Whonix-workstation security

Содержание:

Removal Instructions[edit]

1. Upgrade. Upgrade your system.

2. Cleanup.
When you installed and uninstalled some custom packages or dependencies changed in meanwhile, get rid of unneeded dependencies first.

sudo apt-get autoremove

sudo apt-get autoremove

3. Uninstall.
Let’s see how for example the uwt package could be uninstalled.

sudo apt-get purge uwt

sudo apt-get purge uwt

You will see something like this.

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  anon-banned-packages anon-iceweasel-warning gpl-sources-download knetattach-hide power-savings-disable-in-vms poweroff-passwordless rads scurl shared-folder-help swap-file-creator swappiness-lowest tor-ctrl
Use 'apt-get autoremove' to remove them.
The following packages will be REMOVED:
  anon-shared-packages-recommended* uwt* whonix-shared-packages-recommended*
0 upgraded, 0 newly installed, 3 to remove and 2 not upgraded.
After this operation, 152 kB disk space will be freed.
Do you want to continue [Y/n]?

4. Keep.
Now, there is a small issue. Next time you were to run sudo apt-get autoremove, you would also uninstall all packages listed under «The following packages were automatically installed and are no longer required:«. (Such as rads and others.) Since you most likely want to keep the other packages which were installed by the anon-shared-packages-recommended and the whonix-shared-packages-recommended meta packages, mark them as manually installed, so they do not get removed. You can conveniently do this using aptitude.

sudo aptitude keep-all

sudo aptitude keep-all

5. Done.
Make sure you understood the .

Alternatively, there might be a very crude workaround which can be seen and discussed here:https://forums.whonix.org/t/issues-with-removal-of-specific-packages-by-users-builders/653/9

Whonix ™ Workstation[edit]

Figure: LXDE Custom Workstation #1

Figure: LXDE Custom Workstation #2

Figure: LXDE Custom Workstation #3

Figure: Ubuntu Custom Workstation #1

Figure: Ubuntu Custom Workstation #2

On XFCEedit

Figure: XFCE Custom Workstation #1

Figure: XFCE Custom Workstation #2

Figure: XFCE Custom Workstation #3

Figure: XFCE Custom Workstation #4

Images Licenseedit

The license for each image is footnoted and most are in the public domain. These screenshots can be freely shared or uploaded to other locations.

If these screenshots are uploaded, then image users are kindly asked to notify the Whonix team directly and to add a link to the Whonix homepage.

Footnotesedit

The selection of images captures common Whonix activities on both the Non-Qubes-Whonix and Qubes-Whonix platforms. Further images of common Debian software running on the Whonix platform can be found here.

If readers notice any missing categories or images which are not up-to-date, feel free to add your own.

Picture Creator: Originally contributed by CJ, modified by Patrick Schleizer. License: CC0 1.0 Universal (CC0 1.0) Public Domain Dedication
The Stream Isolation Graphic has been contributed by: Cuan Knaggs – graphic and web design revolver print media – web design – web development – cms – e-commerce. License: CC0 1.0 Universal (CC0 1.0) Public Domain Dedication
↑ Screenshot Creator: torjunkie.
https://docs.bisq.network/getting-started.html
↑ Screenshot Creator: 0brand.
↑ Screenshot Creator: tempest.
↑ Screenshot Creator: Patrick Schleizer.
↑ Screenshot Creator: TNT_BOM_BOM.
↑ Screenshot Creator: iry.
↑ Screenshot Creator: troubadour.
Appropriate attribution is required for images which are already in the public domain.

Whonix is Supported by Evolution Host DDoS
Protected VPS. Stay private and get your VPS with Bitcoin or Monero.

Follow:

Donate:

Share:
|

Interested in becoming an author for the Whonix News Blog or writing about anonymity, privacy and security? Please get in touch!

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to , then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 — 2020 ENCRYPTED SUPPORT LP. Whonix is a trademark. Whonix is a licensee of the Open Invention Network . Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software as Whonix itself. (Why?)

Whonix is a derivative of and not affiliated with Debian . Debian is a registered trademark owned by Software in the Public Interest, Inc .

Whonix is produced independently from the Tor anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.

