Actions

Kicksecure ™ for VirtualBox with XFCE

From Whonix

< Kicksecure



Kicksecure ™: A Security-hardened, Non-anonymous Linux Distribution.

Ambox warning pn.svg.png Testers only!

warning Note:

  • Do not use these instructions inside Whonix ™ [archive].
  • These instructions are only for use outside of Whonix; for example, browsing the internet non-anonymously.

1. Download Kicksecure ™ XFCE for Windows Windows logo - 2012.svg.png, MacOS Rsz osx.png and Linux Tux.png FREE


Ambox warning pn.svg.png By downloading, you acknowledge that you have read, understood and agreed to our Terms of Service and License Agreement.

Version: 16.0.3.1

Type Connection Link Download Security
without Verification 		Download Security
with Verification
Download.png Https long.png

Download (TLS)

Medium High [1]
Download.png Iconfinder tor 386502.png

Download (Onion)

Medium High
Button sig.png Https long.png - -
Button sig.png Iconfinder tor 386502.png - -
Crypto key.png Verify images using this Signing Key


Verify the Kicksecure ™ Images Whonix ™ virtual machine images are cryptographically signed by Whonix developer Patrick Schleizer using OpenPGP. [2]

notice Digital signatures can increase security but this requires knowledge. Learn more about digital software signature verification.

If you know how to use an OpenPGP key, download the Whonix ™ Signing Key and the Whonix ™ signatures straight away.

Otherwise, use the following instructions:

Download Kicksecure ™ XFCE

2. Install VirtualBox Virtualbox logo.png

  • Linux Tux.png: please press expand on the right side.

Hosts using a non-Debian OS:

Install VirtualBox as per the normal mechanism for your Linux distribution.

Debian hosts:

These instructions are for Debian bullseye, which is recommended. Other Debian releases might work, but this is untested. In that case, replace bullseye with the actual codename your release.

Note: this applies to Kicksecure ™ 16. Later Kicksecure ™ versions may use a codename different to bullseye.

Package virtualbox [archive] should be installed from Debian unstable (codename: sid). This is non-ideal but required since VirtualBox in unavailable in Debian bullseye / bullseye-backports at the time of writing. It has risks such as bricking the apt package manager. Therefore users should make sure to have their backup and restore process functional. Alternativly you could install from Oracle Repository but this comes with different risks.

1. On the host.

Open a terminal.

2. Add Debian stable codename bullseye to the apt-conf default-release. 

sudo su -c "echo -e 'APT::Default-Release bullseye;' > /etc/apt/apt.conf.d/70defaultrelease"

3. Add Debian sid to Debian apt sources.

[3] 

sudo su -c "echo -e 'deb http://http.debian.net/debian sid main contrib non-free' > /etc/apt/sources.list.d/unstable.list"

4. Update the package lists. 

sudo apt-get update

5. Install the selected software. 

sudo apt-get install virtualbox/sid linux-headers-$(uname -r)

The procedure is now complete.

6. Undo.

On occasion it is necessary to undo this configuration, for example when upgrading from Debian bullseye to bookworm. [4] To proceed, run. 

sudo rm /etc/apt/sources.list.d/unstable.list

3. Import Kicksecure ™ into VirtualBox Virtualbox logo.png

For Kicksecure ™ VirtualBox import instructions, please press on expand on the right.

Start VirtualBox
Open The virtualbox1.png

Click on File then choose Import Appliance...
Select Import Applience2.png

Navigate and select Kicksecure ™ image and press next
Select whonix image and press next3.png

Do NOT change anything! Just click on Import
Press import4.png

Then press Agree
Press agree5.png

Wait until Whonix-Gateway.ova has been imported
Wait for importing6.png

Now start Kicksecure ™.
Start both of them8.png

Miscellaneous

There are also Video Tutorials.

If you still need help, please check the Support page.

For command line import instructions, see footnote. [5]

4. Start Kicksecure ™

Starting Kicksecure ™ is simple.

Start VirtualBox → Double-click the Kicksecure ™.


Whonix / Kicksecure ™ default admin password is: changeme default username: user
default password: changeme

Footnotes and Experimental Spectre / Meltdown Defenses

Please press on expand on the right.

Kicksecure Stable Version | Kicksecure Testers Only Version

Testers only! For more information please press on expand on the right.

These experimental [archive] Spectre/Meltdown defenses are related to issues outlined in Firmware Security and Updates. Due to the huge performance penalty and unclear security benefits of applying these changes, it may not be worth the effort. The reason is VirtualBox is still likely vulnerable, even after:

  1. A host microcode upgrade.
  2. A host kernel upgrade.
  3. A VM kernel upgrade.
  4. A "not vulnerable" result from spectre-meltdown-checker run on the host.
  5. Installation of the latest VirtualBox version. [6]
  6. All Spectre/Meltdown-related VirtualBox settings are tuned for better security as documented below.

