260729 |*| |a|

Whonix 18 virtual machines on Debian 13 using KVM

~351s

Overview: This guide focuses on installing Whonix 18 on a Debian 13 host OS using the KVM (Kernel-based Virtual Machine) full virtualization solution.

Motivation

Users that need advanced security and privacy can benefit from the principle of security by isolation by running Whonix¹ (KVM²) virtual machines.

Whonix on the Qubes platform is probably the most extreme security setup, but it has relatively poor hardware support.

Note: if at all possible, avoid using VirtualBox due to Oracle's lack of transparency, known vulnerabilities, and licensing issues³.

Assumptions

you're logged in with a user that's part of the sudoer's group on a machine running Debian
HW requirements: CPU with AMD-V or Intel VT-x, recommended 4+ GB RAM, 20+ GB free space (SSD)
internet connection
basic terminal knowledge
~60 mins free time

0. Check virtualization support

Run lscpu | grep "Virtualization" to check if your hardware supports virtualization.

Hopefully, you should get one of the outputs below:

Virtualization: VT-x
Virtualization: AMD-V

1. KVM

1.1 Install

Open up a terminal on your host operating system, update the packages list, and install the required packages:

sudo apt update && sudo apt install --no-install-recommends qemu-kvm qemu-system-x86 libvirt-daemon-system libvirt-clients virt-manager gir1.2-spiceclientgtk-3.0 dnsmasq qemu-utils

1.2 Configure

Your regular user should be able to manage virtual machines without root. Add it to the libvirt and kvm groups:

sudo addgroup "$(whoami)" libvirt && sudo addgroup "$(whoami)" kvm

Reboot the machine with sudo reboot.

We can now enable and start KVM's default networking:

sudo virsh -c qemu:///system net-autostart default && sudo virsh -c qemu:///system net-start default

2. Whonix

2.1 Download

Download the latest image file from the Whonix website (currently 18.2.1.9 LXQt stable)⁴ and the associated signature:

wget https://www.whonix.org/download/libvirt/18.2.1.9/Whonix-LXQt-18.2.1.9.Intel_AMD64.qcow2.libvirt.xz && wget https://www.whonix.org/download/libvirt/18.2.1.9/Whonix-LXQt-18.2.1.9.Intel_AMD64.qcow2.libvirt.xz.asc

Note: you can alternatively download from the onionsite with torsocks wget [url].

2.2 Verify

To verify the image, we need the maintainer's OpenPGP signing key:

wget https://www.whonix.org/keys/derivative.asc

Check the key's fingerprint before importing it:

gpg --keyid-format long --import --import-options show-only --with-fingerprint derivative.asc

Only import the key if its fingerprint matches 916B 8D99 C38E AF5E 8ADC 7A2A 8D66 066A 2EEA CCDA:

gpg --import derivative.asc

Finally, we can start the cryptographic verification:

gpg --verify-options show-notations --verify Whonix*.libvirt.xz.asc Whonix*.libvirt.xz

You should see a gpg: Good signature from "Patrick Schleizer adrelanos@whonix.org" message.

Note: if you get a BAD signature output, restart from step 2.

Note: you can additionally check the GPG signature timestamp to avoid potential rollback/indefinite freeze attacks⁵.

Note: lastly you can confirm that the file name has not been tampered with by looking at the file@name OpenPGP notation⁶ (gpg Signature notation file@name=Whonix-LXQt-18.2.1.9.Intel__AMD64.qcow2.libvirt.xz)

2.3 Decompress

Decompress the .xz archive:

tar -xSvf Whonix*.libvirt.xz

Note: if sparse files are not supported use tar -xvf Whonix*.libvirt.xz instead.

2.4 License Agreement

Read and agree to the Whonix ToS/license:

more WHONIX_BINARY_LICENSE_AGREEMENT
touch WHONIX_BINARY_LICENSE_AGREEMENT_accepted

2.5 Import VM Templates

Add the virtual networks:

sudo virsh -c qemu:///system net-define Whonix_external*.xml && sudo virsh -c qemu:///system net-define Whonix_internal*.xml

Note: if the virtual bridge "virbrX" already exists, edit the Whonix_external*.xml and Whonix_internal*.xml files and change the name to something new (ie. virbr3).