Office Suite[edit]

LibreOffice homepage (Debian package ) is recommended. It is a fully-featured office productivity suite that provides a near drop-in replacement for Microsoft (R) Office. A word processor is included, along with spreadsheet and presentation applications.

To install it: → →

Install .

1. Update the package lists.

sudo apt-get update

sudo apt-get update

2. Upgrade the system.

sudo apt-get dist-upgrade

sudo apt-get dist-upgrade

3. Install the package.

sudo apt-get install libreoffice

sudo apt-get install libreoffice

The procedure of installing is complete.

To launch these applications: →

Figure: LibreOffice Software in Whonix

What are the Advantages of Whonix?[edit]

Whonix realistically addresses common attack vectors.

An is a label which is used to identify a computer on the Internet. A simple analogy is an IP address is similar to a car license plate.

Hiding IP addresses is technically difficult for software. There is always a risk of so-called IP leaks, whereby a user mistakenly thinks the IP address is hidden when it is actually not.

Whonix is the best solution to prevent IP leaks because it uses a more solid . IP leak issues that previously applied to other software were not applicable to Whonix in a number of cases; see Whonix Protection against Real World Attacks.

IP leaks are not the only issue that can break a user’s anonymity. Other threats include time attacks, keystroke deanonymization and data collection techniques. Whonix deploys to mitigate such attacks.

Configuration Overview[edit]

Configuration files are outlined below for:

OpenVPN server
OpenVPN clients
Tor hidden service
Tor clients
Asterisk SIP protocol
Asterisk extensions

Note: this is a chrooted configuration. If necessary, servers can also be isolated in virtual machines. Be sure to also update CPU microcode to protect against the Spectre and Meltdown vulnerabilities.

As an illustration, simply set up:

172.16.0.2/10.8.0.1 OpenVPN Server — bhyve VM on server.
172.16.0.3/10.8.0.10 OpenVPN Client with Apache — bhyve VM on server.
172.16.0.4/10.8.0.20 OpenVPN Client with Asterisk — bhyve VM on server.
172.16.0.5/10.8.0.30 OpenVPN Client with UnrealIRCd — bhyve VM on server.

…

172.31.0.9/10.8.10.10 OpenVPN Client with Apache — bhyve VM on client.
192.168.38.37/10.8.10.20 OpenVPN Client with UnrealIRCd — bhyve VM on client.

And so on. Next, set up static IP addresses in ccd directory for OpenVPN Client servers. Finally, generate encryption keys with OpenSSL (modified OpenSSL can be utilized for quantum-resistant cryptography).

Can I Speed Up Tor or the Whonix-Gateway ™?[edit]

Is there a way to configure the number of nodes in a circuit and to allow selection according to their speeds?

Reminder: Whonix Reliance on Debian (and Tor) — «Whonix is not a stripped down version of Debian; anything possible in «vanilla» Debian GNU/Linux can be replicated in Whonix .» Tor configurations are not limited by using Whonix .

Those who already know how to configure Tor in this way on the command line in vanilla Debian can follow the same procedure in Whonix-Gateway . This is not an endorsement for making these manual Tor changes because it is not recommended by Tor developers and thus the Whonix team. This is also the reason there are no instructions in the Whonix documentation to manipulate Tor nodes in this way.

That said, if general instructions were found describing how to achieve this on the host, then the same procedure could simply be repeated in Whonix-Gateway .

Настройка Whonix

Теперь пришло время настроить всё это дело для нормальной работы. И начать нужно с обновлений. В обоих окнах открываем терминалы и пишем:

стандартный пароль: changeme

Ждём пока обе системы обновятся, это может занять порядочно времени, а после окончания нужно проверить всё ли у нас в порядке, для этого в терминале вводим:

при этом, после выполнения ни в одном из пунктов не должно быть надписи “Warning”, если есть – повторяем с обновлением, если её нет значит всё хорошо и можем идти дальше.

Самое время поменять пароль от root и от user. Это тоже можно сделать на обоих системах. Пишем в терминале:

вводим дэфолтный пароль рута, а потом два раза новый, тоже самое повторяем и с учёткой user.

