Source_Code_Intro#Build_Configuration page, but it is less user-friendly.

To avoid typos, it is best to copy and paste text when creating build configuration files. Take care that editors do not capitalize variable names which are supposed to be lower case during copy and paste procedures.

Platforms Choice

Advanced users can create 64-bit instead of 32-bit builds.

If you are interested, click on Expand on the right.

By default, 32-bit Linux is used. 64-bit builds are less tested due to a lack of developer manpower, but should work well in principle. Whonix 14 will be 64-bit by default, see: State of official 64-bit builds.

Generally speaking, 64-bit builds cannot be created if running a 32 bit kernel. In this case, try installing the packages linux-image-amd64 and linux-headers-amd64, then boot the amd64 kernel by choosing it in the boot menu. The whole system does not require re-installation; just be sure to boot with an amd64 kernel.

To build 64-bit Whonix, add the following build parameter.

--arch amd64

kFreeBSD is entirely untested and most likely needs additional work (see footnotes).

Whonix for arm64 development discussion:
https://forums.whonix.org/t/whonix-for-arm64

Whonix APT Repository

Non-Qubes-Whonix:
Whonix's APT Repository is disabled by default since Whonix 7.3.3 for reasons of Trust. Later on, users can decide to update Whonix Debian packages by building them from source code (greater security). Alternatively, Whonix's APT repository can be enabled right after building or after booting the build for the first time (greater convenience). To use the latter method which sacrifices security for convenience, click on Expand on the right side.

Do you want to opt-in for Whonix's APT Repository? This is set using an environment variable or build configuration. Below is an example using an environment variable.

WHONIX_APT_REPOSITORY_OPTS='--enable --repository stable'
WHONIX_APT_REPOSITORY_OPTS='--enable --repository testers'
WHONIX_APT_REPOSITORY_OPTS='--enable --repository developers'
WHONIX_APT_REPOSITORY_OPTS='--enable --codename jessie'

Add an environment variable as one normally does on that specific Linux platform. For example, to enable the Whonix stable repository during build, you could set WHONIX_APT_REPOSITORY_OPTS by interjecting it between sudo and the ./whonix_build command. Below is an example. Do not use [...]. Replace it with other chosen build parameters (such as --build, <code>--target etc.) after ./whonix_build.

sudo WHONIX_APT_REPOSITORY_OPTS='--enable --repository stable' ./whonix_build [...]

APT Cache

Using an apt cache will greatly improve build speed when building several times in a row (e.g. when debugging, during development).

If you are interested, click on Expand on the right.

In short: Just get an apt cache running and set the REPO_PROXY environment variable.

Example.

sudo apt-get install apt-cacher-ng

Be sure to have a firewall, so the whole internet can not use the apt-cacher-ng service.

sudo REPO_PROXY=http://127.0.0.1:3142 ./whonix_build ...

When building inside a non-Whonix VM, an apt cache can be used on the host. In that case, adjust the IP accordingly and manually test that it is reachable. When building inside a (Whonix) VM, just install the apt cache inside the VM and point to a localhost apt cache.

VM Settings

This is only relevant for VM builds.

Several examples are below. Values can be changed to suit user preferences.

VirtualBox's --vmsize option (virtual RAM).

--vmram 128

VirtualBox's --vram option (virtual video RAM).

--vram 12

grml-debootstrap's --vmsize option.

--vmsize 200G

grml-debootstrap's --filesystem option.

--file-system ext4

grml-debootstrap's --hostname option.

--hostname host

grml-debootstrap's --password option.

--os-password changeme

grml-debootstrap's --debopt option.

--debopt "--verbose"

Skip Steps

--sanity-tests false

Source Code Changes

This is only required if changes were made to the Whonix source folder! In that case click on Expand on the right.
This is not required if only a customized build configuration was added to the /etc/whonix_buildconfig.d folder.

If changes were made to the Whonix source code, it is the easiest to use the following build parameter.

--allow-uncommitted true

Or if not building from a git tag, it is the easiest to use the following build parameter.

