Actions

Install Kicksecure ™ inside Debian

From Whonix

< Kicksecure



warning Note:

  • Do not use these instructions inside Whonix ™ [archive].
  • These instructions are only for use outside of Whonix; for example, browsing the internet non-anonymously.

You can convert your existing Debian buster installation into Kicksecure ™ by installing the Kicksecure ™ deb package. This is also called distro-morphing [archive].

There is no downloadable iso yet but there will be one in the future. For now, install Debian on your host or inside a VM. Then install Kicksecure ™ on top.

Best chance is to start with a minimal installation without GUI or XFCE if it must be one and then installing a meta package (cli or xfce). [1] Easiest to choose the linux user account name to be user during installation of Debian buster.


Prerequisites[edit]

  • Debian buster installed.
  • User account user exists.

Become root. [2]

su

Install sudo and adduser package.

1. Update the package lists.

apt-get update

2. Upgrade the system.

apt-get dist-upgrade

3. Install sudo and adduser package.

apt-get install --no-install-recommends sudo adduser

The following commands need to be run either by root or use sudo. [3]

Create group console.

/usr/sbin/addgroup --system console

Add user user to group console.

/usr/sbin/adduser user console

Add user user to group sudo.

/usr/sbin/adduser user sudo

Reboot.

/sbin/reboot

Installation[edit]

Complete the following steps to add the Whonix ™ Signing Key to the system's APT keyring.

Open a terminal.

Install curl, gpg, gpg-agent. [4]

Install curl gpg gpg-agent.

1. Update the package lists.

sudo apt-get update

2. Upgrade the system.

sudo apt-get dist-upgrade

3. Install the curl gpg gpg-agent package.

Using apt-get command line parameter --no-install-recommends is in most cases optional.

sudo apt-get install --no-install-recommends curl gpg gpg-agent

The procedure of installing curl gpg gpg-agent is complete.

Download Whonix ™ Signing Key. [5]

If you are using a Qubes TemplateVM, run.

curl --proxy http://127.0.0.1:8082/ --tlsv1.3 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc

If you are using Debian, run.

curl --tlsv1.3 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc

Users can check Whonix ™ Signing Key for better security.

Add Whonix ™ signing key to APT trusted keys.

sudo apt-key --keyring /etc/apt/trusted.gpg.d/derivative.gpg add ~/patrick.asc

The procedure of adding Whonix ™ signing key is now complete.

Add Whonix ™ Repository.

Choose either: Option A, Option B OR Option C.

Option A: Add Whonix ™ Onion Repository.

To add Whonix ™ Repository over Onion please press on expand on the right.

Install apt-transport-tor from the Debian repository.

sudo apt-get install apt-transport-tor

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster.

echo "deb tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option B: Add Whonix ™ Clearnet Repository over Tor.

To add Whonix ™ Repository over torified clearnet please press on expand on the right.

Install apt-transport-tor from the Debian repository.

sudo apt-get install apt-transport-tor

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster.

echo "deb tor+https://deb.Whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Option C: Add Whonix Clearnet Repository over clearnet.

To add Whonix ™ Repository over clearnet please press on expand on the right.

Add Whonix's APT repository for default Whonix using Debian stable. At the time of writing this was buster.

echo "deb https://deb.Whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

Pick a package.

  • kicksecure-cli: command line interface (CLI) version only. This does not modify your graphical desktop environment. You will get better kernel hardening, better entropy, and more security features.
  • kicksecure-xfce: Same as kicksecure-cli but installs the XFCE graphical desktop environment and default applications. This is useful if you installed Debian without a graphical desktop environment and want to set up the Kicksecure ™ graphical desktop environment which is XFCE.

Install Kicksecure ™ package such as kicksecure-cli.

Install kicksecure-cli.

1. Update the package lists.

sudo apt-get update

2. Upgrade the system.

sudo apt-get dist-upgrade

3. Install the kicksecure-cli package.

Using apt-get command line parameter --no-install-recommends is in most cases optional.

sudo apt-get install --no-install-recommends kicksecure-cli

The procedure of installing kicksecure-cli is complete.

When asked about Configuration file '/etc/machine-id', say y yes Enter and install.

Check if there is some APT source in /etc/apt/sources.list which should be kept.

Move original /etc/apt/sources.list out of the way (or delete) because /etc/apt/sources.list.d/debian.list by Kicksecure ™ replaces it.

sudo mv /etc/apt/sources.list ~/

Create empty /etc/apt/sources.list. [6]

sudo touch /etc/apt/sources.list

Installation of Kicksecure ™ is complete.

Footnotes[edit]

  1. http://forums.whonix.org/t/sudo-apt-get-install-whonix-part-i-distro-morphing/2346/8 [archive]
  2. One way or another.
  3. Required to use full path to addgroup, adduser, reboot because when using su the PATH environment variable is not adjusted for use with root rights. See echo "$PATH". user rights PATH:
    /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
    

    root rights PATH:

    /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
    

    When using sudo using /full/path/to/application is not required.

  4. gpg is required by apt-key. gpg-agent is required due to the following error message.
    sudo apt-key --keyring /etc/apt/trusted.gpg.d/derivative.gpg add ~/patrick.asc
    
    gpg: failed to start agent '/usr/bin/gpg-agent': No such file or directory
    gpg: can't connect to the agent: No such file or directory
    
  5. See Secure Downloads to understand why curl and the parameters --tlsv1.3 --proto =https are used instead of wget.
  6. https://forums.whonix.org/t/command-not-found-warningcould-not-open-file-etc-apt-sources-list/7903 [archive] This can be avoided once package whonix-legacy has been renamed and ported to Kicksecure since it automates this.


text=Jobs in USA
Jobs in USA


Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki


Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: 1024px-Telegram 2019 Logo.svg.png Discourse logo.png Matrix logo.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png Iconfinder Apple Mail 2697658.png Reddit.jpg Hacker.news.jpg 200px-Mastodon Logotype (Simple).svg.png

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.