Кому нужен русский язык, можно обновить локалки:

в появившемся окне отмечаем пробелом все позиции где есть <RU> , табом переключаемся на ОК, жмём и перезагружаем систему.

Также можно добавить русскую раскладку клавиатуры. Для этого идем Настройки->Клавиатура, там выбираем вкладку “Раскладка”, убираем галку с “Использовать стандартные системные параметры”, выбираем комбинацию клавишь для изменения раскладки, жмём добавить и выбираем русский язык (ну или какой нужен)

Теперь обновим Tor Browser, для этого вводим в терминале:

Если есть желание можем ускорим скорость загрузки виртуалок, Для начала уменьшим таймаут GRUB, для этого нужно отредактировать файл /etc/default/grub :

там ищем параметр GRUB_TIMEOUT, по-умолчанию будет стоять 5, меняем на 0. И после этого нужно переконфигурировать GRUB:

Сохраняем Ctrl+S и выходим Ctrl+X.

При запуске Whonix, существует 10 секундная задержка, чтобы её убрать нужно отредактировать файл /etc/rads.d/30_default.conf:

Ищем строчку rads_wait_seconds=10 и меняем значение на поменьше (например 2), также сохраняем и выходим.

В принципе, если ты планируешь использовать именно Whonix, дальнейшая настройка очень ситуативна и зависит от твоих потребностей и сводится к установке и настройке соответствующего софта, коего в это ОС практически нет, поэтому каждому предоставлена возможность ставить то что ему хочется. Поэтому, в связи с индивидуальностью данного вопроса, останавливаться на нём я не вижу смыслы и мы переходим ко второй части нашей истории в которой, для начала, вместо Whonix Workstation мы будем использовать Kali Linux и пустим трафик из неё через Whonix Gateway.

Hardware Purchases[edit]

Before purchasing any hardware specifically for Qubes, consider Qubes Certified Hardware , Qubes Hardware Testing or at least the hardware compatibility list (HCL) for suitable models. Without referring to any of these, there is a chance that a computer without the above specifications will be incompatible with Qubes.

Also note the fairly priced Insurgo PrivacyBeast X230 is the first custom, refurbished laptop to exceed all Qubes hardware certification requirements. For detailed specifications and pricing, see: Insurgo PrivacyBeast X230 Laptop — QubesOS Certified & preinstalled — Single Order .

Footnotesedit

This is more secure because an attacker must subvert the hypervisor, which is far more difficult than exploiting a host operating system.
Custom-Workstation: Self-made builds can be run on any real or virtual hardware, so long as they are behind a Whonix-Gateway . Tor Browser binaries are only available for a limited number of platforms (Windows, Linux, BSD and MacOS).
Unsupported: QEMU
Unsupported: VMware
↑
The virtual machine can work with as low as 256 MB RAM, but resource intensive operations like kernel package upgrades that rebuild the initrd might leave the virtual machine in a frozen state. It might run with 196 MB RAM or even less. Experimentation with RAM lower than 256 MB is up to the user; please share your results.
https://www.qubes-os.org/doc/system-requirements/
Qubes system requirements are directly sourced from https://www.qubes-os.org/doc/system-requirements/
This is required for running HVM domains , such as Windows-based AppVMs.
Users report problems in creating DisposableVMs and running multiple VMs in parallel with only 4 GB RAM. 8 GB RAM is nearly exhausted with Qubes-Whonix VMs running in parallel with the , and AppVMs.
To prevent malicious compromise of dom0 via USB mice, keyboards or other USB devices.
https://github.com/QubesOS/qubes-issues/issues/3208
This includes:
- Binary-blob-free Coreboot initialization, including native graphic initialization.
- Heads provides an Anti-evil Maid (AEM) firmware solution and protects against malicious interdiction.
- Intel ME is neutered and unnecessary modules involved in main CPU initialization have been deleted.
- Ships with Qubes OS pre-installed (with full-disk encryption), with the final disk encryption key being regenerated when first powered on by the buyer.

Whonix is Supported by Evolution Host DDoS
Protected VPS. Stay private and get your VPS with Bitcoin or Monero.

Follow:

Donate:

Share:
|

Join us in testing our new AppArmor profiles for improved security! (forum discussion )

Whonix is a derivative of and not affiliated with Debian . Debian is a registered trademark owned by Software in the Public Interest, Inc .