--allow-untagged true

Otherwise, changes must be committed to git first, before creating a git tag.

Network Verification

Before running the whonix_build script make sure eth1 and eth0 refer to the correct interfaces.

## May be helpful.
dmesg | grep eth

If you are using non-default network interface names, please click on Expand on the right.

Should be doable using non-default network interface names as well. Not as easy. Not fully documented. Untested.

One way would be to figure out how to change a network interface name such as wlan0 to eth0.

Otherwise you could consider to change the network interface names in the configuration files. To find the components that require configuration changes in the Whonix source folder, the following commands may be helpful. Should be really only a very few files. We used variables for eth0 and eth1 wherever possible.

exclude="--exclude=README.md --exclude=control --exclude=changelog.upstream --exclude-dir=.git --exclude-dir=whonix-developer-meta-files --exclude-dir=build-steps.d --exclude-dir=qubes-whonix"

grep $exclude -r eth0 ~/Whonix
grep $exclude -r eth1 ~/Whonix

grep -l $exclude -r eth0 ~/Whonix
grep -l $exclude -r eth1 ~/Whonix

Should you decide to edit these files in Whonix source folder, note to apply the build parameters from #Source Code Changes as well.

Another, perhaps better option might be to change the network interface names after Whonix build script finished.

For example /home/user/Whonix/packages/whonix-ws-network-conf/etc/network/interfaces.d/30_non-qubes-whonix becomes /etc/network/interfaces.d/30_non-qubes-whonix.

/usr/bin/whonix_firewall

Do not edit. We use a drop-in config snippet instead.

/etc/whonix_firewall.d/30_default.conf

Use a drop-in config snippet instead.

Open /etc/whonix_firewall.d/50_user.conf in an editor with root rights.

If you are using a graphical Whonix or Qubes-Whonix, run.

[select code]

kdesudo kwrite /etc/whonix_firewall.d/50_user.conf

kdesudo kwrite /etc/whonix_firewall.d/50_user.conf

If you are using a terminal-only Whonix, run.

[select code]

sudo nano /etc/whonix_firewall.d/50_user.conf

sudo nano /etc/whonix_firewall.d/50_user.conf

Add. Replace eth0 with your actual external network interface name as well as eth1 with your actual internal network interface name.

EXT_IF="eth0"
INT_IF="eth1"

Save.

/etc/network/interfaces.d/30_non-qubes-whonix

Manual edit required.

Open /etc/network/interfaces.d/30_non-qubes-whonix' in an editor with root rights.

If you are using a graphical Whonix or Qubes-Whonix, run.

[select code]

kdesudo kwrite /etc/network/interfaces.d/30_non-qubes-whonix'

kdesudo kwrite /etc/network/interfaces.d/30_non-qubes-whonix'

If you are using a terminal-only Whonix, run.

[select code]

sudo nano /etc/network/interfaces.d/30_non-qubes-whonix'

sudo nano /etc/network/interfaces.d/30_non-qubes-whonix'

Replace interface names.

Save.

/uwt/usr/lib/uwtwrapper

Do not edit. Use a drop-in config snippet instead.

Required for Whonix-Workstation in Whonix 14 and above only.

Open /etc/uwt.d/50_user.conf in an editor with root rights.

If you are using a graphical Whonix or Qubes-Whonix, run.

[select code]

kdesudo kwrite /etc/uwt.d/50_user.conf

kdesudo kwrite /etc/uwt.d/50_user.conf

If you are using a terminal-only Whonix, run.

[select code]

sudo nano /etc/uwt.d/50_user.conf

sudo nano /etc/uwt.d/50_user.conf

Add. Replace eth0 interface name.

bindp_interface="eth0"

/usr/bin/leaktest

Not important. Manual edit required.

/usr/lib/whonixcheck/check_network_interfaces.bsh

Manual edit required. Will break when whonixcheck gets upgraded. Then it needs to be edited again. This will be configurable in Whonix 14 so the setting survives whonixcheck upgrades.

/etc/sudoers.d/whonixcheck

Do not edit. Use a drop-in config snippet instead.

