'sudo apt-get install whonix' Part I / Distro-Morphing

[HulaHoop]

The ability to install Whonix meta-packages packages from a repository is finished.

How it Works:

In two steps a user is able to convert plain Debian VMs into Whonix:

1. First by adding the Whonix repo URLs to the apt sources list (optionally: check instructions for anonymous repo downloads)

2. Then doing ‘sudo apt-get install whonix-(gateway|workstation)’

What Becomes Possible:

The concept of distro-morphing is an incredible technical milestone because at the moment, no other derivative OS can be directly installed on its upstream base just by running a package manager. This makes Whonix packages accessible to Debian virtual machine users in a couple of commands.

Whonix becomes portable and possible to install on every alternative hardware architecture supported by Debian with little effort. It also sets allows installing select Whonix packages on Debian hosts.

Another advantage is easier testing of Whonix packages across different hypervisors and reduced template sizes for Qubes-Whonix.

Related:

'sudo apt-get install whonix' Part II / Whonix Packages for Debian Hosts

Many packages developed under the Whonix umbrella are independent packages in their own right and should be available to users whether they use Whonix directly or not. Another long term goal is bringing some of Whonix’s major software packages with their security and privacy enhancements to Debian host systems via our repository. To try it out, follow the instructions on the wiki. Currently supported packages: security-misc: Disables kernel features to decrease surface attack and prevents …

[Patrick]

Theory:

Dev/Installation from Repository

[Patrick]

Practice:

This was implemented and now used in the wild.

Whonix reported to be running on POWER9 using distro-morphing.

• https://wiki.raptorcs.com/wiki/Whonix
• https://wiki.raptorcs.com/wiki/Main_Page
• https://raptorcs.com/
• https://en.wikipedia.org/wiki/POWER9
• https://wiki.debian.org/PPC64

[HulaHoop]

This was implemented and now used in the wild.

Awesome I was thinking about alternative platforms like Talos when writing about this feature. Happy to see people pick it up and run with it.

[TNT_BOM_BOM]

WOW Thats Awseome!!!

[Patrick]

Bad News

@Patrick

distro-morphing might become unsupported after a Kicksecure ISO gets available. There’s too much state on a user system that can lead to issues.

To elaborate on that one…
distro-morphing is still in use to a degree.

• During the build process of Non-Qubes-Whonix and Qubes-Whonix a Debian base image (created in earlier build step) will be morphed into Whonix.
• During the build process of Kicksecure a Debian base image (created in earlier build step) will be morphed into Kicksecure.

What’s hard indeed is supporting arbitrary user installations of Debian which could contain a lot state (configuration, gnome vs kde vs whatever desktop environment) to be morphed to Whonix or Kicksecure.

---

Good News

This is also related to distro-morphing:

@Patrick

chroot debootstrap install Whonix / Kicksecure to folder

Other Linux distributions such as Qubes and ParrotOS indicated interest in a package developed by Whonix developers, namely security-misc, which does Kernel Hardening; Protect Linux User Accounts against Brute Force Attacks; Improve Entropy Collection; Strong Linux User Account Separation; Enhances Misc Security Settings.

• https://github.com/QubesOS/qubes-issues/issues/1885
• https://community.parrotlinux.org/t/parrotos-hardening/11649
• ParrotOS + Whonix

But security-misc is only one component of security hardening. These and other Linux distributions might in future become interested to re-base to Kicksecure , which is a security-hardened, non-anonymous Linux Distribution.

chroot / debootstrap is a method to download (“install”) a Linux distribution in a folder from an already installed operating system. This has many uses and can be used to build a derivative (of Kicksecure) Linux distribution or Qubes template.

Actually not debootstrap but mmdebstrap which is better .

More about Kicksecure:

whonix.org – 21 Mar 20

Kicksecure ™: A Security-hardened, Non-anonymous Linux Distribution - Whonix

Kicksecure ™ is a security-hardened Debian based Linux distribution that provides better protection from malware.

How to install Kicksecure in a chroot:

whonix.org – 3 Apr 20

Install Kicksecure ™ inside a folder (chroot) - Whonix

You can install Kicksecure ™ on top of your existing Debian (based) Linux installation inside a chroot (change root).

To learn early when distro-morphing would break due to package installation issues:

@Patrick

Continuous Integration (CI)

One test running on Travis CI uses travis.debian.net script (sets up a docker container which runs Debian) where package whonix-host-xfce-kvm-nonfreedom gets installed for real.

Another two tests running on Travis CI (one not using apt-cacher-ng, another using apt-cacher-ng) uses mmbdebstrap to create a chroot for the following meta packages whonix-host-xfce-kvm-nonfreedom , qubes-whonix-gateway , qubes-whonix-workstation , kicksecure-cli , kicksecure-cli-vm , kicksecure-xfce , kicksecure-xfce-vm , non-qubes-whonix-gateway-xfce , non-qubes-whonix-workstation-xfce , which then pull other Whonix packages. Therefore many new build bugs can be quickly spotted.

generally:
https://travis-ci.org/github/Whonix/Whonix

a recent successful build:
https://travis-ci.org/github/Whonix/Whonix/builds/671191361

[HulaHoop]

So are you saying it should work if the user doesn’t try to install a different DE or set of packages different from the official defaults?

[Patrick]

That depends what the definition of the word “should” is.
Yes, should work.
Best chance is to start with a minimal installation without GUI or XFCE if it must be one and then installing a meta package (cli or xfce).

@Patrick

distro-morphing might become unsupported after a Kicksecure ISO gets available. There’s too much state on a user system that can lead to issues.

I wrote that because I think it’s a bad use of development time to support individual geeky exercises if something better (Whonix-Host) can be created instead.

[HulaHoop]

@Patrick

Best chance is to start with a minimal installation without GUI or XFCE if it must be one and then installing a meta package (cli or xfce).

Good to know. Worth adding to documentation since this is the second time recently I’ve seen people interested. Great to see it a building block in some projects like yoshidako’s laptop.

[Patrick]

Done here: https://www.whonix.org/wiki/Kicksecure/Debian