I have read almost the entire Whonix Wiki. However, there are some questions that the Wiki did not answer or remained unclear.
#General
The wiki recommends Debian as host operating system. Why not take advantage of Kicksecure’s hardening and use it as host operating system?
The wiki recommends disabling TCP SACK. Is this still recommended? Within Whonix 15 I can’t find the configuration under “/etc/sysctl.d/tcp_sack.conf”.
The wiki recommends hiding different user locations against Tor guard fingerprinting by using alternating bridges. Are these special bridges? Or “normal” bridges and they alternate by default?
FireJail is no longer recommended because it’s unclear whether it does more good than harm, right?
#Qubes-Whonix specific
5) I have read that the sys-net, sys-firewall templates from Fedora ping home by default. Is this still a problem?
6) Is there a good reason not to install Tirdad inside Qubes-Whonix?
7) The wiki recommends to disable core dumps and swap. Is this also recommended for Qubes-Whonix?
8) Why are disabled core dumps and swap files not the default setting within the Whonix templates?
9) The wiki recommends using Debian minimal templates for sys-net and sys-firewall. Why not use an already hardened cloned Whonix-ws-15?
You can use Kicksecure, but it is not ready for production use yet. Look in the development forum for threads about hosts for Whonix.
Check /etc/sysctl/30_security_misc.conf. If the wiki page is outdated, could you update it?
Do you mean by moving the state file? If so, the guide helps you to temporarily rotate guards, not use bridges.
There might be other issues, but it breaks things and it might affect fingerprinting.
You can find out with a dnf search for a package including “fedora connectivity check” in the name.
Does not work in Qubes.
Would not work. Whonix is specialized for its purpose. Go to the docs section of the Qubes website for managing minimal templates. There are instructions for adding packages to create fedora-minimal or debian-minimal netvm.
/etc/sysctl/30_security_misc.conf has the TCP SACK option. The wiki is out of date if 30_security_misc.conf is the correct file for it. How can I check that this is the new correct file and not accidentally?
=> outdated wiki at /wiki/Whonix-Workstation_Security_Hardening#Disable_TCP_SACK
No, I don’t mean the state file. The wiki points out several options for the protection of fingerprints at different locations. One option is to use “alternating bridges”. My question is: Are “alternating bridges” special bridges or normal bridges and all bridges alternating? I think they are just the normal bridges, and “alternating bridges” describes that they are not persistent for the rotation of the guards. I just want to be sure.
answered
If I run dnf se “Fedora connectivity check” and nothing is found, is it okay?
Why does it not work inside of Qubes? Is there change in the near future?
question still open
question still open
answered
Is there a easy way to store the whonix wiki locally?
Is there an easy way to save the qubes-os wiki locally? (I know Qubes related)
Are Debian minimal templates still the better choice to use as sys-net and sys-firewall compared to fedora?
The “best” hypervisor currently available for onion service hosting is KVM because it allows the best defense against advanced deanonymization attacks, isn’t it?
=> /wiki/Advanced_Deanonymization_Attacks#Attack_Methodology
Whonix-Host - in development at time of writing - will be based on Kicksecure.
added just now:
Wording clarification: There is no such thing as “Alternating-Bridges”. It’s not it’s own word. It means “a bridge to alternate”. As in “use different bridges”.
“recommended” is such a strong word I try to avoid. There are complex technical topics and these cannot be boiled down to yes/no. Details are here:
Better look at / ask in the original ticket if anywhere.
No updates there - assume there are no updates.
I am not aware of any changes.
I will check out your links.
Redirected to Qubes support:
The wiki recommends to disable core dumps and swap. Is this also recommended for Qubes-Whonix?
Is there an easy way to save the qubes-os wiki locally?
Reamaining questions:
Is there a easy way to store the whonix wiki locally?
The “best” hypervisor currently available for onion service hosting is KVM because it allows the best defense against advanced deanonymization attacks, isn’t it?
=> /wiki/Advanced_Deanonymization_Attacks#Attack_Methodology
The wiki is out of date at => /wiki/Whonix-Workstation_Security_Hardening#Disable_TCP_SACK
/etc/sysctl/30_security_misc.conf has the TCP SACK option now.
That wiki section is still needed, because 30_security_misc.conf still has the tcp_sack options commented by default (because uncommenting can cause network issues, so users must decide whether to do that manually or not).
For some reason the approved text on that page is not showing 30_security_misc.conf, but showing an alternative file. Weird. You can see the correct reference when you try to edit the relevant section.