Whonix is produced independently from the Tor anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else.

Best Practice[edit]

It is strongly recommended the user keep a master copy of the Whonix-Workstation VM which is:

Kept updated.
Does not have any additional software installed.
Does not have any default settings changed.
Is not used directly for any activities.

Regular clean snapshots or clones of the master VM should be made for activities that require anonymity. Particular care must be taken that clean and unclean states are never mixed up!

The correct method for the safest operation of Non-Qubes-Whonix is as follows:

Import both VMs into the virtualizer.
Start both the Whonix-Gateway and Whonix-Workstation VMs.
.
After the updates have finished, shut down both VMs. Do not browse anywhere or open any unauthenticated communication channels to the internet.
Create snapshots of both VMs in their clean state.
Only use the snapshots for browsing or initiating any external connections.

Note: The only exception made is running apt, since it has a guaranteed way to securely download and verify packages.

Servers and Privacy[edit]

Even with end-to-end encryption, VoIP servers servers can log call signalling metadata. This is not a major threat if:

VoIP IDs are anonymously registered (no personal data is required for signing up).
All parties only and always connect over Tor and have never used (or will use) accounts over clearnet.
All calls are encrypted end-to-end.
No communications occur with anonymous strangers.

In this case it is unlikely a malicious server could cause much harm from logging or other actions.

Other than the factors outlined in this introduction section, no additional anonymity or security problems have been identified for VoIP. That said, this configuration is less tested in Whonix so the performance and voice quality could be quite variable. If this activity is necessary, then it is recommended to test the performance of VoIP software for yourself and to provide feedback about the experience.

Toxedit

Tox looks like a promising solution for secure, encrypted communications. The official client implementation is based on the TokTok protocol library, which is very feature-rich and has a variety of functions besides VoIP. By default, Tox does not attempt to cloak your IP address from authorized contacts. However, Tox is the only Tor compatible VoIP solution we know of, allowing communication with others even if they are not anonymous. Desktop versions are available for every major OS, however mobile support is lacking.

To learn more, refer to .

Basics[edit]

By default, Whonix assumes that Whonix-Gateway and Whonix-Workstation are connected by (virtual) LAN cable. Wireless technologies are not recommended as a malware compromised Whonix-Workstation could access (other) wireless access points and subsequently connect without Tor or find user’s location based on WiFi SSIDs. Using a (virtual) cable enforces that Whonix-Workstation can only connect through Whonix-Gateway . For the same reason, connections to Whonix-Gateway over the internet are also not recommended.

By default, connections between Whonix-Workstation and Whonix-Gateway are neither authenticated nor encrypted. The above (virtual) LAN connection between Whonix-Workstation and Whonix-Gateway is assumed to be secure. Adding authentication and/or encryption by default would further increase the complexity of Whonix , which is to be avoided as explained in earlier chapters.

If you want to run Multiple Whonix-Workstation at the same time inside the same (virtual) isolated LAN, authentication should be added:

Inside virtual LANs:
- Authentication is enough.
- Encryption is not required. (When machines cannot be impersonated, MITM attacks are not possible from within the virtual LAN.)
Inside physical LANs:

If you want to connect to a Whonix-Gateway over insecure, untrusted, or unknown foreign networks (internet):

Both authentication and encryption should be added.
- Encryption is required to deny MITM eavesdropping.
- Authentication validates the identity of the connecting machine.

Footnotes[edit]

The following is unreliable due to gpg connectivity bugs .
```
sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg adv --keyserver hkp://ipv4.pool.sks-keyservers.net:80 --recv-keys 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA
```
sudo apt-key —keyring /etc/apt/trusted.gpg.d/whonix.gpg adv —keyserver hkp://ipv4.pool.sks-keyservers.net:80 —recv-keys 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA

is required by .
is required, because…

sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg add ~/patrick.asc

gpg: failed to start agent '/usr/bin/gpg-agent': No such file or directory
gpg: can't connect to the agent: No such file or directory

For reasoning why is not being used and why is and parameters are being used instead, see Secure Downloads.
https://phabricator.whonix.org/T524