Community Support Only!

Introduction[edit]

Community Support Only!:
	Community Support Only means Whonix ™ developers are unlikely to provide free support for wiki chapters or pages with this tag. See Community Support for further information, including implications and possible alternatives.

Whonix-Gateway ™ supports torification of any operating system, including Microsoft Windows and others.

Using a default workstation is easier and provides more Security out of the box! It is your responsibility to get the same security features for a Whonix-Custom-Workstation ™, see Security Comparison: Whonix ™-Download-Workstation vs. Whonix-Custom-Workstation ™ at the bottom of the page for details.

Also note that it's strongly discouraged to anonymize VMs that have once connected to the clearnet. It could be the case that they might have leaked an identifier or created some network fingerprint that is still recognizable even when running it with Tor. Using it would unmask your traffic.

Windows-Whonix-Workstation ™[edit]

Introduction[edit]

Microsoft Windows XP, Vista, 7, 8, 10 are known to work behind Whonix-Gateway ™. While it is possible, it is not recommended and only for advanced users. This is because, there are issues with Windows. Those are not Whonix ™ issues. Whonix ™ developers cannot fix those issues. One issue is, that Windows is closed source. Rather, Windows is affected by Transparent Proxy Leaks ^[archive] and other issues. For more information and depending on your security requirements, read the following chapters.

Easy[edit]

This is the easiest, but least secure option. (#more security)

Start VM and Install Operating System

1. Start the newly created VM (for example: myVM).
2. Insert the installation DVD.
3. Updates don't have to installed while installing the OS. Post-install, apply updates after the network has been set up.
4. The username is: user. The computer name is: host

Configure network.

For Windows 7 (similar in Windows XP): In Control Panel → Network and Sharing Center: click on "Change adapter settings" Right-click on local area connection > properties In property window: double-click Internet Protocol Version 4, use the following settings:

## increment last octet of IP address on additional workstations
IP address 10.152.152.50
Subnet netmask 255.255.192.0
Default gateway 10.152.152.10
Preferred DNS server 10.152.152.10

Download operating system updates.

Tor Browser Settings[edit]

Start TB without Tor.bat

SET TOR_SKIP_LAUNCH=1

"Start Tor Browser.lnk"

Whonix ™-FreeBSD-Workstation[edit]

Create a new FreeBSD VM on VirtualBox

VirtualBox → Machine → New → Next → Enter Name (for example: myVM) → Enter Operating System and Version → Next → define RAM → Next → create a new hdd (or not) → Next → disk format doesn't matter, VDI works fine however → Next → dynamically or fixed size is a matter of preference → Next hdd size and location is a matter of preference → Next → Create

Install FreeBSD and upgrade it

This is necessary as freebsd-update or pkg do not support socks.

## Base OS patches as root
root_shell> freebsd-update fetch install 

#Application updates
root_shell> pkg upgrade

You will need a http proxy chained to tor gateway to torify pkg or freebsd-update, else you risk loosing patches. Use one of privoxy/proxychains/tsocks when using the Whonix-Gateway ™.

Install necessary applications.

root_shell> pkg install privoxy

After this shutdown the VM.

root_shell> shutdown -p now

Change the VirtualBox VM settings

Choose the newly created VM (for example: myVM) → Settings → System → Motherboard → Hardware Clock in UTC

System → Motherboard → Pointing Device → PS/2 Mouse (required so that USB controller may be disabled)

System → Processor → Enable PAE/NX if available

Network → Adapter 1 → attached to Internal Network (Important!)

Network → Adapter 1 → Name (of Internal Network) (Important!): Whonix ™ (Note: It is Whonix ™, not whonix. Case sensitive. Capital W.)

USB → uncheck Enable USB controller

→ OK

Start VM and proceed to configure the OS inside the VM.

Configure network.

In your Custom-Workstation. Open a terminal and edit as a privileged user /etc/rc.conf

You need to configure a single interface, here it is em0, there should not be any other 'ifconfig' statements:

## Increment the octect of IP address for configuring other workstations.
ifconfig_em0="inet 10.152.152.12 netmask 255.255.192.0"
defaultrouter="10.152.152.10"

For the address resolution to work. Open file /etc/resolv.conf in an editor with root rights.

sudoedit /etc/resolv.conf

and delete everything, then add

nameserver 10.152.152.10

Restart network service:

root_shell> service netif restart

Confirm changes by running ifconfig.