Activate them:

sudo virsh -c qemu:///system net-autostart Whonix-External && sudo virsh -c qemu:///system net-start Whonix-External
sudo virsh -c qemu:///system net-autostart Whonix-Internal && sudo virsh -c qemu:///system net-start Whonix-Internal

Import the Gateway and Workstation images:

sudo virsh -c qemu:///system define Whonix-Gateway*.xml && sudo virsh -c qemu:///system define Whonix-Workstation*.xml

2.6 Move Image Files

sudo mv Whonix-Gateway*.qcow2 /var/lib/libvirt/images/Whonix-Gateway.qcow2
sudo mv Whonix-Workstation*.qcow2 /var/lib/libvirt/images/Whonix-Workstation.qcow2

Note: the image files can alternatively be copied with sudo cp --sparse=always.

2.7 (optional) Cleanup

Remove archive files and temporary folders:

rm Whonix* && rm -r WHONIX*

2.8 (optional) Increase memory

Note: Whonix-Gateway virtual machine needs to be given at least 512 MB of RAM to be able to start (CLI) but for the LXQt desktop environment it is recommended to allocate it 1-2 GB for optimal performance.

Before starting the machines, we can increase the maximum memory with:

virsh setmaxmem <vm_name> <memsize> --config

Set the actual memory:

virsh setmem <vm_name> <memsize> --config

Restart the VM:

virsh -c qemu:///system start <vm_name>

Note: replace <vm _name> with the virtual machine's name and <memsize> with the desired memory size; vCPU and memory allocation can also be set from the Virtual Machine Manager GUI.

2.9 Start Whonix

We first need to start Whonix-Gateway and then the Workstation-Workstation.

2.9.1 CLI

Start the Gateway:

sudo virsh start Whonix-Gateway

And the Workstation:

sudo virsh start Whonix-Workstation

2.9.2 GUI

Alternatively, start the Virtual Machine Manager from Start Menu > Applications > System > Virtual Machine Manager.

Start the Gateway and Workstation by clicking on Whonix-Gateway > Open > Play and then Whonix-Workstation > Open > Play.

3. Post install

3.1 Updates

Boot into PERSISTENT Mode | SYSMAINT Session⁶ and run upgrade-nonroot in both Gateway and Workstation to keep your system up-to-date.

3.2 Extra vCPUs

If you need to add more vCPUs to each machine, make sure to read more about CPU pinning⁷.

Here is an example XML configuration:

<!-- Gateway VM -->
<vcpu placement="static" cpuset="0-1">2</vcpu>
<cputune>
<vcpupin vcpu="0" cpuset="0"/>
<vcpupin vcpu="1" cpuset="1"/>
</cputune>

<!-- Workstation VM -->
<vcpu placement="static" cpuset="2-3">2</vcpu>
<cputune>
<vcpupin vcpu="0" cpuset="2"/>
<vcpupin vcpu="1" cpuset="3"/>
</cputune>

Note: check the Enable XML editing option in 'Virtual Machine Manager > Edit > Preferences > General' in order to modify each VM's template.

Observations

this setup might not be compatible with your threat model⁸
the Whonix Virtual Machine Images can be built from source for more security⁹
XML configuration can still be edited after the Machine was imported¹⁰
if available, add extra RAM and CPUs to VMs for better performance (2048+ MiB, 2 x vCPU)
at all times ensure the host clock has an accuracy of up to +/- 30 minutes to avoid Time Attacks¹¹
dig deeper: post installation security advice¹², common CLI commands¹³, advanced docs¹⁴, and the Whonix forums¹⁵

That's it, you can now use Whonix on Debian with KVM.

U260729: updated guide for Whonix version 18 which migrated from Xfce to LXQt.

1: https://www.whonix.org/↩︎
2: https://www.linux-kvm.org/↩︎
3: https://seclists.org/fulldisclosure/2012/Apr/343, https://www.oracle.com/corporate/security-practices/assurance/vulnerability/disclosure.html, https://forums.virtualbox.org/viewtopic.php?f=7&t=89395↩︎
4: https://www.whonix.org/wiki/About#Whonix_Version↩︎
5: https://theupdateframework.io/security/↩︎
6: https://www.whonix.org/wiki/Sysmaint↩︎
7: https://www.whonix.org/wiki/KVM#Adding_vCPUs↩︎
8: /threat-modeling-demystified/↩︎
9: https://www.whonix.org/wiki/KVM#Build_from_Scratch↩︎
10: https://www.whonix.org/wiki/KVM#Editing_an_Imported_Machine's_XML_Configuration↩︎
11: https://www.whonix.org/wiki/Time_Attacks↩︎
12: https://www.whonix.org/wiki/Post_Install_Advice↩︎
13: https://www.kicksecure.com/wiki/Common_CLI_Commands↩︎
14: https://www.whonix.org/wiki/Advanced_Documentation↩︎
15: https://forums.whonix.org/↩︎