Use any editor of your choice.

sudo EDITOR=nano visudo -f /etc/sudoers.d/whonixcheck-user

Add. Replace eth0 and eth1 with your network interface names.

whonixcheck ALL=NOPASSWD: /sbin/ifconfig eth0
whonixcheck ALL=NOPASSWD: /sbin/ifconfig eth1

Save.

Minor Things

Most configuration files work well inside Virtual Machines and on hardware. Only minor things such as deactivating powersaving, passwordless reboot, shutdown etc. are only recommended for Virtual Machines. You can easily comment them out by putting a hash # in front of them. They are marked, to find them, grep can be used. Skip this for now. You can change these files later after building Whonix. (Simpler.)

grep -r VMONLY* *

Run Build Script

It is recommended that you create a log of the build process by redirecting all the output to a log file. Be aware that by doing so no build progress will appear on the screen - instead a text log file will be created in your home folder.

sudo ./whonix_build --flavor whonix-gateway -- --target root --build >> ~/log-phyiso 2>&1

To optionally watch the progress, open a second virtual console and type.

tail -f ~/log-phyiso

If don't want to create a log of the build process (the build progress will then appear on screen) use the following command.

This is not recommended because if anything goes wrong during the build, it will be harder to pinpoint the exact error without the actual log file.

sudo ./whonix_build --flavor whonix-gateway -- --target root --build

Final Steps

Reboot.

sudo reboot

Login as new user "user". (If you didn't install as user "user", your old user and home folder does of course still exist.)

• This is untested since use /etc/network/interfaces.d instead of /etc/network/interfaces was implemented. Please test and leave feedback. whonix-gw-network-conf ships a file /etc/network/interfaces.d/30_non-qubes-whonix. Usually it should not conflict with your /etc/network/interfaces. If it does, consider removing source-directory /etc/network/interfaces.d from /etc/network/interfaces (if there are no other files in /etc/network/interfaces.d folder) or moving /etc/network/interfaces.d/30_non-qubes-whonix out of the way. (sudo mv /etc/network/interfaces.d/30_non-qubes-whonix ~/)

Done.

Cleanup

OPTIONAL!

Remove temporary files.

Warning, this will run git clean -d --force --force in Whonix's main source code folder (~/Whonix) as well as in all sub folders of the Whonix packages folder ~/Whonix/packages. This means, if you knowingly added any files to any of these folders that have not been committed to git, these will be deleted.

./help-steps/cleanup-files

How To Install Whonix-Gateway in a VM (UNTESTED / NOT RECOMMENDED)

It is advised to install a new OS just for hosting the Gateway VM, any OS that can run VirtualBox works but we recommend an Open Source system.

Download the Whonix-Gateway image. (Or build it from source code.)

Adapter 1 can be set up as a NAT network. Adapter 2 must either be set to NAT as well (but you will need to forward ports from the host to the guest) or much simpler: use bridged networking and set it to the second physical interface (the one that goes into the isolated network/point to point ethernet). See "NAT vs Bridging" below.

This configuration is entirely untested and not recommended unless you need to run Tor through an unsupported 3G modem and can't afford a 3rd physical device.

When using NAT for a virtualized Gateway you need to set up port forwarding in VirtualBox. Using bridged network may be easier, but then the router may see the Whonix-Gateway MAC address which identifies as Whonix-Gateway. (Should not be of concern in home networks. Should be of concern in untrusted networks or when using a modem to connect.)

Install Whonix-Workstation in a VM (RECOMMENDED)

First Steps

Install and update a host operating system. On the host can run any OS that is capable of running VirtualBox, but be aware of Transparent Proxy Leaks. It is recommended against to use Windows or another other commercial proprietary system as host operating system.

Download the Whonix-Workstation image. (Or build it from source code.)

Note sure what we wanted to say with this sentence: If the physical network (between Whonix-Gateway and a router) uses 10.152.152.* you need to review and edit all shell scripts and switch the internal network to something else!

Host Network Adapter

The host has to be configured to use the static IP configuration.

