Whonix Packages for Debian Hosts and Whonix Host Enhancements

From Whonix
Jump to navigation Jump to search

About this Packages for Debian Hosts Page
Contributor maintained wiki page.
Support Status testing
Difficulty medium
Contributor HulaHooparchive.org iconarchive.today icon
Support Support

How to install packages developed by Whonix in other Linux distributions such as your host operating system.

Introduction[edit]

Many of the packages developed under the Whonix umbrella can be thought of as independent projects in their own right. They are directly relevant to Debian hosts because they can increase privacy and security.

This guide shows how to download these select packages from the Whonix repository; they can be downloaded stand-alone or combined.

Info COMMUNITY SUPPORT ONLY : THIS WHOLE WIKI PAGE is only supported by the community. Whonix developers are very unlikely to provide free support for this content. See Community Support for further information, including implications and possible alternatives.

How-to: Install Whonix Packages[edit]

Add Whonix Repository[edit]

There are two different options to enable the Whonix APT repository. Choose one. [1]

Using extrepo

1. Install package extrepo.

sudo apt install extrepo

2. Enable the stable whonix APT repository. (See footnote for other options.) [2]

A : Non-Qubes-Whonix™

===

Whonix

sudo extrepo enable whonix

B : Qubes-Whonix™ Template

===

Qubes-Whonix Template (whonix-workstation-17)

sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 extrepo enable whonix

3. Advanced options.

For advanced options such as clearnet over Tor or onion. [3]

Please press on expand on the right side.

Optional.

Install apt-transport-tor.

Install package(s) apt-transport-tor following these instructions

1 Platform specific notice.

2 Kicksecure logo Update the package lists and upgrade the systemOnion network Logo.

sudo apt update && sudo apt full-upgrade

3 Install the apt-transport-tor package(s).

Using apt command line Kicksecure logo --no-install-recommends optionOnion network Logo is in most cases optional.

sudo apt install --no-install-recommends apt-transport-tor

4 Platform specific notice.

  • Non-Qubes-Whonix: No special notice.
  • Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Kicksecure logo Qubes Template ModificationOnion network Logo.

5 Done.

The procedure of installing package(s) apt-transport-tor is complete.

Find out filename.

ls -la /etc/apt/sources.list.d/extrepo_*

NOTE: Filename will be different if using a repository other than the stable repository such as the testers repository.

Open file /etc/apt/sources.list.d/extrepo_kicksecure.sources in an editor with root rights.

Select your platform.

Non-Qubes-Whonix™

See Kicksecure logo Open File with Root RightsOnion network Logo for detailed instructions on why to use sudoedit for better security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

Qubes-Whonix™

NOTES:

  • When using Qubes-Whonix, this needs to be done inside the Template.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

  • After applying this change, shutdown the Template.
  • All App Qubes based on the Template need to be restarted if they were already running.
  • This is a general procedure required for Qubes and unspecific to Qubes-Whonix™.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources

Choose either option A) or B).

  • A) Clearnet over Tor Repository: To enable clearnet over Tor, tor+ needs do be prepended in front of the https. The same in other words, look for Uris: https and replace it with Uris: tor+https .
  • B) Onion Repository: To enable onion, look for the line starting with Uris:. Delete the whole line. Or out-comment it by adding as hash ("#") in front of it. Then add a new line: Uris: tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion

4. Done.

The Whonix APT repository has been enabled [4]

Manually

Add Signing Key

Complete the following steps to add the Whonix Signing Key to the system's APT keyring.

Open a terminal.

1. Package curl needs to be installed.

Install package(s) curl following these instructions

1 Platform specific notice.

2 Kicksecure logo Update the package lists and upgrade the systemOnion network Logo.

sudo apt update && sudo apt full-upgrade

3 Install the curl package(s).

Using apt command line Kicksecure logo --no-install-recommends optionOnion network Logo is in most cases optional.

sudo apt install --no-install-recommends curl

4 Platform specific notice.

  • Non-Qubes-Whonix: No special notice.
  • Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Kicksecure logo Qubes Template ModificationOnion network Logo.

5 Done.

The procedure of installing package(s) curl is complete.

2. Download Whonix Signing Key. [5]

Choose your operating system.

A : Debian

If you are using Debian, run.

Choose TLS or onion.

