Long Wiki Edits Thread

[nurmagoz]

@HulaHoop

What step exactly? I always update the guide to follow what Debian version is stable at the moment.

Yes if we talk about stable which is stretch then that might be still working , but im using now buster and testing it with vbox-whonix-15. so instructions for e.g which doesnt work like

virsh -c qemu:///system net-define Whonix-External.xml

It says:

error: failed to get network ‘Whonix-External’
error: Network not found: no network with matching name ‘Whonix-External’

This one i faced in buster , i dunno if something changed as well in stretch.

[torjunkie]

@Patrick

awesome, thanks for the notice!

No problem. BTW I forget why the v3 onion Whonix download links were removed form the relevant template(s)?

@nurmagoz

failed to get network ‘Whonix-External’

I saw someone (not me) editing KVM instructions talking about this exact naming issue (and name change) recently? Didn’t look closely, but something about Whonix (or external?) being dropped from network name.

[nurmagoz]

@torjunkie

I saw someone (not me) editing KVM instructions talking about this exact naming issue (and name change) recently? Didn’t look closely, but something about Whonix (or external?) being dropped from network name.

I dunno if thats the case then again wiki instructions must be updated to solve this issue.

[HulaHoop]

This ticket has some nice resources for testing screen resolution leaks from Tor Browser.

Where can I add this?

TBA: Window size rounding isn't used (#27083) · Issues · The Tor Project /...

[Patrick]

Browser Tests - Whonix fits and add a link from Tor Browser Advanced Topics too?

[Patrick]

Add disabling some drivers to the Hardware Threat Minimization guide.

Some users (like myself) don’t have an option to disable their webcam and microphone in their BIOS and don’t want to mess about with the insides of their computer. The next best thing to this would be to disable the drivers for the webcam and microphone so they cannot be used. It would be good to add steps for these to the Hardware Threat Minimization guide on the wiki. For Linux, you can add files to /etc/modprobe.d to blacklist the modules. Add blacklist uvcvideo to disable your webcam driver…

[torjunkie]

@Patrick

1. The second, extra Whonix-WS firewall wiki info went MIA? Is it deprecated / no longer under development? If so, there are a few references to it here and there that need to be removed from wiki e.g.

http://dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/System_Hardening_Checklist#Whonix_.E2.84.A2_VM_Security

Consider enabling the optional (extra) Whonix-Workstation ™ firewall.

2. Also this recommendation in the “Expert” section - what about Coreboot? Should we add it - did anyone ever get Whonix running on it? (never tried - way, way too hard ) cc: @madaidan

Libreboot is a free, opensource BIOS or UEFI replacement (firmware) that initializes the hardware and starts the bootloader for your OS.

[Patrick]

@torjunkie

1. The second, extra Whonix-WS firewall wiki info went MIA? Is it deprecated / no longer under development? If so, there are a few references to it here and there that need to be removed from wiki e.g.

It is default enabled for a while now.

[torjunkie]

Ah okay - will fix that here and there in the wiki.

[Patrick]

Could you please document

• clock-random-manual-cli (see man clock-random-manual-cli)
• and clock-random-manual-gui?

It’s there since Whonix 14 already but never documented. It is supposed to be used in case sdwdate is failing.

[madaidan]

@torjunkie

2. Also this recommendation in the “Expert” section - what about Coreboot? Should we add it - did anyone ever get Whonix running on it? (never tried - way, way too hard ) cc: @madaidan

I’ve never tried Coreboot/Libreboot as it’ll probably brick my motherboard. I would recommend against Libreboot though as
it allows no proprietary firmware at all. This means no microcode updates which are pretty important for security.

[0brand]

It doesn’t look like forcing onion with HTTPS Everywhere user rule sets is possible with the current version which is 2019.5.13. Or at least it can’t be done using these instructions.

https://whonix.org/wiki/Forcing_.onion_on_Whonix.org#Adding_User_Rules

I am able to copy over my user rule sets from an earlier Tor Browser/HTTPS Everywhere version. (works OK). However, unless someone has an idea, this part of the forcing onion docs should be deprecated imo.

[torjunkie]

@Patrick

Please do a mass find-replace for “->” and use the HTML right-hand arrow instead:

→

which looks much better.

@madaidan

I’ve never tried Coreboot/Libreboot as it’ll probably brick my motherboard. I would recommend against Libreboot though as
it allows no proprietary firmware at all.

What do you think @HulaHoop ? remove? (if mere mortals can’t achieve it & no microcode updates available)

[HulaHoop]

@torjunkie

What do you think @HulaHoop ? remove? (if mere mortals can’t achieve it & no microcode updates available)

Yeah please recommend against libreboot and the reason why (hopelessly impractical becuase firmware blacklisting), also keep a note on Coreboot for those who might want to buy systems that have it by default like Chromebooks or maybe they would want to research how to flash it onto the handful of refurbished boards out there that support it.

[Patrick]

@torjunkie

Please do a mass find-replace for “->” and use the HTML right-hand arrow instead:

→

which looks much better.

Done.

[torjunkie]

@HulaHoop

Yeah please recommend against libreboot and the reason why

Thanks, will fix that.

@Patrick

Done.

Thanks, looks much better

Confirmed that these instructions don’t work (as you pointed out already):

http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/Onionizing_Repositories#Onionize_whonix.list

(x2 on that page)

sudo whonix_repository --baseuri http://deb.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion --enable --repository stable

whonix_repository unknown option: --baseuri

The only thing I couldn’t remember in those edits was whether it must be tor+http for whonix sources list, or just http.

(Or maybe you already modified the code block by default to have the onion available just by uncommenting - don’t remember, was a while since I played with whonix sources)

[Patrick]

@torjunkie

The only thing I couldn’t remember in those edits was whether it must be tor+http for whonix sources list, or just http .

Thanks for pointing that out. Room for improvement here.

As a general rule:
When using apt-get and .onion one should always be using tor+http whether inside or outside of Whonix. Non-critical (as per footnotes in link below).

I added that to Essential Host Security but it may still not be clear enough.

Also Essential Host Security might not be perfect placement and also interlinking with Onionizing Repositories is missing.

Having learned that, pointing out tor+http on Onionizing Repositories might be useful too?

When using apt-get and .onion one should always be using tor+http whether inside or outside of Whonix. Non-critical (as per footnotes in link below).

That said, we might be missing tor+http in various places on Onionizing Repositories and even in (Qubes) source files?

[Patrick]

Onionizing Repositories: Difference between revisions - Whonix - template deprecation isn’t ideal. If tor+http doesn’t work on plain Debian, then we need to update the instructions for plain Debian. The fix would be “install apt-transport-tor beforehand” most likely. tor+http isn’t developed by Whonix, apt-transport-tor implements it. Could you revert that please?

[torjunkie]

Will fix that.

In that apt-transport-tor stuff, I had also changed one of the weird onions (earth… .onion) to the proper Debian security one? Check that was correct also.

BTW Can Whonix builds etc. borrow any settings from this hardening list?

https://wiki.debian.org/Hardening