## Whonix-Workstation
## /etc/network/interfaces for the host,
## when using Physical Isolation,
## with Whonix-Workstation in a VM.

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
   ## Increment last octet of address
   ## on optional additional hosts.
   address 10.152.152.11 
   netmask 255.255.192.0
   gateway 10.152.152.10
   #pre-up /usr/bin/whonix_firewall

   ## Out commented.
   ## For what do we require the network and broadcast
   ## instances anyway?
   #network 10.152.152.0
   #broadcast 10.152.152.255

#auto eth0
#iface eth0 inet dhcp

## end of /etc/network/interfaces

If the physical network (between Whonix-Gateway and a router) uses 10.152.152.* you need to review and edit all /etc/network/interfaces.

NAT vs Bridging

Two Choices

In the default Whonix VirtualBox image, the network adapter setting for Adapter 1 (eth0) is set to internal network and will therefore not work out of the box. There are two choices to fix this. NAT (recommended) or bridged network.

NAT (RECOMMENDED)

If you use NAT you will have to edit the /etc/network/interfaces in Whonix-Workstation to use DHCP (easier, shown in the example below) or a static IP for VirtualBox NAT.

sudo nano /etc/network/interfaces

Replace it with.

## Whonix-Workstation
## /etc/network/interfaces in a VM
## when using Physical Isolation.

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

## end of /etc/network/interfaces

Bridged Network (UNTESTED / NOT RECOMMENDED)

If you use bridged networking things will (or should, we haven't tested anything yet) just work.

Since in the bridged network case, Whonix-Workstation can see the MAC address of whatever network adapter it is connected to, you should change the MAC address of the Workstation host and of the Whonix-Gateway.

See Whonix in public networks.

Install Whonix-Workstation on hardware (NOT RECOMMENDED)

Install Whonix-Workstation on hardware without using a VM is recommended against, because hardware serials would be visible to Whonix-Workstation.

The instructions are very similar, if not the very same, to those in "How To Install Whonix-Gateway on hardware" above. You have to use --flavor whonix-workstation instead of --flavor whonix-gateway.

Expected Build Warnings

Can not write log, openpty() failed (/dev/pts not mounted?)

This does not affect the build.

[....] Your system does not have the CPU extensions required to use KVM. Not doing anything. ...[ FAIL ]

This does not affect the build.

[....] Stopping VirtualBox kernel modules [ ok ].
[....] Starting VirtualBox kernel modules[....] No suitable module for running kernel found ...[ FAIL ]
invoke-rc.d: initscript virtualbox, action "restart" failed.

This does not affect the build.

WARNING: The character device /dev/vboxdrv does not exist.
	 Please install the virtualbox-ose-dkms package and the appropriate
	 headers, most likely linux-headers-486.

	 You will not be able to start VMs until this problem is fixed.

This does not affect the build.

dpkg: warning: failed to open configuration file '/root/.dpkg.cfg' for reading: Permission denied

This does not affect the build.

Related forum topic:
Expected Build Warnings

After installing

Further required reading: Documentation. The host security chapter applies to both computers!

Read and apply the Post Installation Security Advice.

Stay tuned

Introduction

It is important to read the latest Whonix news to stay in touch with ongoing developments. This way, users also benefit from notifications about important security vulnerabilities and improved releases which address identified issues, like those found affecting the updater or other core elements.

Whonix News Blogs

For user convenience, there are multiple avenues for receiving news. Choose the most suitable option from this list:

1. Whonix Important Blog - Only critical information is reported. This includes security vulnerabilities and new stable Whonix versions. It is best suited for people with very limited time and interest in Whonix development and news.
2. Whonix Feature Blog - This includes everything from the Whonix Important Blog and has a relaxed posting policy. Testers-only and developers Whonix versions are announced here, along with the publishing of blog posts about updated articles, new features, future features, development, calls for testing, general project ideas and so on.
3. Other choices.

If time-constrained, users should at least read the Whonix Important Blog. Follow the Whonix Feature Blog if interested in learning about anonymity / privacy / security-related issues in detail, or to follow recent Whonix developments.

