Jump to: navigation, search

File Transfer

Qubes-Whonix[edit]

For Qubes-Whonix, you can then use the usual Qubes capabilities. Please refer to the Qubes documentation on how to do that.

Non-Qubes-Whonix[edit]

Non-Qubes-Whonix means all Whonix platforms except Qubes-Whonix. That includes KVM, VirtualBox and Physical Isolation.

Security Overview[edit]

All methods:

  • Risk of transferring Metadata or other sensitive information into Whonix-Workstation.
  • Whonix is about isolation. If you import data from the host or other media into Whonix-Workstation you weaken isolation and must be very careful.


Shared Folder:

  • Recommended.


SSH:

  • Works with ssh, scp, sshfs. Instructions below.


ISO Images, Host -> Whonix-Gateway/Workstation:

  • Safest method of getting files into Whonix-Workstation.


USB devices plugged into VirtualBox:

  • Hardware serials of the USB controller and/or USB device could leak into Whonix-Workstation.
  • Requires closed source VirtualBox extensions.
  • Bad idea security wise to plug USB controllers into untrusted virtual machines.


Mounting Virtual Machine images:

  • No idea if and if yes, what could leak into the Virtual Machine image.
  • See also Dev/Build Anonymity.


Adding Host-Only Networking adapter to Whonix-Workstation

Transfer files from the Host into Whonix-Gateway or Whonix-Workstation through ISO images[edit]

Linux host[edit]

Brasero[edit]

Act like you are burning a data disk with Brasero, and it gives you the option to create an iso. Go to the virtual machine window menu > Devices > CD/DVD devices > Choose a virtual disk.

Command line[edit]

Install genisoimage:

sudo apt-get install genisoimage

To create an iso "files.iso" containing the content of "folder":

genisoimage -o files.iso /path/to/folder

Use the VirtualBox graphical user interface to mount your newly created iso a virtual VM CD/DVD drive.

Inside Whonix-Workstation...

Create the folder /media/cdrom.

sudo mkdir -p /media/cdrom

Now attach the iso to the VM. Mount it with

sudo mount /dev/sr0 /media/cdrom

Get into that folder.

cd /media/cdrom

See your files.

dir

This is intentionally one-way as the Whonix-Workstation is inherently untrusted and should remain isolated to prevent side-channel attacks and covert channel leaks.

KVM[edit]

See KVM#Shared_Folders.

VirtualBox[edit]

Shared Folder[edit]

Recommended.

See VirtualBox Guest Additions chapter.

Transfer files from one Whonix-Workstation to a different Whonix-Workstation through a VDI file[edit]

Linux[edit]

This is one of the more convenient solutions for copying work from one Whonix-Workstation to another Whonix-Workstation.

0. The virtual machine you want to edit needs to be powered off.

1. First, in VirtualBox, click on the "Settings" for the Whonix Workstation that you desire to copy files from. Then, click on "Storage."

2. In the "Storage" settings, click on the square with a + sign on it to "add hard disk." It will be located next to an entry that says "Controller: Whonix."

3. In the next window that appears, click on "create new disk."

4. When prompted to choose a "hard drive file type," select "VDI."

5. When prompted to choose "storage on physical hard drive," choose "dynamically allocated."

6. In the next window, type "WhonixTransferBackup" for the drive name and then choose the storage capacity you need. In many cases, the default "8.00 GB" will be enough.

7. When you are returned to the "Settings" window, click the "OK" button.

8. Next, start the Whonix Workstation that you wish to transfer files from. When you reach the desktop, open a Terminal/Konsole session.

9. Now, format the new drive you created. Type

sudo fdisk /dev/sdb
at the command prompt that appears, type "n" create a new partition. Press "enter" to choose the default options when prompted until you are returned to fdisk's main menu. Finally, when you are returned to fdisk's main command prompt, type "w" to write the partition and exit fdisk.

10. Next, type

sudo mkfs.ext4 /dev/sdb1
in the terminal session.

