We are currently experiencing a problem and, despite doing some research, I haven’t been able to find a solution. I would love to hear your thoughts and suggestions on how to resolve this permanently.
We are currently using the latest versions of both Whonix and VirtualBox. The issue is that I cannot mount an external disk that I want to use as a mount point. We are using the “user daily” mode, and for security reasons, I do not want to switch to user-sysmaint-split. I suppose I could remove user-sysmaint-split to solve the problem at its root, but I prefer not to do that.
Given this setup, does the architecture allow mounting and using a disk while remaining in “daily mode”?
Some of the terminology you’re using seems confused; you say that you don’t want to switch to user-sysmaint-split (which sounds like you don’t have it installed and like it that way), but that you are considering removing it (which sounds like you do have it installed and like it that way). Furthermore, there isn’t such a thing as “daily mode”; there is PERSISTENT Mode | USER Session | daily activities, and LIVE Mode | USER Session | daily activities, which operate in rather different ways. I think you have a standard Whonix installation, with user-sysmaint-split installed, and you want to keep it.
What is the external disk in this context? Is it a virtual disk image, a USB drive, or a physical disk? How are you providing the external disk to the VM? Are you attaching it as a new disk device? Are you using USB passthrough? Are you using a shared folder?
Apologies for explaining things in a confusing way. In my setup running Whonix 17, I was using an attached .vdi virtual disk. After upgrading to the latest Whonix version, I attached the .vdi disk again, but I cannot mount it in the “PERSISTENT Mode - User Session - Daily activities” session; I can only mount and use it in the “PERSISTENT Mode - Sysmaint Session - System maintenance tasks” session. Is it possible for the user session to use this? What steps should I follow?
The VM will see a .vdi virtual disk as an internal disk. In order to mount that, you will probably need to boot into a sysmaint session, then add configure a line to /etc/fstab that automatically mounts the disk as part of the boot process.
Yes, I edited /etc/fstab and added the UUID for the .vdi file, but it doesn’t show up in the Devices section. I was able to access it via the /media directory, but it doesn’t offer the same flexible disk usage as it did in Whonix 17. I can mount it if I use a System Maintenance Session, but device mounting has become much stricter due to user-sysmaint-split. Additionally, disk encryption cannot be used for a User Session in this setup.
It isn’t supposed to show up in the devices section, it should show up in whatever directory you specified in /etc/fstab.
I’m not sure what “flexible disk usage” means in this context, could you elaborate?
Sure it can. If the partition from the virtual disk is encrypted with LUKS, then add a line for the encrypted partition to /etc/crypttab, and mount the unlocked device in /etc/fstab. Then regenerate the initramfs. Once that’s done, you should get a prompt on bootup to decrypt the disk. Enter the disk’s passphrase, and it will unlock and mount it as part of the boot process.
(I’m being intentionally brief in the above description since it sounds like you’re proficient in Linux use already, I can elaborate more on the above if desired, and can save the instructions in the wiki somewhere.)
AxCrypt appears to be closed-source software, which carries inherent security risks and should usually be avoided:
I may be misunderstanding; AxCrypt would be third-party software, LUKS is part of Kicksecure and can be set up with some effort using standard Linux tools and configuration files (cryptsetup, parted, dracut, mkfs.ext4, /etc/crypttab, /etc/fstab). If you need to encrypt individual files, you can use Sequoia-PGP or a GPG frontend like KGpg:
If you mean that AxCrypt has a superior user interface, then yes, that’s probably true but it’s worth considering whether a nice user interface is worth the risk of malware/spyware from using proprietary software, especially proprietary encryption software.
Protect files and folders with strong encryption before sharing them or storing in Google Drive, OneDrive, or Dropbox with zero-knowledge encryption.
lol reminds me of the ads on youtube that sell TB external hard drives with “military grade encryption” = with zero-knowledge encryption equivilent buzzwords
Yes but are you trying to achieve a hidden volume that is encrypted or a just a encrypted volume by itself?
but it’s worth considering whether a nice user interface is worth the risk of malware/spyware from using proprietary software, especially proprietary encryption software.