Operating System Updates

As strongly recommended in the Security Guide, it is necessary to regularly check for operating system updates on the host operating system, and both the Whonix-Workstation and Whonix-Gateway.

Tor Browser

whonixcheck

Tor Browser's built-in update check mechanism also works in Whonix, so use it whenever updates become available.

For additional information about Tor Browser updates see Tor Browser. Additionally, consider subscribing to https://blog.torproject.org for developments from The Tor Project.

Whonix Version Check and Whonix News

Whonix Version Check (first rectangle in black) and
Whonix News (second rectangle in green)

Whonixcheck will also automatically provide notifications about new Whonix versions and critical Whonix News updates.

Running Whonixcheck

By default, Whonixcheck runs automatically from time to time whenever the user starts up a Whonix-Workstation (commonly called whonix-ws). Whonixcheck verifies that the Whonix system is up-to-date and that everything is in proper working order.

Even though Whonixcheck should run automatically and periodically, users can also manually run Whonixcheck to check the system status by following the directions below.

How to Manually Run Whonixcheck

If you are using Qubes-Whonix, complete the following steps.

Qubes App Launcher (blue/grey "Q") -> click on the Whonix VM you want to check -> whonixcheck / System Check

If you are using a graphical Whonix, complete the following steps.

Start Menu -> System -> whonixcheck

If you are using a terminal-only Whonix, complete the following steps.

[select code]

whonixcheck

whonixcheck

Depending on the system specifications, Whonixcheck may take up to a few minutes to run. Assuming everything is working as intended, the output should highlight each "INFO" heading in green (not red). A successful Whonixcheck process results in output similar to the sample below.

Sample Whonixcheck Output

INFO: SocksPort Test Result: Connected to Tor. IP: 146.10.104.240 

INFO: TransPort Test Result: Connected to Tor. IP: 91.89.96.88 

INFO: Stream Isolation Test Result: Functional. 

INFO: Whonix News Result:
√ Up to date: whonix-workstation-packages-dependencies 3.4.2-1

INFO: Debian Package Update Check Result: No updates found via apt-get. 

INFO: Whonix APT Repository: Enabled. When the Whonix team releases JESSIE updates, they will be AUTOMATICALLY installed (when you run apt-get dist-upgrade) along with updated packages from the Debian team. Please read https://www.whonix.org/wiki/Trust to understand the risk. If you want to change this, use: 
dom0 -> Start Menu -> Template: whonix-ws -> Whonix Repository 

Tor Bootstrap

Tor bootstrap refers to the process of attempting to connect to the Tor network (successfully or unsuccessfully). Familiar output related to this process includes: "Tor connecting xx percent...", "Tor not connected", "Tor connected" and so on. Bootstrapping does not refer to related concepts, such as whether connections are "secure", "not secure", "anonymous" or "not anonymous".

Social Media Profiles

There are some Whonix Social Media Profiles online, but please do not rely on them for the latest Whonix News or to contact Whonix developers (see Contact for contact information).

As some users will disregard this advice, messages from the Whonix Feature Blog are automatically mirrored to the Whonix Twitter Profile, Whonix Facebook Profile and the Whonix Google+ Profile.

If it is safe to inform others about Whonix, feel free to Contribute via an anonymous account that follows or likes these profiles. This page can be shared on: Twitter | Facebook | Google+.

Source Code

If Whonix source code updates are of interest, subscribe to code changes.

Extra packages for better hardware support

Some packages for bare metal may or may not be missing. Here is a probably incomplete list of packages, which may or may not be useful for better hardware support. Some suggestions.

xorg
xserver-xorg-input-all
xserver-xorg-input-wacom
xserver-xorg-input-geode
xserver-xorg-input-vmmouse
xserver-xephyr

xserver-xorg-input-*
xserver-xorg-*

acpi-support-base
acpid
acpi

discover
discover-modprobe
discover-data

hwdata

mdetect

apt-cache show task-desktop
apt-cache show task-kde-desktop
apt-cache show task-laptop

If you have EFI bios.

grub-efi-amd64

To get a more complete list, install Debian (with KDE) on bare metal using the regular Debian installer medium.