11. Now create a new directory to be the mount point for your drive. Type

mkdir temp
in the terminal.

12. Next, mount your new drive. Type

sudo mount /dev/sdb1 temp
in the terminal.

13. Now, change the permissions to your mount folder so you can write to the drive. Type

sudo chmod 777 temp
in the terminal.

14. At this point, you can copy whichever files you desire to your new drive by copying them to the "temp" folder. You can do this in the terminal, with the file browser, etc. Once you have finished copying the files you want to the "temp" folder, shut down the Whonix Workstation.

15. After the Whonix Workstation is closed, open the "Virtual Media Manager" in VirtualBox by clicking on "File -> Virtual Media Manager."

16. Locate the new VDI file you created in steps 1-7 and click on it. Then, click the "copy" button. When the next window appears, click the "next" button.

17. When prompted to choose a "hard drive file type," select "VDI."

18. When prompted to choose "storage on physical hard drive," choose "dynamically allocated."

19. In the next window, type "WhonixWorkstationFileTransfer" for the drive name and then choose a folder where you wish to store it. The, click on the "copy" button. [ If copying does not work for you, you can also just power down the old VM, and attach the same vdi to the new VM. ]

20. When you are returned to the "Virtual Media Manager" window, click the "close" button.

21. Now, in the main VirtualBox window, click on the version of the Whonix Workstation that you want to copy the files into and click "settings."

22. Got to the "storage" section and click on the square with a + sign on it to "add hard disk." It will be located next to an entry that says "Controller: Whonix."

23. In the next window that appears, click on "choose existing disk." Then, find where you saved the "WhonixWorkstationFileTransfer.vdi" file and select it.

24.When you are returned to the "settings" window, click "OK."

25. Now, start the Whonix Workstation that you wish to copy your files into. When you reach your desktop, open a Terminal/Konsole session.

26. At the terminal command prompt, create a new directory to be the mount point for your drive. Type

mkdir temp
in the terminal.

27. Next, mount your new drive. Type

sudo mount /dev/sdb1 temp
in the terminal.

28. Finally, copy the files you want into the Whonix Workstation. When you are finished copying all the files, you can shut down the Whonix Workstation and delete the temporary "file transfer" VDI files you used in this process through the Virtual Media Manager if you desire.

Related forum topic:
How to tranfer data to Whonix 8

Windows[edit]

https://forums.whonix.org/t/virtualbox-transfer-files-from-whonix-to-host-with-disk-images/2189

Adding USB device to VirtualBox[edit]

This is not recommended for security reasons. A malicious guest can flash the low level firmware of your USB thumbdrive turning it into an attack vehicle against any machine you plug it into.

Does not require VirtualBox Guest Additions.

Please read the chapter Whonix is based on Debian.

Means, you can change your search terms from "How to get USB in Whonix-Workstation?" to "How to get USB in VirtualBox?".

Anyway, VirtualBox does not support USB out of the box. There are closed source additional extensions for usb support. You can download them from the VirtualBox download page.

Install them on the host.

We don't know if reboot is required. Then you can plug USB devices into Virtual Machines through the device menu in VirtualBox.

Note that automount of USB devices is disabled in Whonix by default. Try, Start menu -> System Settings -> Removable Media or manually mount. (Old forum topic.) (You could start a new forum discussion to share your results.)

Note, if you USB device is formatted with NTFS, you need to install the ntfs-3g package, and a special mount command, see [1].

https://forums.whonix.org/t/can-t-enable-usb-drive-in-virtualbox-troubleshooting-help-needed/1563/7

SSH into Whonix-Gateway[edit]

Developers / experts only! Only for debugging!

These instructions assume connecting from a local host into Whonix, not ssh to a remotely running Whonix.

On Whonix-Gateway.

Look at the /etc/whonix_firewall.d/30_default.conf config file.

Set GATEWAY_ALLOW_INCOMING_SSH to 1.