To learn more, see: VirtualBox 5.2.18 vulnerable to spectre/meltdown despite microcode being installed [archive] and the associated VirtualBox forum discussion [archive]. [7] Users must patiently wait for VirtualBox developers to fix this bug.

On the host. [8] [9] [10] [11] [12] [13] [14]

VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-entry on VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-exit on VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-sched on VBoxManage modifyvm "Whonix-Gateway" --spec-ctrl on VBoxManage modifyvm "Whonix-Gateway" --nestedpaging off VBoxManage modifyvm "Whonix-Gateway" --mds-clear-on-vm-entry on VBoxManage modifyvm "Whonix-Gateway" --mds-clear-on-sched on

VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-exit on VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-sched on VBoxManage modifyvm "Whonix-Workstation" --spec-ctrl on VBoxManage modifyvm "Whonix-Workstation" --nestedpaging off VBoxManage modifyvm "Whonix-Workstation" --mds-clear-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --mds-clear-on-sched on

Info These steps must be repeated for every Whonix or non-Whonix VirtualBox VM, including multiple and custom VMs.

The above instructions only apply to the default VM names Whonix-Gateway ™ and Whonix-Workstation ™. Therefore, if Multiple Whonix-Workstation ™ and/or Multiple Whonix-Gateway ™ are configured, then repeat these instructions using the relevant name/s.


Footnotes[edit]

  1. ↑ It does not matter if the bulk download is done over an insecure channel if software signature verification is used at the end.
  2. ↑ OpenPGP is a standard for data encryption that provides cryptographic privacy and authentication through the use of keys owned by its users.
  3. ↑ Or alternatively use the .onion mirror. 
    sudo su -c "echo -e 'deb tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian sid main contrib non-free' > /etc/apt/sources.list.d/unstable.list"

  4. ↑ Most often this step applies before attempting major Kicksecure ™ upgrades; upgrade instructions are also made available at that time (see stay tuned).
  5. ↑ For Linux: Read License Agreement. 
    vboxmanage import Kicksecure-XFCE-15.0.0.0.6.ova --vsys 0 --eula show --vsys 1 --eula show

    vboxmanage import Kicksecure-XFCE-15.0.0.0.6.ova --vsys 0 --eula accept --vsys 1 --eula accept

  6. ↑ VirtualBox version 5.2.18 or above is required since only that version comes with Spectre/Meltdown defenses. See https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739/22 [archive].
  7. ↑ Also see the following Whonix forum discussion: Whonix vulerable due to missing processor microcode packages? spectre / meltdown / retpoline / L1 Terminal Fault (L1TF) [archive]
  8. ↑

    --ibpb-on-vm-[enter|exit] on|off: Enables flushing of the indirect branch prediction buffers on every VM enter or exit respectively. This could be enabled by users overly worried about possible spectre attacks by the VM. Please note that these options may have sever impact on performance.
    https://www.virtualbox.org/manual/ch08.html [archive]

    There is a mistake in the VirtualBox manual stating enter which does not work. It is actually entry.

  9. ↑ https://www.virtualbox.org/manual/ch08.html [archive]

    --l1d-flush-on-vm-enter on|off: Enables flushing of the level 1 data cache on VM enter. See Section 13.4.1, “CVE-2018-3646”.

  10. ↑

    --l1d-flush-on-sched on|off: Enables flushing of the level 1 data cache on scheduling EMT for guest execution. See Section 13.4.1, “CVE-2018-3646 [archive]”.
    https://www.virtualbox.org/manual/ch08.html [archive]

  11. ↑ https://www.virtualbox.org/manual/ch13.html#sec-rec-cve-2018-3646 [archive]

    For users not concerned by this security issue, the default mitigation can be disabled using

    VBoxManage modifyvm name --l1d-flush-on-sched off

    Since we want to enable the security feature we set --l1d-flush-on-sched on.

  12. ↑

    --spec-ctrl on|off: This setting enables/disables exposing speculation control interfaces to the guest, provided they are available on the host. Depending on the host CPU and workload, enabling speculation control may significantly reduce performance.
    https://www.virtualbox.org/manual/ch08.html [archive]

  13. ↑ According to this VirtualBox ticket [archive] --spec-ctrl should be set to on.
  14. ↑

    --nestedpaging on|off: If hardware virtualization is enabled, this additional setting enables or disables the use of the nested paging feature in the processor of your host system; see Section 10.7, “Nested paging and VPIDs” and Section 13.4.1, “CVE-2018-3646”.

Fosshost is sponsors Kicksecure ™ stage server Whonix old logo.png
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: 1024px-Telegram 2019 Logo.svg.png Discourse logo.png Matrix logo.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png Iconfinder Apple Mail 2697658.png Reddit.jpg Hacker.news.jpg 200px-Mastodon Logotype (Simple).svg.png

Did you know that Whonix ™ could provide protection against backdoors? See Verifiable Builds. Help is wanted and welcomed.

https link onion link Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

Retrieved from "https://www.whonix.org/w/index.php?title=Kicksecure/XFCE&oldid=67667"
By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.
More information