• diff "dpkg -l" with Whonix
• diff "sudo lsmod" with Whonix
• contribute your findings

• See also: http://wiki.debian.org/HardwareAutodetection

Troubleshooting

• Slow network speed? Eventually it is the fault of your wifi driver? We had such a report in the forum.
• No connection between Whonix-Gateway and Whonix-Workstation? Could have something to do with Auto-MDIX. We had such a report in the forum.

Known bugs

Non-Qubes-Whonix means all Whonix platforms except Qubes-Whonix. This includes KVM, VirtualBox and Physical Isolation.

Suspend / Hibernate Issues

Short: Avoid suspending or hilbernating the computer or Whonix VMs while Whonix is running.

Long: Network Time Syncing, Troubleshooting#Clock Fix.

Mounting (CD / DVD) Devices

If the device auto mounter is broken, see if Start menu -> System Settings -> Removable Media helps.

The following workaround can be used.

[select code]

sudo mkdir /mnt/cdrom

sudo mkdir /mnt/cdrom

[select code]

sudo mount -o ro /dev/cdrom /mnt/cdrom/

sudo mount -o ro /dev/cdrom /mnt/cdrom/

Using the ro flag will mount the CD / DVD in read-only mode. If a CD / DVD is not being mounted, then drop the "-o ro" parameter.

Forum discussion:
https://forums.whonix.org/t/workstation11-doesnt-mount-hdds/1313

Help fixing this bug is welcome! (ticket)

VLC / Video Player Crash

The following workaround can be used.

VLC -> Tools -> Preferences -> Video -> Output -> X11 -> Save

Network Manager Systray Unmanaged Devices

Short answer: Unmanaged devices are unrelated to Whonix functioning and shouldn't concern the user.
Long answer:

Proxychains Tor Browser Issue

Using Tor Browser in conjunction with proxychains for the connection scheme: User -> Tor -> Proxy -> Internet
doesn't currently work. For more information, see here.

"apt-get source package" will show "dpkg-source: warning: failed to verify signature"

This is not a security issue, but only a warning. Read the entire thread here for more information.

This warning message can be removed with the following workaround below.

1. Modify /etc/dpkg/origins/default

[select code]

sudo unlink /etc/dpkg/origins/default

sudo unlink /etc/dpkg/origins/default

[select code]

sudo ln -s /etc/dpkg/origins/debian /etc/dpkg/origins/default

sudo ln -s /etc/dpkg/origins/debian /etc/dpkg/origins/default

2. Download the Source Package

[select code]

apt-get source package

apt-get source package

3. Undo Afterwards to Prevent Unexpected Issues

[select code]

sudo unlink /etc/dpkg/origins/default

sudo unlink /etc/dpkg/origins/default

[select code]

sudo ln -s /etc/dpkg/origins/whonix /etc/dpkg/origins/default

sudo ln -s /etc/dpkg/origins/whonix /etc/dpkg/origins/default

Security and Support Status

Whonix Physical Isolation has no dedicated maintainer. It is a leftover from previous times, where no other supported platforms were supported. This setup, these instructions still work. Some users are still using them. But Patrick's focus has now moved to Qubes. Grave security issues are unlikely due to Whonix's design. There is no Whonix team member testing Whonix physical isolation. No progress on the Whonix Physical Isolation development task list should be expected. That's why the supported platforms table lists Physical Isolation in the column 'security' with 'experimental'.

Help Wanted

• work on the Whonix Physical Isolation development task list (not even filled up)
• Become Whonix Physical Isolation maintainer so the #Security and Support Status can be improved.

Footnotes / References

---

Random News:

Did you know that Whonix could provide protection against backdoors? See Verifiable Builds. Help is wanted and welcomed.

---

Impressum | Datenschutz | Haftungsausschluss

https | (forcing) onion
Share: Twitter | Facebook | Google+

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.

Whonix (g+) is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Libre Software license as Whonix itself. (Why?)