Whonix ™-OpenBSD-Workstation[edit]

1. Download OpenBSD iso.

Go to: https://www.openbsd.org/ ^[archive]

Download installXX.iso (current version: install67.iso) from https://cdn.openbsd.org/pub/OpenBSD/6.7/amd64/ ^[archive] and the SHA256 and SHA256.sig files.

2. Verify OpenBSD iso.

In Whonix-Workstation or Debian-based systems. Install the signify-openbsd package.

sudo apt update
sudo apt install signify-openbsd

Install OpenBSD keys. The version in buster only contains older keys, so install a newer version of the signify-openbsd-keys package. Temporarily replace your stable repository with testing:

sudo sed -i s/bullseye/testing/g /etc/apt/sources.list.d/debian.list

sudo apt update
sudo apt install signify-openbsd-keys

Change your repositories back to stable.

sudo sed -i s/testing/bullseye/g /etc/apt/sources.list.d/debian.list

Change directory to where you downloaded install67.iso, SHA256, and SHA256.sig.

cd /home/user/Downloads

Verify OpenBSD iso.

signify-openbsd -C -p /usr/share/signify-openbsd-keys/openbsd-67-base.pub -x SHA256.sig install67.iso

Must show

install67.iso: OK

3. Begin installation of OpenBSD.

Create, configure and boot your virtual machine from install67.iso according to instructions specific to your hypervisor.

4. Install OpenBSD.

Once the system boots from the iso, you will be prompted by:

Welcome to the OpenBSD/amd64 6.7 installation program.
(I)nstall, (U)pgrade, (A)utoinstall, or (S)hell?

Type I to install and press Enter.

Choose your keyboard layout ('?' or 'L' for list) [default]

Keep default and press Enter.

System hostname? (short form, e.g. 'foo')

Type host and press Enter.

Which network interface do you wish to configure? (or 'done') [xxx0]

Press Enter.

IPv4 address for xxx0? (or 'dhcp' or 'none') [dhcp]

Note: xxx0 will be something else instead, em0 or specific to your hypervisor.

Qubes-Whonix ™: Enter address of the VM (can be viewed in the qube's settings).

Non-Qubes-Whonix ™:

10.152.152.12

Netmask for xxx0? [255.255.255.0]

Qubes-Whonix ™:

255.255.255.255

Non-Qubes-Whonix ™:

255.255.192.0

IPv6 address for xxx0? (or 'autoconf' or 'none') [none]

Keep none and press Enter.

Which network interface do you wish to configure? (or 'done') [done]

Continue.

DNS domain name? (e.g. 'example.com') [my.domain]

Enter localdomain.

DNS nameservers? (IP address list or 'none') [none]

Qubes-Whonix ™: Enter address of your Whonix-Gateway (can be viewed in the qube's settings).

Non-Qubes-Whonix ™:

10.152.152.10

Password for root account? (will not echo)

Type your desired root password.

Start sshd(8) by default? [yes]

Type no and press Enter.

Do you expect to run the X Window System? [yes]

Keep default and continue.

Do you want the X Window System to be started by xenodm(1)? [no]

Keep default and continue.

Setup a user? (enter a lower-case loginname, or 'no') [no]

Enter user.

Available disks are: sd0 sd1 sd2

Which disk is the root disk? ('?' for details) [sd0]

Continue.

Use (W)hole disk MBR, whole disk (G)PT or (E)dit? [whole]

Continue.

Use (A)uto layout, (E)dit auto layout, or create (C)ustom layout? [a]

E to edit, because /usr will need more space than the default.

sd0>

Type h or ? for help.

Type p M to print the disk layout in megabytes.

Type d e to remove the /home partition (you will set it up on another disk).

Type w to write label to disk.

Type m d to modify the /usr partition and expand it.

offset: [xxxxxxx]

Keep and press Enter.

size: [xxxxxxx]

Enter your desired size here, either in bytes or megabytes, at least 5120.0M or more recommended.

FS type: [4.2BSD]

Keep and press Enter.

mount point: [/usr]

Keep and press Enter.

w to write label to disk.

p M again to print the disk layout in megabytes and make sure the changes were written correctly.

q to quit and save changes.

Which disk do you wish to initialize? (or 'done') [done]

Enter sd1

Use (W)hole disk MBR, whole disk (G)PT or (E)dit? [whole]

E to edit.

