Actions

Combine Whonix Live VMs with Read-only Mode for Virtual Hard Drives

From Whonix

< Whonix Live



Introduction[edit]

It is possible to optionally set the virtual machine (VM) disks to read-only. This increases the security of the Whonix ™ Live configuration, because otherwise malware running as root in the VM could theoretically mount the image read-write and gain persistence in this way.

Qubes[edit]

grub-live is currently unsupported on Qubes, but may become available in the future. Refer to the following forum discussion [archive] for further information.

In Qubes R4, Qubes DisposableVMs are a suitable alternative, as well as the Qubes Live USB [archive].

VirtualBox[edit]

1. Set the VM disks to read-only.

Follow these steps:

  • Power off the virtual machine (VM).
  • Set the disk to read-only.
    • The name of the VM in the following example below is Whonix-Workstation-XFCE. It could be replaced with the name of any other VM such as Whonix-Gateway-XFCE.
    • On the host, on the command line, run.

VBoxManage setextradata Whonix-Workstation-XFCE "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly" 1

2. Launch the live system.

Following reboot, a second boot entry called "Whonix ™ Live-mode" will be visible. Simply press Enter to boot the live system and use it as normal.

3. Optional: Revert the read-only change.

To boot into normal mode again, run this command on the host to revert the change.

VBoxManage setextradata Whonix-Workstation-XFCE "VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly"

The normal boot option can now be selected in the GRUB menu.

KVM[edit]

1. Set the VM disks to read-only.

Follow these steps:

  • Power off the machine.
  • Set the hard disk to read-only in the virt-manager GUI before booting into live mode.

2. Launch live-mode.

Following reboot, a second boot entry called "Whonix ™ Live-mode" will be visible. Simply press Enter to boot the live system and use it as normal.

3. Optional: Revert the read-only change.

To boot into normal mode again, simply revert the change from step 1 and choose the normal boot option in the GRUB menu.

Alternative Configurations[edit]

Ambox warning pn.svg.png Skip this section if the KVM Live-mode or Virtualbox Live-mode configuration steps above have already been completed.

Virtualbox and KVM:

VirtualBox only:

Footnotes[edit]


Want to help create awesome, up-to-date screenshots for the Whonix wiki? Help is most welcome!

https [archive] | (forcing) onion [archive]
Follow: Twitter.png Facebook.png 1280px-Gab text logo.svg.png Rss.png 1024px-Telegram 2019 Logo.svg.png Discourse logo.svg

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint.

Monero donate whonix.png