Whonix

Jump to: navigation, search

Qubes/Install



First time user?

Whonix first time users warning
Warning:
  • If you do not know what metadata or a man-in-the-middle attack is.
  • If you think nobody can eavesdrop on your communications because you are using Tor.
  • If you have no idea how Whonix works.
Then read the About, Warning and Do Not pages to decide whether Whonix is the right tool for you based on its limitations.

Installation
Use Qubes Q3.

1. Launch dom0 Terminal Qubes App Launcher (blue/grey "Q")

Qubes-whonix1.png

Then go to:- System Tools -> Konsole

2. Install Whonix-Gateway and Whonix-Workstation TemplateVM


Write down this command inside the konsole , then hit "Enter".

[select code]
sudo qubes-dom0-update --enablerepo=qubes-templates-community qubes-template-whonix-gw qubes-template-whonix-ws

3. Make sure inactive VMs are shown

Start Qubes VM Manager (QVMM).

Qubes-whonix3.png

In Qubes VM Manager, if you do not see whonix-… in the list, use the “View” menu to toggle the setting “Show/Hide inactive VMs”.

Qubes-whonix5.png

After finishing the download process , you should see whonix-ws and whonix-gw.

Qubes-whonix2.png

4. Enable AppArmor (optional, testers-only security enhancement)

If you are interested, click on Expand on the right.

Proceed at your own risk!
Note: If considering the use of Tor bridges, be aware that AppArmor has caused problems with obfsproxy in the past. [1]

The following steps should be completed in dom0 for both the Whonix-Gateway (commonly called whonix-gw) and the Whonix-Workstation (commonly called whonix-ws) TemplateVMs. It is also important to check AppArmor is active in the TemplateBasedVMs sys-whonix and anon-whonix after making the changes.

Note: After these settings are applied to the TemplateVMs, the TemplateBasedVMs based on the whonix-gw / whonix-ws Whonix templates - namely anon-whonix and sys-whonix - will inherit the AppArmor kernel settings. It is not necessary to recreate the anon-whonix and sys-whonix TemplateBasedVMs to benefit from this change. [2]

Whonix-Gateway

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Xfce Terminal

List the current kernel parameters.

[select code]
qvm-prefs -l whonix-gw kernelopts

As of Qubes R3.2, this will show.
nopat

Keep the existing kernel parameters and add 'apparmor=1 security=apparmor'. For example.

[select code]
qvm-prefs -s whonix-gw kernelopts "nopat apparmor=1 security=apparmor"

List the current kernel parameters again (hit the up arrow key twice; you don't have to type the command again).

[select code]
qvm-prefs -l whonix-gw kernelopts

The output should show AppArmor is part of the new kernel parameters. For example.
nopat apparmor=1 security=apparmor

Start the sys-whonix ProxyVM and check AppArmor is now active.

[select code]
sudo aa-status --enabled ; echo $?

The output should show.
0

Whonix-Workstation

Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q") -> System Tools -> Xfce Terminal

List the current kernel parameters.

[select code]
qvm-prefs -l whonix-ws kernelopts

As of Qubes R3.2, this will show.
nopat

Keep the existing kernel parameters and add 'apparmor=1 security=apparmor'. For example.

[select code]
qvm-prefs -s whonix-ws kernelopts "nopat apparmor=1 security=apparmor"

List the current kernel parameters again (hit the up arrow key twice; you don't have to type the command again).

[select code]
qvm-prefs -l whonix-ws kernelopts

The output should show AppArmor is part of the new kernel parameters. For example.
nopat apparmor=1 security=apparmor

Start the anon-whonix AppVM and check AppArmor is now active.

[select code]
sudo aa-status --enabled ; echo $?

The output should show.
0

5. Create Whonix-Gateway ProxyVM

Qubes VM Manager -> Create AppVM

Qubes-whonix4.png

Then change the settings as it shown below. (You can choose any name and color you like.)