Type edit 0

Type A6 and press Enter.

Do you wish to edit in CHS mode? [n]

Keep n.

Partition offset [0 - xxxxxxx]: [0]

Keep.

Partition size [1 - xxxxxxx]

Type your desired size or use the maximum and enter.

w to write changes to disk.

quit to save changes and exit.

Label editor (enter '?' for help at any prompt)

p M to print the disk layout in megabytes.

Type a to add a partition.

offset: [0]

Keep.

size: [xxxxxxx]

Type desired size in megabytes or use the maximum and enter.

FS type: [4.2BSD]

Keep.

mount point: [none]

Type /home and press Enter.

sd1*>

w to write changes to disk.

q to save changes and exit.

Which disk do you wish to initialize? (or 'done') [done]

Done.

Proceed with the installation.

Directory does not contain SHA256.sig. Continue without verification?

yes can be typed safely (explained in OpenBSD installation FAQ).

What timezone are you in? ('?' for list)

Enter UTC.

Exit to (S)hell, (H)alt or (R)eboot? [reboot]

Reboot.

5. Configure Whonix-OpenBSD Workstation.

Login as root.

Connect the Whonix-OpenBSD workstation to the Gateway.

Run

vi /etc/mygate

Press a to append text and type the address of the Whonix-Gateway.

Non-Qubes-Whonix ™:

10.152.152.10

Press Esc.

Type :w to write the file. Type :q to exit.

vi /etc/ntpd.conf

a to append text, then comment all lines. They will not be needed as ntpd is broken behind Whonix-Gateway.

:w to write the file. :q to exit.

rcctl disable ntpd

to prevent it from starting.

Configure network interface.

ls /etc

Should show a file hostname.xxx0.

vi /etc/hostname.xxx0

Change the cursor position to the end of

inet [address of VM]

and hold x to delete everything after

inet [address of VM]

Instead append, enter a new line, and type

Non-Qubes-Whonix ™:

netmask 255.255.192.0

Qubes-Whonix ™:

netmask 255.255.255.255

Esc, :w, :q.

Run

sh /etc/netstart

to apply the changes.

6. Install system updates.

Run

syspatch

Reboot.

7. Optional: Install a desktop environment (Xfce used as example here.)

As root:

pkg_add xfce consolekit2 slim slim-themes

Configure Xfce.

touch /etc/rc.conf.local /etc/rc.local /root/.xinitrc /home/user/.xinitrc

echo "exec /usr/local/bin/ck-launch-session /usr/local/bin/startxfce4" >> /root/.xinitrc

echo "exec /usr/local/bin/ck-launch-session /usr/local/bin/startxfce4" >> /home/user/.xinitrc

echo 'pkg_scripts="messagebus avahi_daemon"' >> /etc/rc.conf.local

echo "/etc/rc.d/slim start" >> /etc/rc.local

8. Optional: Install packages to increase usability.

As root:

pkg_add bash sudo nano

Allow user to use sudo.

As root, run:

visudo /etc/sudoers

Uncomment the line.

%wheel ALL=(ALL) SETENV: ALL

Optional: Change shell to bash. As root:

chsh -s /usr/local/bin/bash

Repeat for user user.

9. Install torsocks.

sudo pkg_add torsocks

Tor will be installed as a dependency. To prevent it from automatically starting, comment the line

RunAsDaemon 1

in /etc/tor/torrc.

Configure torsocks.

sudoedit /etc/torsocks.conf

or

sudo nano /etc/torsocks.conf

Make sure the following lines are present and uncommented:

TorAddress [address of Whonix-Gateway]
TorPort 9050

Whonix ™-GNU/Linux-Workstation[edit]

Easy[edit]

This is the easiest, but least secure option. (#more security)

Start VM and Install Operating System

1. Start the newly created VM (for example: myVM).
2. Insert the installation DVD.
3. Updates don't have to installed while installing the OS. Post-install, apply updates after the network has been set up.
4. The username is: user. The computer name is: host

Configure network.

For Qubes-Whonix ™, you do not have to configure the network.

sudoedit /etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface, leave as it is
auto lo
iface lo inet loopback

auto eth0
#iface eth0 inet dhcp
iface eth0 inet static
# increment last octet of IP address on additional workstations
       address 10.152.152.12
       netmask 255.255.192.0
       #network 10.152.152.0
       #broadcast 10.152.152.255
       gateway 10.152.152.10

sudoedit /etc/resolv.conf

nameserver 10.152.152.10

Download operating system updates.

