|
|
| (35 intermediate revisions by the same user not shown) |
| Line 1: |
Line 1: |
| − | [http://dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/ Whonix] ([https://www.whonix.org/ clearnet link]) can be installed on the Talos using KVM. These instructions were tested with Whonix 15.
| + | #REDIRECT [[Kicksecure and Whonix]] |
| − | | |
| − | == Both Whonix-Gateway and Whonix-Workstation ==
| |
| − | | |
| − | Download Whonix from the [http://dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/KVM#Download_Whonix_.E2.84.A2 Whonix KVM download page] ([https://www.whonix.org/wiki/KVM#Download_Whonix_.E2.84.A2 clearnet link]).
| |
| − | | |
| − | Extract it:
| |
| − | | |
| − | tar -xvf Whonix*.libvirt.xz
| |
| − | | |
| − | Install the Whonix virtual networks:
| |
| − | | |
| − | virsh -c qemu:///system net-define Whonix_external*.xml
| |
| − | virsh -c qemu:///system net-define Whonix_internal*.xml
| |
| − | virsh -c qemu:///system net-autostart external
| |
| − | virsh -c qemu:///system net-start external
| |
| − | virsh -c qemu:///system net-autostart internal
| |
| − | virsh -c qemu:///system net-start internal
| |
| − | | |
| − | Then, create two Debian Buster ppc64el VM's, launch a root shell in each, and follow the below instructions for each VM.
| |
| − | | |
| − | Import the Whonix signing key ([https://github.com/Whonix/whonix-developer-meta-files/blob/master/README_generic.md#how-to-install-package-name-using-apt-get source]):
| |
| − | | |
| − | wget https://www.whonix.org/patrick.asc
| |
| − | apt-key --keyring /etc/apt/trusted.gpg.d/derivative.gpg add ~/patrick.asc
| |
| − | | |
| − | Add the Whonix package repository ([https://github.com/Whonix/whonix-developer-meta-files/blob/master/README_generic.md#how-to-install-package-name-using-apt-get source]):
| |
| − | | |
| − | <nowiki>echo "deb https://deb.whonix.org buster main" | tee /etc/apt/sources.list.d/derivative.list</nowiki>
| |
| − | | |
| − | == Whonix-Gateway ==
| |
| − | | |
| − | Run the following:
| |
| − | | |
| − | apt-get update
| |
| − | | |
| − | Then, run one of the following, depending on whether you want the Whonix-Gateway to use XFCE or CLI-only:
| |
| − | | |
| − | apt-get install non-qubes-whonix-gateway-xfce
| |
| − | | |
| − | apt-get install non-qubes-whonix-gateway-cli
| |
| − | | |
| − | If you get prompted with questions during package installation, you can choose the defaults.
| |
| − | | |
| − | The Whonix packages will install their own <code>sources.list</code> data in <code>/etc/apt/sources.list.d/debian.list</code>, which means you should delete the <code>sources.list</code> that Debian came with (in order to avoid warnings from <code>apt-get</code> about duplicated repos):
| |
| − | | |
| − | rm /etc/apt/sources.list
| |
| − | | |
| − | Shut off the VM.
| |
| − | | |
| − | Set the VM's NIC to use the <code>external</code> Network source.
| |
| − | | |
| − | Add a 2nd NIC to the VM, and set it to use the <code>internal</code> Network source.
| |
| − | | |
| − | Launch the VM again; Whonix-Gateway should be running.
| |
| − | | |
| − | If you get errors about the Tor service failing to start, this is probably a bug in Whonix's AppArmor configuration; you can fix it by editing the file <code>/etc/apparmor.d/tunables/home.d/live-mode</code> and commenting out the line <code>@{HOMEDIRS}+=/rw/home/</code> (i.e. prefix it with a <code>#</code> character, so it will look like <code>#@{HOMEDIRS}+=/rw/home/</code>). Restart the VM again and Tor should work.
| |
| − | | |
| − | == Whonix-Workstation ==
| |
| − | | |
| − | Run the following:
| |
| − | | |
| − | apt-get update
| |
| − | | |
| − | Then, run one of the following, depending on whether you want the Whonix-Workstation to use XFCE or CLI-only:
| |
| − | | |
| − | apt-get install non-qubes-whonix-workstation-xfce
| |
| − | | |
| − | apt-get install non-qubes-whonix-workstation-cli
| |
| − | | |
| − | If you get prompted with questions during package installation, you can choose the defaults.
| |
| − | | |
| − | The Whonix packages will install their own <code>sources.list</code> data in <code>/etc/apt/sources.list.d/debian.list</code>, which means you should delete the <code>sources.list</code> that Debian came with (in order to avoid warnings from <code>apt-get</code> about duplicated repos):
| |
| − | | |
| − | rm /etc/apt/sources.list
| |
| − | | |
| − | Shut off the VM.
| |
| − | | |
| − | Set the VM's NIC to use the <code>internal</code> Network source.
| |
| − | | |
| − | Launch the VM again; Whonix-Workstation should be running.
| |
| − | | |
| − | == Known Issues ==
| |
| − | | |
| − | === Checking for virtualization ===
| |
| − | | |
| − | <code>whonixcheck</code> in both VM's reports this error:
| |
| − | | |
| − | <nowiki>[ERROR] [whonixcheck] Virtualizer Failed to check for virtualization: Permission denied unsupported by Whonix developers! Whonixcheck aborted! (qubes_detected: false)
| |
| − | | |
| − | Using Virtualizer Failed to check for virtualization: Permission denied together with Whonix is recommended against, because it is rarely tested. [1] [2] [3] It could be made possible, but would require more Whonix contributors.
| |
| − | It may already work, but is highly experimental.
| |
| − | | |
| − | | |
| − | | |
| − | This might endanger your anonymity. Do not proceed unless you know what you are doing.
| |
| − | | |
| − | If you wish to ignore this warning and to continue whonixcheck anyway, you can set
| |
| − | WHONIXCHECK_NO_EXIT_ON_UNSUPPORTED_VIRTUALIZER="1"
| |
| − | in /etc/whonix.d/30_whonixcheck_default.conf.
| |
| − | | |
| − | Recommended action:
| |
| − | - Shut down.
| |
| − | - Read Whonix documentation [4].
| |
| − | - Use Whonix with a supported virtualizer or Physical Isolation [5].
| |
| − | | |
| − | Footnotes:
| |
| − | | |
| − | [1] https://www.whonix.org/wiki/LeakTests
| |
| − | [2] https://www.whonix.org/wiki/Test
| |
| − | [3] https://www.whonix.org/wiki/Protocol-Leak-Protection_and_Fingerprinting-Protection
| |
| − | [4] https://www.whonix.org/wiki/Documentation
| |
| − | [5] https://www.whonix.org/wiki/Physical_Isolation</nowiki>
| |
| − | | |
| − | It is not clear why this error shows up, or whether anything bad will happen if it's ignored. The only mention of this error that I can find in upstream documentation is [http://forums.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/t/error-virtualizer-unsupported-by-whonix-developers/4471 this forum thread], which doesn't have any solution.
| |
