Hello, welcome to Whonix forums and thank you for your question!
Some may think I shouldn’t be saying that, but software signature verification in your case looks not to be the most important. Two reasons:
Windows Hosts are a lost cause, see:
I expand Whonix wiki that subject just today.
Surveys (example) have shown that very few users use software signature verification. Even fewer users have a sufficient understanding of the threat model. In case of an attack by an advanced adversary most users would get compromised. This is the very strong opinion of the author of this text. Usually the author of this text seldom raises strong opinions.
i just want you all to know that i have not abandoned this. i thought i’d have more time to get this done now. but, with the covid-19 issues, and how much net based interaction has become more essential since, i’ve found my waking hours consumed by work. as soon as life returns to a more normal pace, i promise that i will be contributing.
so, here is one of the variables in play for me. initially, i’d put steps to amend /etc/default/grub to include a number of hardening provisions. later, i’d opted to use the command line to add the whonix repo to /etc/apt/sources.list and upgrade/transform the system to kicksecure.
since i’m instructing via the “expert” install method, i’m debating starting from scratch to a degree, installing merely a base command line interface from the debian unofficial iso, emphasizing the use of a wired connection only during install, updating the apt repo to include the whonix repo, and then installing kicksecure-xfce from there.
I have reading … my voting its. " Option A : Add Whonix ™ Onion Repository. "
well Build a Script/InitScript to executing on final stage Debian installation/first boot. Or creating a Script just executing after a complete Expert Debian Installation ?!
EDIT:
Dont know if helps…
#!/bin/bash
WNXFAC="XFCE"
echo 'Check User "user" exists...'
if id "user" >/dev/null 2>&1; then
echo "Username user Exists"
if id -nG "user" | grep -qw "sudo"; then
echo "Username user belongs to sudo group"
else
echo "Adding Username user into sudo group.."
adduser user sudo
fi
else
echo "User Not Found.. Creating it.."
sudo adduser user
adduser user sudo
fi
addgroup --system console
adduser user console
Yes, I’m fallowing chapter 2B (2017) step by step.
I have an error in paragraph 74
quote “When prompted to “Enter any passphrase,” type the passphrase you created for your
encrypted hard drive in step 27 of this chapter and press “enter.” **If the process was a ** success, you will return to the command prompt.”
Hi @tempest that how it looks like in terminal:
Chapter 2B. Installing the Operating System on an Encrypted Internal Hard Drive Partition
with a USB Flash Drive Boot Key
(2017 guide) paragraph 73 (page 119 ) (debian 10 buster)
debian@josef:~$ su
Password:
root@josef:/home/debian# sudo -i
root@josef:~# dd if=/dev/urandom of=keyfile bs=512 count=16
16+0 records in
16+0 records out
8192 bytes (8.2 kB, 8.0 KiB) copied, 0.000121474 s, 60.4 MB/s
root@josef:~# nano /etc/crypttab
was:
sda5_crypt UUID=r7xxxxx-xxxx-xxx-xxxx none luks,discard
is:
sda5_crypt UUID=r7xxxxx-xxxx-xxx-xxxx /boot/keyfile.gpg luks,keyscript=/lib/cryptsetup/scripts/decrypt_gnupg
control + x and saved
root@josef:~# cryptsetup luksAddKey /dev/sda5 /keyfile
Enter any existing passphrase: Failed to open key file. ( I use the same pass like before, in partitioning steps)
root@josef:~# gpg -c --cipher-algo AES256 /keyfile
gpg: directory ‘/root/.gnupg’ created
gpg: keybox ‘/root/.gnupg/pubring.kbx’ created
gpg: can’t open ‘/keyfile’: No such file or directory
gpg: symmetric encryption of ‘/keyfile’ failed: No such file or directory
root@josef:~# nano /etc/crypttab
root@josef:~#