For Debian based Linux, such as Ubuntu, see Updates.

Configure Tor Browser Settings[edit]

sudoedit /etc/environment

## Deactivate tor-launcher,
## a Vidalia replacement as browser extension,
## to prevent running Tor over Tor.
## https://gitlab.torproject.org/legacy/trac/-/issues/6009
## https://gitweb.torproject.org/tor-launcher.git
TOR_SKIP_LAUNCH=1

## Environment variable to disable the "TorButton" →
## "Open Network Settings..." menu item. It is not useful and confusing to have
## on a workstation, because this is forbidden for security reasons. Tor must be
## configured on the gateway.
TOR_NO_DISPLAY_NETWORK_SETTINGS=1

## environment variable to skip TorButton control port verification
## https://gitlab.torproject.org/legacy/trac/-/issues/13079
TOR_SKIP_CONTROLPORTTEST=1

env

TOR_NO_DISPLAY_NETWORK_SETTINGS=1
TOR_SKIP_CONTROLPORTTEST=1
TOR_SKIP_LAUNCH=1

mousepad ~/.tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/user.js

nano ~/.tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/user.js

user_pref("extensions.torbutton.use_privoxy", false);
user_pref("extensions.torbutton.settings_method", "custom");
user_pref("extensions.torbutton.socks_host", "10.152.152.10");
user_pref("extensions.torbutton.socks_port", 9100);
user_pref("network.proxy.socks", "10.152.152.10");
user_pref("network.proxy.socks_port", 9100);
user_pref("extensions.torbutton.custom.socks_host", "10.152.152.10");
user_pref("extensions.torbutton.custom.socks_port", 9100);
user_pref("extensions.torlauncher.control_host", "10.152.152.10");
user_pref("extensions.torlauncher.control_port", 9052);

Disable system-tor over Tor[edit]

system-tor must also be disabled to prevent Tor over Tor.

In the terminal, run.

Stop Tor.

sudo systemctl stop tor

Prevent Tor service from restarting after reboot.

sudo systemctl mask tor

The process is now complete.

Testing[edit]

cd ~/.tb/tor-browser/Browser

./start-tor-browser

sudo systemctl status tor@default

tor@default.service - Anonymizing overlay network for TCP
   Loaded: loaded (/lib/systemd/system/tor@default.service; static; vendor prese
  Drop-In: /lib/systemd/system/tor@default.service.d
           └─30_qubes.conf
   Active: inactive (dead)

sudo ps aux | grep tor

debian-+   707  0.1  0.9  89320 36400 ?        Ss   21:15   0:01 /usr/bin/tor --defaults-torrc /usr/share/tor/tor-service-defaults-torrc -f /etc/tor/torrc --RunAsDaemon 0

Whonix ™-Android-Workstation[edit]

Community Support Only!

With Static IP[edit]

Preferred!

VM settings are the same: attach the network adapter to the internal network named Whonix.

Configure Android x86 to use a static IP. On the Android VM run the following in the Terminal Emulator (tested on Nougat):

su

ifconfig eth0 10.152.152.12 netmask 255.255.192.0

ip rule add from all lookup main pref 0

busybox route add default gw 10.152.152.10

ndc resolver setnetdns 100 localdomain 10.152.152.10

Static IP routing and DNS should now be working. Note that ping uses ICMP and therefore is unsupported, so open the browser to check your connection.

With DHCP[edit]

sudo apt update

sudo apt full-upgrade

sudo apt install --no-install-recommends isc-dhcp-server

sudoedit /etc/dhcp/dhcpd.conf

option domain-name "whonix";
option domain-name-servers 10.152.152.10;
subnet 10.152.128.0 netmask 255.255.192.0 {
        range 10.152.152.12 10.152.152.15;
        option subnet-mask 255.255.192.0;
        option broadcast-address 10.152.191.255;
        option routers 10.152.152.10;
}
default-lease-time 600;
max-lease-time 7200;

sudo dpkg-reconfigure isc-dhcp-server

More security[edit]

Recommendations:

• Verify operating system installation CD, compare with sha256 hash or even better verify the gpg signature, if available.
• Install while the Virtual Machine has no internet connection.
• Set your username to user.
• Disable Internet Time Syncing.
• Set your Time Zone to UTC.
• Set up a static IP.
• In case you want to run more than one Whonix-Workstation ™ at the same time, it is recommended reading the Introduction in the Multiple Whonix-Workstation ™ article.
• Read Basic Security Guide, Advanced Security Guide, Documentation and Design (which is Whonix ™-Example-Implementation-Workstation (based on Debian GNU/Linux) specific) and try to apply as much from it to Windows as possible.