GATEWAY_ALLOW_INCOMING_SSH=1

Restart firewall.

On Whonix-Gateway!

sudo /usr/bin/whonix_firewall

Inside Whonix-Gateway:

On Whonix-Gateway! Run once.

sudo apt-get install openssh-server

On the host: Add port forwarding from host into Virtual Machine.

On the host! Run once.

Open a terminal. This forwards connection from the host to 127.0.0.1:2200 to the SSH server running inside Whonix-Gateway on port 22.

VBoxManage modifyvm "Whonix-Gateway" --natpf1 "ssh",tcp,127.0.0.1,2200,,22

If you ever want to undo this...

VBoxManage modifyvm "Whonix-Gateway" --natpf1 delete "ssh"

If you ever want to verify this...

VBoxManage showvminfo "Whonix-Gateway"
Look for the lines beginning with NIC. e.g. NIC 1 Rule(0): name = ssh, protocol = tcp, host ip = 127.0.0.1, host port = 2222, guest ip = 127.0.0.1, guest port = 22

On the host: Open a ssh session.

On the host! As user.

ssh user@127.0.0.1 -p 2200

Or as root.

ssh root@127.0.0.1 -p 2200

On the host: Or mount Whonix-Gateway as a folder.

Create a folder which will be used to mount the image. It needs to exist before trying to mount.

mkdir ~/mountgateway

On the host! As user.

sshfs user@127.0.0.1:/ -p 2200 ~/mountgateway

Or as root.

sshfs root@127.0.0.1:/ -p 2200 ~/mountgateway

SSH into Whonix-Workstation[edit]

Developers / experts only! Only for debugging!

These instructions assume connecting from a local host into Whonix, not ssh to a remotely running Whonix.

You can not directly SSH into Whonix-Workstation, because Whonix-Workstation has only an internal network interface and no NAT interface. Adding one would defeat the purpose of Whonix. (See Security Guide for details why.)

Required: You mastered the steps "SSH into Whonix-Gateway" above.

Connection will look like this: host -> ssh -> Whonix-Gateway -> ssh -> Whonix-Workstation.

On Whonix-Workstation:

sudo apt-get install openssh-server

On the Whonix-Gateway:

Or user@.

/usr/bin/ssh.anondist-orig root@10.152.152.11

Then SSH from the host into Whonix-Gateway (host -> Whonix-Gateway). From there, SSH into Whonix-Workstation (Whonix-Gateway -> Whonix-Workstation). You can also do that with one command (called SSH hopping).

On the host!

Or root@.

ssh -t user@127.0.0.1 -p 2200 "ssh.anondist-orig user@10.152.152.11"

You can also mount the filesystem of Whonix-Workstation with two commands. SSH hopping is also possible for sshfs (a website told (w) me).

mkdir ~/mountworkstation

On the host!

Or root@.

SSH into Whonix-Workstation and map to localhost:2222.

ssh -f user@127.0.0.1 -p 2200 -L 2222:10.152.152.11:22 -N

Mount Whonix-Workstation folder on the host.

sshfs -p 2222 user@127.0.0.1:/ ~/mountworkstation

If these instructions do not work for your, you can try the alternative standalone instructions Sshfs into Whonix-Workstation.

Mount and inspect images[edit]

Introduction[edit]

Developers / experts only! Only for debugging!

Required knowledge:

  • You don't have to use this method. Standard vdi (or raw) images are used. Feel free to mount them using any other way you like.
  • Mount and inspect images has been researched for only for Linux hosts. Not saying it's impossible on Windows, but it's not documented.
  • You must understand understand for what raw and for what vdi images are used, that's explained on the Dev/Source Code Intro page.
  • You need the Whonix source code, see chapter Get the Whonix source code.
  • Verify the Whonix source code with OpenPGP is not required, but recommended.
  • You need some dependencies, you can install them using the build-steps.d/1100_prepare-build-machine script.

