Actions

Whonix-Gateway Security

From Whonix


Whonixgatewaysecur23234234.jpg

Whonix ™ comes with many security features [archive]. Whonix ™ is Kicksecure ™ security hardened by default and also provides extensive Documentation including a System Hardening Checklist. The more you know, the safer you can be.

This page is targeted at users who wish to improve the security of their Whonix-Gateway ™ to become even more secure.

AppArmor[edit]

According to debian.org: [1]

AppArmor is a Mandatory Access Control framework. When enabled, AppArmor confines programs according to a set of rules that specify what files a given program can access. This proactive approach helps protect the system against both known and unknown vulnerabilities.

AppArmor provides a number of advantages: [2]

  • It protects the operating system and applications from external or internal threats, including zero-day attacks.
  • "Good behavior" is enforced and it mitigates exploits via unknown application flaws.
  • AppArmor security policies define the system resources that individual applications can access, and with what privileges. For instance:
    • Network access.
    • Raw socket access.
    • Read, write or execute file permissions on specific paths.

It is recommended to use the Whonix ™ AppArmor profiles which are available for various programs that run in both Whonix-Gateway ™ and Whonix-Workstation ™, such as Tor, Tor Browser, Thunderbird and more. The profiles are easy to apply and provide a considerable security benefit.

General Advice[edit]

Ambox warning pn.svg.png Warning: Only use Whonix-Gateway ™ (sys-whonix) for running Tor!

If Whonix-Gateway ™ (sys-whonix) is ever compromised, the attacker can discover:

  • The user's identity (public IP address).
  • All destinations visited.
  • The entirety of clear-text and onion service communication over Tor.

Before installing any extra packages in Whonix-Gateway ™, first consult the developers to check whether that is necessary and wise.

Seccomp[edit]

According to Mozilla: [3]

Seccomp stands for secure computing mode. It is a simple sandboxing tool in the Linux kernel, available since Linux version 2.6.12. When enabling seccomp, the process enters a "secure mode" where a very small number of system calls are available (exit(), read(), write(), sigreturn()). Writing code to work in this environment is difficult; for example, dynamic memory allocation (using brk() or mmap(), either directly or to implement malloc()) is not possible.

It is recommended to enable seccomp on Whonix-Gateway ™ (Qubes-Whonix ™: sys-whonix), since it is easily applied and provides additional sandboxing protection for the Tor process. Be aware that pluggable transports [archive] like obfs4, meek-lite and Snowflake are incompatible with seccomp. [4]

Info Note: Enabling seccomp on Whonix-Gateway ™ currently prevents Tor from connecting. Help is most welcome, see: Cannot use Seccomp in sys-whonix after update [archive]. [5]

Open /usr/local/etc/torrc.d/50_user.conf.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named sys-whonix)Tor User Config (Torrc)

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSettings/usr/local/etc/torrc.d/50_user.conf

If you are using a terminal-only Whonix-Gateway ™, complete the following steps.

sudo nano /usr/local/etc/torrc.d/50_user.conf

Add.

Sandbox 1

Save and exit.

Tor Connection Padding[edit]

From Tor 3.1.7 onward, connection padding is available for the Tor process. This setting helps to resist traffic analysis, as The Tor Project explains (emphasis added): [6]

Connections between clients and relays now send a padding cell in each direction every 1.5 to 9.5 seconds (tunable via consensus parameters). This padding will not resist specialized eavesdroppers, but it should be enough to make many ISPs’ routine network flow logging less useful in traffic analysis against Tor users.

Padding is negotiated using Tor’s link protocol, so both relays and clients must upgrade for this to take effect. Clients may still send padding despite the relay’s version by setting ConnectionPadding 1 in torrc, and may disable padding by setting ConnectionPadding 0 in torrc.

Follow these steps to enable connection padding.

Open /usr/local/etc/torrc.d/50_user.conf.

If you are using Qubes-Whonix ™, complete the following steps.

Qubes App Launcher (blue/grey "Q")Whonix-Gateway ™ ProxyVM (commonly named sys-whonix)Tor User Config (Torrc)

If you are using a graphical Whonix-Gateway ™, complete the following steps.

Start MenuApplicationsSettings/usr/local/etc/torrc.d/50_user.conf

If you are using a terminal-only Whonix-Gateway ™, complete the following steps.

sudo nano /usr/local/etc/torrc.d/50_user.conf

Add.

ConnectionPadding 1

Save and exit.

Forum discussion:
Tor Connection Padding [archive]

Warning: Bridged Networking[edit]

Do not change Whonix-Gateway ™'s first or second network interface to a bridged network. This is unsupported, untested and should not be necessary. Users who feel it is necessary in their circumstances should get in contact for the purpose of community feedback.

For further interest, here is a discussion thread [archive], and another one [archive], debating whether NAT or a bridged network is more secure. [7] [8]

Footnotes[edit]



Fosshost is sponsors Kicksecure stage server Whonix old logo.png
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki


Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: 1024px-Telegram 2019 Logo.svg.png Discourse logo.png Matrix logo.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png link=mailto:?subject=Whonix-Gateway Security&body=https://www.whonix.org/wiki/Whonix-Gateway_Security link=https://reddit.com/submit?url=https://www.whonix.org/wiki/Whonix-Gateway_Security&title=Whonix-Gateway Security link=https://news.ycombinator.com/submitlink?u=https://www.whonix.org/wiki/Whonix-Gateway_Security&t=Whonix-Gateway Security link=https://mastodon.technology/share?message=Whonix-Gateway Security%20https://www.whonix.org/wiki/Whonix-Gateway_Security&t=Whonix-Gateway Security

There are five different options for subscribing to Whonix ™ source code changes.

https link onion link Priority Support | Investors | Professional Support

Whonix | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.