Actions

Whonix-Gateway Security Hardening

Introduction[edit]


Note that if onion-grater is disabled, users will no longer receive helpful Whonix notifications when Tor is not fully bootstrapped, since the whonixcheck and sdwdate tools rely upon it.

How-to: Disable Control Port Filter Proxy[edit]

Whonix-Gateway[edit]

Deactivate onion-grater in Firewall[edit]

Modify Whonix User Firewall Settings

Note: If no changes have yet been made to Whonix Firewall Settings, then the Whonix User Firewall Settings File /etc/whonix_firewall.d/50_user.conf appears empty (because it does not exist). This is expected.

If using Qubes-Whonix, complete these steps.

Qubes App Launcher (blue/grey "Q") -> Template: whonix-gw-14 -> Whonix User Firewall Settings

If using a graphical Whonix-Gateway, complete these steps.

Start Menu -> Applications -> Settings -> User Firewall Settings

If using a terminal-only Whonix-Gateway, complete these steps.

sudo nano /etc/whonix_firewall.d/50_user.conf

For more help, press on Expand on the right.

Note: The Whonix Global Firewall Settings File /etc/whonix_firewall.d/30_default.conf contains default settings and explanatory comments about their purpose. By default, the file is opened read-only and is not meant to be directly edited. Below, it is recommended to open the file without root rights. The file contains an explanatory comment on how to change firewall settings.

## Please use "/etc/whonix_firewall.d/50_user.conf" for your custom configuration,
## which will override the defaults found here. When Whonix is updated, this
## file may be overwritten.

See also Whonix modular flexible .d style configuration folders.

To view the file, follow these instructions.

If using Qubes-Whonix, complete these steps.

Qubes App Launcher (blue/grey "Q") -> Template: whonix-gw-14 -> Whonix Global Firewall Settings

If using a graphical Whonix-Gateway, complete these steps.

Start Menu -> Applications -> Settings -> Global Firewall Settings

If using a terminal-only Whonix-Gateway, complete these steps.

nano /etc/whonix_firewall.d/30_default.conf

Add the following content.

CONTROL_PORT_FILTER_PROXY_ENABLE=0

Save.

Reload Whonix-Gateway Firewall.

If you are using Qubes-Whonix, complete the following steps.

Qubes App Launcher (blue/grey "Q") -> Whonix-Gateway ProxyVM (commonly named sys-whonix) -> Reload Whonix Firewall

If you are using a graphical Whonix-Gateway, complete the following steps.

Start Menu -> Applications -> System -> Reload Whonix Firewall

If you are using a terminal-only Whonix-Gateway, run.

sudo whonix_firewall

Deactivate onion-grater[edit]

Stop onion-grater.

sudo service onion-grater stop

Disable autostart of onion-grater.

sudo systemctl mask onion-grater

Reboot.

Check if onion-grater is still running or disabled.

ps aux | grep onion-grater

If output similar to the following appears, then disabling did not work.

onion-g+   911  3.2  1.9  66444 20644 ?        Ss   12:21   0:00 /usr/bin/python3 -u /usr/lib/onion-grater --debug --listen-interface eth1

Deactivate whonixcheck onion-grater Running Test[edit]

Open /etc/whonix.d/50_user.conf in an editor with root rights.

If you are using a graphical Whonix or Qubes-Whonix, run.

kdesudo kwrite /etc/whonix.d/50_user.conf

If you are using a terminal-only Whonix, run.

sudo nano /etc/whonix.d/50_user.conf

Add the following content.

whonixcheck_skip_functions+=" check_control_port_filter_running "

Save.

Whonix-Workstation[edit]

Deactivate whonixcheck Tor Bootstrap Test[edit]

Because it relies on onion-grater.

Open /etc/whonix.d/50_user.conf in an editor with root rights.

If you are using a graphical Whonix or Qubes-Whonix, run.

kdesudo kwrite /etc/whonix.d/50_user.conf

If you are using a terminal-only Whonix, run.

sudo nano /etc/whonix.d/50_user.conf

Add the following content.

whonixcheck_skip_functions+=" check_tor_bootstrap "

Save.

Deactivate sdwdate Connectivity Test[edit]

Whonix-Workstation only.

Open /usr/lib/anon-shared-helper-scripts/te_pe_tb_check in an editor with root rights.

If you are using a graphical Whonix or Qubes-Whonix, run.

kdesudo kwrite /usr/lib/anon-shared-helper-scripts/te_pe_tb_check

If you are using a terminal-only Whonix, run.

sudo nano /usr/lib/anon-shared-helper-scripts/te_pe_tb_check

Replace the existing content with the following text.

#!/bin/bash
exit 0

Save.

Restart sdwdate.

sudo systemctl restart sdwdate

Done.

Be aware that this setting will not persist after any upgrade of sdwdate, nor is sdwdate currently configurable. [1]

Tor Browser Updater[edit]

In order to update Tor Browser using Tor Browser Updater by Whonix developers while onion-grater is disabled, complete the following steps. [2]

update-torbrowser --no-tor-con-check

Or create a file /etc/torbrowser.d/50_user.conf with the following content.

TB_NO_TOR_CON_CHECK="1"

Static VirtualBox IP[edit]

Instead of using DHCP to obtain the internal IP address for the Whonix-Workstation eth0 NAT adapter, a static IP can be used instead. This might marginally improve security because the DHCP package can then be removed.

Open /etc/network/interfaces.d/30_non-qubes-whonix on GitHub and read the comments. Then, comment out DHCP and comment in Static VirtualBox IP.

Footnotes[edit]

  1. Any Whonix users interested in further development should create a relevant ticket on Phabricator.
  2. It is far simpler to update using Tor Browser's internal updater instead.

License[edit]

Whonix Whonix-Gateway Security Hardening wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Whonix Whonix-Gateway Security Hardening wiki page Copyright (C) 2012 - 2018 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>

This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it under certain conditions; see the wiki source code for details.


Random News:

Please help us to improve the Whonix Wikipedia Page. Also see the feedback thread.


https | (forcing) onion

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.

Whonix is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Libre Software license as Whonix itself. (Why?)