One of the coolest staple operating systems to always have in your toolkit is Whonix. Whonix has always been one of my personal mainstays in my arsenal of Linux operating systems, especially since it’s so different. So strap yourselves in, since people love them distro reviews, let’s learn about Whonix.
What is Whonix?
Whonix is not your traditional Linux operating system. Most people install Linux on real computers, virtual machines, or servers, but Whonix exclusively works on virtual machines. Also it requires that your computer supports virtual machines, and not just 1, but 2.
Whonix is incredibly distrustful of their “Workstation” virtual machine, which is where you conduct all the normal activities that you’d expect to do on Linux. To protect your privacy (and from all those loser sellouts with VPN sponsors), Whonix filters everything through the Tor network using a second lighter-weight virtual machine, the Gateway virtual machine.
Now if you were running Whonix with just one virtual machine, a virus or phishing email could in theory turn off the anonymity protections that Tor gives you, and deanonymize you. In fact, we know this has been done before by companies and governments in targeted attacks before.
Even if it was a child predator, Facebook is so messed up that they are willing to pay for 6 figure research to develop a cyber weapon for a government agency.
By using multiple virtual machines, malicious programs can’t just “turn off” Tor, they need to get past the virtual machine system you use, KVM or VirtualBox. In fact, if you use KVM, which I covered on the channel before, companies like Red Hat, Google, and Amazon have a vested interest in preventing people from doing just this to their data centers.
So you need to have not the most amazing computer, but one decent enough to run 2 other operating systems. And if you are going to use it, you can’t use an Apple Silicon Mac, and you need to use Linux and KVM to make the most out of it.
Another oddity for people who know me well is Whonix is based on Debian. The Whonix developers have mitigated a lot of the security issues that exist in Debian’s default installation and implemented further kernel hardening measures on top of it; so in my mind, if you’re going to use Debian, this is one of the ways to use it best.
Installation
Whonix has a page for installing VirtualBox, but I want to focus on KVM, which stumped me years ago getting into it. Whonix’s current KVM maintainer, HulaHoop, provides very in-depth instructions based on operating system.
Downloading the .QCOW files
Download Whonix Xfce.
Verify you received the authentic archive using the OpenPGP Signature by downloading it.
cd [the directory in which you downloaded the .libvirt.xz and the .asc]
Download HulaHoop’s OpenPGP key.
Import HulaHoop’s key to your GPG keyring.
gpg --keyid-format long --import --import-options show-only --with-fingerprint hulahoop.asc
Next, we need to verify the PGP key.
gpg --verify-options show-notations --verify Whonix*.libvirt.xz.asc Whonix*.libvirt.xz
If the download is authentic, we want to see:
gpg --verify-options show-notations --verify Whonix*.libvirt.xz.asc Whonix*.libvirt.xz
Do not continue if the verification fails. Try downloading Whonix again
The Whonix License Agreement
Extract the archive:
tar -xvf Whonix*.libvirt.xz
First we need to read the Whonix License Agreement. Unlike Microsoft’s end user license agreement, you can do whatever you want to Whonix, but you are 100% responsible for whatever you do, not them nor I am responsible for whatever happens.
more WHONIX_BINARY_LICENSE_AGREEMENT
To agree, enter the following:
touch WHONIX_BINARY_LICENSE_AGREEMENT_accepted
If you don’t accept, you can’t continue with the installation.
Importing the KVM Templates
First add the virtual machine networks:
sudo virsh -c qemu:///system net-define Whonix_external*.xml
sudo virsh -c qemu:///system net-define Whonix_internal*.xml
Next activate the virtual networks and import the images.
sudo virsh -c qemu:///system net-autostart Whonix-External
sudo virsh -c qemu:///system net-start Whonix-External
sudo virsh -c qemu:///system net-autostart Whonix-Internal
sudo virsh -c qemu:///system net-start Whonix-Internal
sudo virsh -c qemu:///system define Whonix-Gateway*.xml
sudo virsh -c qemu:///system define Whonix-Workstation*.xml
Finally, let’s move them in place. Don’t be alarmed that they are 100GB, they will be much smaller at first and will expand as you put more in them.
sudo mv Whonix-Gateway*.qcow2 /var/lib/libvirt/images/Whonix-Gateway.qcow2
sudo cp --sparse=always Whonix-Workstation*.qcow2 /var/lib/libvirt/images/Whonix-Workstation.qcow2
If the move is successful and you can dispose of the files.
First Setup
If you open virt-manager, you’ll see there’s two new entries:
- Whonix Workstation: This is where you conduct your browsing and desktop activities.
- Whonix Gateway: This is where you configure your connection to the Tor network.
There’s a specific order to launching the virtual machines. You can also make duplicates of the Workstation, but there isn’t much value into making duplicate Gateways.
There’s also a live boot mode, which allows you to boot into a completely disposable desktop session that will delete your files when powered off.
Logging In
First boot up Gateway. This will kick you into a TTY environment.
Default username: user
Default password: changeme
Next, change your password using passwd. You shouldn’t use the default password.
Connect to the network using sudo whonixsetup. Then wait for Tor to connect.
Finally, run updates. Whonix’s devs created a script which manages apt without root privileges:
upgrade-nonroot
Then repeat the same steps with Whonix Workstation, but no sudo whonixsetup. You will also need to open the Tor Browser and allow it to be fully updated.
Using Whonix
Whonix also places priority on your security first and foremost. That doesn’t mean that other operating systems don’t protect you, but in addition to being locked into a virtual machine, you can’t just install and use the same programs you like to use on Linux.
- Wine does not work due to a modified kernel parameter.
- The kernel hardening has made it harder to run Flatpaks in the past.
- Using other programs that use Tor within Whonix (OnionShare, Brave, etc) makes you stand out amongst others in the Tor network. This is because your traffic is being bounced twice as much as everyone else.
- Tor is not a place for illegal activity. Do not rely on it for protection.