Create Qubes-Whonix-Gateway ProxyVM23423.png

6. Create Whonix-Workstation AppVM

Qubes VM Manager -> Create AppVM

Create Qubes-Whonix-Workstation AppVM2.png

7. TemplateVM proxy settings

a) Attach Whonix TemplateVMs to a Whonix-Gateway ProxyVM (commonly called sys-whonix)

Qubes VM Manager -> one left click on TemplateVM whonix-gw -> VM-Settings

Whonix templatevms to a GW.png

NetVM: -> sys-whonix -> OK

Qubes-Whonix-Gateway TemplateVM Qubes VM Manager Settings.png

b) Attach Whonix TemplateVMs to a Whonix-Workstation appVM (commonly called ws-whonix)

Qubes VM Manager -> one left click on TemplateVM whonix-ws -> VM-Settings

then

NetVM: -> sys-whonix -> OK

Whonix templatevms to a GW2.png

8. Update your Whonix-Gateway and Whonix-Workstation TemplateVMs

9. start Whonix-Workstation AppVM

For example, start the browser.

Qubes App Launcher (blue/grey "Q") -> Domain: anon-whonix -> Privacy Browser

10. Advanced information (Optional [security] information.)

If you are interested, click on Expand on the right.

Stay tuned[edit]

Introduction[edit]

It is important to read the latest Whonix news to stay in touch with ongoing developments. This way, users also benefit from notifications about important security vulnerabilities and improved releases which address identified issues, like those found affecting the updater or other core elements.

Whonix News Blogs[edit]

For user convenience, there are multiple avenues for receiving news. Choose the most suitable option from this list:

  1. Whonix Important Blog Whonix Important Blog Rss - Only critical information is reported. This includes security vulnerabilities and new stable Whonix versions. It is best suited for people with very limited time and interest in Whonix development and news.
  2. Whonix Feature Blog Whonix Feature Blog rss - This includes everything from the Whonix Important Blog and has a relaxed posting policy. Testers-only and developers Whonix versions are announced here, along with the publishing of blog posts about updated articles, new features, future features, development, calls for testing, general project ideas and so on.
  3. Other choices. [3]


If time-constrained, users should at least read the Whonix Important Blog. Follow the Whonix Feature Blog if interested in learning about anonymity / privacy / security-related issues in detail, or to follow recent Whonix developments.

Operating System Updates[edit]

As strongly recommended in the Security Guide, it is necessary to regularly check for operating system updates on the host operating system, and both the Whonix-Workstation and Whonix-Gateway.

Tor Browser[edit]

whonixcheck graphical user interface screenshot
whonixcheck

Tor Browser's built-in update check mechanism also works in Whonix, so use it whenever updates become available. [4]

For additional information about Tor Browser updates see Tor Browser. Additionally, consider subscribing to https://blog.torproject.org for developments from The Tor Project.

Whonix Version Check and Whonix News[edit]

whonixcheck graphical user interface screnshot
Whonix Version Check (first rectangle in black) and
Whonix News (second rectangle in green)

Whonixcheck will also automatically provide notifications about new Whonix versions and critical Whonix News updates. [5]

Running Whonixcheck[edit]

By default, Whonixcheck runs automatically from time to time whenever the user starts up a Whonix-Workstation (commonly called whonix-ws). Whonixcheck verifies that the Whonix system is up-to-date and that everything is in proper working order.

Even though Whonixcheck should run automatically and periodically, [6] users can also manually run Whonixcheck to check the system status by following the directions below.

How to Manually Run Whonixcheck[edit]

If you are using Qubes-Whonix, complete the following steps. [7]

Qubes App Launcher (blue/grey "Q") -> click on the Whonix VM you want to check -> whonixcheck / System Check

If you are using a graphical Whonix, complete the following steps.

Start Menu -> System -> whonixcheck

If you are using a terminal-only Whonix, complete the following steps.

[select code]
whonixcheck

Depending on the system specifications, Whonixcheck may take up to a few minutes to run. Assuming everything is working as intended, the output should highlight each "INFO" heading in green (not red). A successful Whonixcheck process results in output similar to the sample below.