Even more security[edit]

General[edit]

Recommendations:

• Prevent Transparent Proxy Leaks ^[archive] by disabling Whonix-Gateway ™ Transparent Proxy feature. Instead use your Windows Whonix-Workstation ™ behind an Isolating Proxy ^[archive]. See Stream Isolation for more information and instructions on how to disable the Transparent Proxy feature.
• Check your host clock out of band (use a watch or atomic clock).
• Set your host and your Workstation clock to show seconds as well. After booting the Whonix ™-Windows-Workstation, add a random skew to your clock, maybe +/- 1 to 30 seconds. Optimal values are still under investigation. For reference, see Whonix ™ Secure And Distributed Time Synchronization Mechanism, it is Whonix ™-Example-Implementation-Workstation (based on Debian GNU/Linux) specific, but most information also applies to Windows. Since we are not aware of a tails_htp alternative for Windows, you have to do it manually.

VM settings[edit]

Qubes-Whonix ™ users can skip this.

vboxmanage list vms

VBoxManage modifyvm "yourvmname" --synthcpu on
VBoxManage modifyvm "yourvmname" --acpi on
VBoxManage modifyvm "yourvmname" --ioapic on
VBoxManage modifyvm "yourvmname" --rtcuseutc on
VBoxManage setextradata "yourvmname" "VBoxInternal/Devices/VMMDev/0/Config/GetHostTimeDisabled" "1"

VBoxManage modifyvm "yourvmname" --clipboard disabled

VBoxManage modifyvm "yourvmname" --draganddrop disabled

Whonix ™ Packages[edit]

Whonix ™ Debian Packages (overview ^[archive]), such as for example uwt ^[archive], are available for installation from source and Whonix ™ apt repository (example instructions ^[archive]). Installation (of some) anonymity/security/privacy/usability related ones of them might be interesting for users of Debian and Debian derivatives.

Note, that usage of these package outside of Whonix ™ is untested and there is no contributor that supports this use case.

The current Whonix ™ contributors can only maintain a limited amount of things, has limited resources and focuses on other priorities. If you have developer skills, would you be interested to contribute by co-maintaining one or another package for using them outside of Whonix ™?

Most security[edit]

Use the default Whonix ™ VMs and build them yourself from source.

Ubuntu[edit]

• General: Ubuntu Tips
• Ubuntu Tips#Guest_additions_for_Ubuntu

Debian[edit]

Whonix ™-Default/Download-Version is already based on Debian Wheezy / Stable. You may be interested to read:

• How to obtain Debian safely: Debian ISO gpg verification

Security Comparison: Whonix ™-Download-Workstation vs. Whonix-Custom-Workstation ™[edit]

Introduction[edit]

Read first: Comparison of different Whonix ™ variants!

Note: Whonix ™-BuildYourselfFromSource-Workstation is of course the same as Whonix ™-Download-Workstation.

Table[edit]

Conclusion[edit]

The Whonix ™-Download-Workstation is already preconfigured with all Whonix ™ extra security features.

A Whonix-Custom-Workstation ™ can be made (Your responsibility!) as secure as a Whonix ™-Download-Workstation. If you simply create ^[22] a Whonix-Custom-Workstation ™ it has still some security advantages, for example full IP/DNS protocol leak protection, but not all, for example it lacks Secure Distributed Network Time Synchronization. The details are listed in the table above.

Missing Documentation[edit]

You might wonder what "your responsibility" means. Some users are wondering, where the documentation for these aspects can be found. No documentation has been written yet. There is a lack of resources to maintain such instructions. I.e. writing them, and more so, keeping them up to date, testing them, answering support requests, fixing bugs and implementing feature requests. Please contribute. For more detailed explanation, see also Whonix ™ Packages.

References[edit]

Expand all Collapse all

	100px
Fosshost	About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow:

Support:

Donate:

Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Freedom Software / Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.