TLS (Debian)

sudo curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.whonix.org/keys/derivative.asc

onion (Debian)

Downloading over onion requires an already functional system Tor.

sudo torsocks curl --output /usr/share/keyrings/derivative.asc --url http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/keys/derivative.asc

B : Qubes

If you are using a Qubes Debian Template, run.

Choose TLS or onion.

TLS (Qubes)

sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.whonix.org/keys/derivative.asc

onion (Qubes)

Downloading over onion requires an already functional system Tor.

sudo torsocks curl --output /usr/share/keyrings/derivative.asc --url http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/keys/derivative.asc

3. Users can check Whonix Signing Key for better security.

4. Done.

The procedure of adding the Whonix signing key is now complete.

Add Repository

Add the Whonix APT Repository.

Choose either: Option A, Option B OR Option C

A : Onion Rep.

Option A: Add Whonix Onion Repository.

To add Whonix Repository over Onion please install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add Whonix APT repository for default Whonix using Debian stable. At the time of writing this was bookworm.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

B : Clearnet Rep. via Tor

Option B: Add Whonix Clearnet Repository over Tor.

To add Whonix Repository over torified clearnet install apt-transport-tor from the Debian repository.

sudo apt install apt-transport-tor

Add Whonix APT repository for default Whonix using Debian stable. At the time of writing this was bookworm.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+https://deb.whonix.org bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

C : Clearnet Rep.

Option C: Add Whonix Clearnet Repository over clearnet.

NOTE: When later using Whonix repository tool, then this will be upgraded to "Clearnet Rep. via Tor", unless see footnote. [6]

To add Whonix Repository over clearnet please add Whonix APT repository for default Whonix using Debian stable. At the time of writing this was bookworm.

echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.whonix.org bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list

The procedure of adding the Whonix repository is now complete.

Package Installation[edit]

Install a supported package.

Note: Replace package-name with the actual name of a supported package.

Install package(s) package-name following these instructions

1 Platform specific notice.

2 Kicksecure logo Update the package lists and upgrade the systemOnion network Logo.

sudo apt update && sudo apt full-upgrade

3 Install the package-name package(s).

Using apt command line Kicksecure logo --no-install-recommends optionOnion network Logo is in most cases optional.

sudo apt install --no-install-recommends package-name

4 Platform specific notice.

  • Non-Qubes-Whonix: No special notice.
  • Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Kicksecure logo Qubes Template ModificationOnion network Logo.

5 Done.

The procedure of installing package(s) package-name is complete.

Supported Packages[edit]

Packages Looking for a Contributor[edit]

Footnotes[edit]

  1. ↑ extrepo vs manual:
    • Usability:
      • There are some detail usability differences. Using onion connection might be easier with manual method until Whonix gets ported to Debian 13 / trixie because extrepo might get onion support then.
      • Apart from that, extrepo's usability seems generally better.
    • Security:
      • A detailed comparative research of both methods is unavailable.
      • If usability is considered a security feature, then extrepo might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Whonix signing key. Manual key fingerprint verification not required.
      • The extrepo project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared with curl (written in C), it might be more secure.
    • Keeping support for manual method:
      • Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case extrepo signing key is outdated, get deprecated, it's easy to switch back to manual method.
  2. ↑ stable-proposed-updates repository: sudo extrepo enable whonix_proposed testers repository: sudo extrepo enable whonix_testers developers repository: sudo extrepo enable whonix_developers
  3. ↑ extrepo feature request: extrepo apt-transport-tor and onion supportarchive.org iconarchive.today icon
  4. ↑ forum discussion: extrepo - safely adding reposarchive.org iconarchive.today icon
  5. ↑ See Secure Downloads to understand why curl and the parameters --tlsv1.3 are used instead of wget.

    Placing an additional signing key into folder /usr/share/keyrings by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder /usr/share/keyrings using the signed-by keyword the signing key will be actually used. Therefore deleting keys in /usr/share/keyrings is optional if intending to disable an APT repository. See also APT Signing Key Folders.
  6. ↑ Unless using repository-dist --transport plain-tls. See also man repository-dist.
  7. ↑ https://phabricator.whonix.org/T524archive.org iconarchive.today icon
Notification image
Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!

Retrieved from "https://www.whonix.org/w/index.php?title=Packages_for_Debian_Hosts&oldid=101263"