Sample Whonixcheck Output[edit]

INFO: SocksPort Test Result: Connected to Tor. IP: 146.10.104.240 

INFO: TransPort Test Result: Connected to Tor. IP: 91.89.96.88 

INFO: Stream Isolation Test Result: Functional. 

INFO: Whonix News Result:
√ Up to date: whonix-workstation-packages-dependencies 3.4.2-1

INFO: Debian Package Update Check Result: No updates found via apt-get. 

INFO: Whonix APT Repository: Enabled. When the Whonix team releases JESSIE updates, they will be AUTOMATICALLY installed (when you run apt-get dist-upgrade) along with updated packages from the Debian team. Please read https://www.whonix.org/wiki/Trust to understand the risk. If you want to change this, use: 
dom0 -> Start Menu -> Template: whonix-ws -> Whonix Repository

Tor Bootstrap[edit]

Tor bootstrap refers to the process of attempting to connect to the Tor network (successfully or unsuccessfully). Familiar output related to this process includes: "Tor connecting xx percent...", "Tor not connected", "Tor connected" and so on. Bootstrapping does not refer to related concepts, such as whether connections are "secure", "not secure", "anonymous" or "not anonymous".

Social Media Profiles[edit]

There are some Whonix Social Media Profiles online, but please do not rely on them for the latest Whonix News or to contact Whonix developers (see Contact for contact information).

As some users will disregard this advice, messages from the Whonix Feature Blog are automatically mirrored to the Whonix Twitter Profile, Whonix Facebook Profile and the Whonix Google+ Profile.

If it is safe to inform others about Whonix, feel free to Contribute via an anonymous account that follows or likes these profiles. This page can be shared on: Twitter | Facebook | Google+.

Source Code[edit]

If Whonix source code updates are of interest, subscribe to code changes.

Known bugs[edit]

Proxychains Tor Browser Issue[edit]

Using Tor Browser in conjunction with proxychains for the connection scheme: User -> Tor -> Proxy -> Internet
doesn't currently work. For more information, see here.

"apt-get source package" will show "dpkg-source: warning: failed to verify signature"[edit]

This is not a security issue, but only a warning. Read the entire thread here for more information.

This warning message can be removed with the following workaround below.

1. Modify /etc/dpkg/origins/default

[select code]
sudo unlink /etc/dpkg/origins/default
[select code]
sudo ln -s /etc/dpkg/origins/debian /etc/dpkg/origins/default

2. Download the Source Package

[select code]
apt-get source package

3. Undo Afterwards to Prevent Unexpected Issues

[select code]
sudo unlink /etc/dpkg/origins/default
[select code]
sudo ln -s /etc/dpkg/origins/whonix /etc/dpkg/origins/default

Footnotes[edit]

  1. ↑ https://github.com/Whonix/Whonix/issues/67
  2. ↑ Since Qubes R3.0, TemplateBasedVMs inherit the kernelopts setting of their TemplateVM.
  3. ↑ Other choices:
  4. ↑ The only exception is Tor Browser running in a DisposableVM in Qubes-Whonix, since the update will not persist.
  5. ↑ For example: When a version becomes unsupported, if manual user action is required, if major features break, or if security vulnerabilities are found. The policy is to use Whonix News sparingly.
  6. ↑ This does not happen every time the user starts a Whonix-Workstation.
  7. ↑ Qubes VM Manager -> right-click on the Whonix VM you want to check -> select "Run command in VM"

    Type the following.
    [select code]
    konsole
    Then press. 
    <ENTER>

    Type the following.

    [select code]
    whonixcheck

    Then press. 

    <ENTER>
Random News:

Check out the Whonix blog.

Impressum | Datenschutz | Haftungsausschluss

https | (forcing) onion
Share: Twitter | Facebook | Google+

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.

Whonix (g+) is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Libre Software license as Whonix itself. (Why?)

Retrieved from "https://www.whonix.org/w/index.php?title=Qubes/Install&oldid=29381"