VDI[edit]

Mount Whonix-Gateway vdi images.[edit]

sudo ./help-steps/mount-vdi --target virtualbox --build --flavor whonix-gateway
cd "/home/user/whonix_binary/Whonix-Gateway_image"

Inspect.

cd ~
sudo ./help-steps/unmount-vdi --target virtualbox --build  --flavor whonix-gateway

Mount Whonix-Workstation vdi images.[edit]

sudo ./help-steps/mount-vdi --target virtualbox --build --flavor whonix-workstation
cd "/home/user/whonix_binary/Whonix-Gateway_image"

Inspect.

cd ~
sudo ./help-steps/unmount-vdi --target virtualbox --build --flavor whonix-workstation

raw[edit]

Mount Whonix-Gateway raw images.[edit]

sudo ./help-steps/mount-raw --target virtualbox --build --flavor whonix-gateway
cd "/home/user/whonix_binary/Whonix-Gateway_image"

Inspect.

cd ~
sudo ./help-steps/unmount-raw --target virtualbox --build --flavor whonix-gateway

Mount Whonix-Workstation raw images.[edit]

sudo ./help-steps/mount-raw --target virtualbox --build --flavor whonix-workstation
cd "/home/user/whonix_binary/Whonix-Gateway_image"

Inspect.

cd ~
sudo ./help-steps/unmount-raw --target virtualbox --build --flavor whonix-workstation

VMDK[edit]

Mount Whonix-Workstation vmdk images.[edit]

Use this method to mount any VirtualBox file type (VMDK, VDI, VHD, or raw) on a Linux host.

Broken, because package virtualbox-fuse package is no longer available in Debian jessie or above.

This method uses a VirtualBox utility named "vdfuse" (virtualbox-fuse package). It uses the VirtualBox access library to open a VirtualBox supported image file and mount it as a Fuse file system.

This step is optional. You can skip this step and come back to it if the next step fails.

sudo apt-get update

Install the VirtualBox vdfuse utility. Note: this only works up to Debian Wheezy.

sudo apt-get install virtualbox-fuse

Edit the /etc/fuse.conf file and uncomment the line #user_allow_other and then save the file. Then, set the permissions on /etc/fuse.conf.

sudo vi /etc/fuse.conf (Uncomment #user_allow_other and then save)
sudo chmod 644 /etc/fuse.conf

Create a mount point and mount the Whonix Workstation image. This example shows a .vmdk file type, but any VirtualBox file type should work (VMDK, VDI, VHD, or raw).

mkdir /mnt/whonix
vdfuse -f /path/to/Whonix-Workstation/Whonix-Workstation-disk1.vmdk /mnt/whonix

The path /mnt/whonix/ will now contains files like EntireDisk, Partition1, etc. Last, mount Partition1 at a second mount point.

mkdir /mnt/workstation
sudo mount -o loop /mnt/whonix/Partition1 /mnt/workstation

Now, you can copy files to/from the Whonix workstation disk image.

When you are finished, unmount each of the mount points.

sudo umount /mnt/workstation
sudo umount /mnt/whonix

Related[edit]

Usability Development Tickets[edit]

All solutions listed here are far from user friendly. Please help improving this. See also our tickets about this issue:

See Also[edit]

Footnotes[edit]

  1. http://sourceforge.net/p/whonix/discussion/general/thread/c2429909/
  2. https://www.berrange.com/posts/2013/02/20/a-reminder-why-you-should-never-mount-guest-disk-images-on-the-host-os/

Random News:

Check out Whonix blog.


Impressum | Datenschutz | Haftungsausschluss

https | (forcing) onion
Share: Twitter | Facebook | Google+
This is a wiki. Want to improve this page? Help welcome, volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation. Whonix (g+) is a licensee of the Open Invention Network. Unless otherwise noted above, content of this page is copyrighted and licensed under the same Free (as in speech) license as Whonix itself.