Whonix Hidden Service Hosting Initiative -> KVM development

Development
41

Made some 64 bit workstation 8.2 builds - all green :slight_smile:

42

Moved leak testing discussion here:

:slight_smile:

43

some ongoing changes here?

W: Failed to fetch Whonix Developer Meta Files - Browse Files at SourceForge.net Could not resolve ā€˜tenet.dl.sourceforge.netā€™

44

[quote=ā€œzweeble, post:43, topic:165ā€]some ongoing changes here?

W: Failed to fetch Whonix Developer Meta Files - Browse Files at SourceForge.net Could not resolve ā€˜tenet.dl.sourceforge.netā€™[/quote]
No. Works for me now. Perhaps just temporary failure somewhere (Tor network, sf, mirror)?

45

[quote=ā€œPatrick, post:34, topic:165ā€]Due to popular request in various places by various peopleā€¦

Proposal for Whonix 9.

Gateway eth1.

auto eth1
iface eth1 inet static
       address 11.150.150.150
       netmask 255.255.192.0

Workstation eth0.

auto eth0
iface eth0 inet static
       address 11.150.150.151
       netmask 255.255.192.0
       gateway 11.150.150.150

I am currently testing these. This should less likely cause conflicts with physical networks, routers, kvmā€¦

What do you think?[/quote]

Proposal updated in Whonix Forum. Letā€™s move the IP discussions to Whonix Forum.

46

started workstation firewall for testing, then whonixcheck fails to find gw :ā€™(

where is the config for the firewall?

gw 8.2 32bit
ws 8.2 64 bit
192.168.0.0 isolated virtual network

47

Config folder:
/etc/whonix_firewall.d

iptables rules script:
/usr/bin/whonix_firewall

The latter contains an ugly variable.

NON_TOR_WHONIXG="192.168.1.0/24 192.168.0.0/24 127.0.0.0/8"

NON_TOR_WHONIXG can in Whonix 8 only be configured by editing /usr/bin/whonix_firewall.
Not that a big deal, but non-ideal and will be improved in Whonix 9.

gw 8.2 32bit ws 8.2 64 bit
Fine, I don't think that will ever cause any issues.
48

What IP does the gateway eth1 have? Default 192.168.0.10? Because that IP is hardcoded into whonixcheck (not difficult to change).

But most likely this is not the issue, because whonixcheck worked without the firewall?

49

Is there still a problem here that need fixing. If so please explain. Would like to know about so I could change the config accordingly, or if there isnā€™t, then the blocker is removed.

50

Everything works for you know? whonixcheck? TransPort? No leaks? If yesā€¦ Then there are indeed no more blockers.

51

That is correct, its all running perfect. All checks coming green in whonixcheck when the unsupported hypervisor and kvmclock flags are disabled.

52

Ok.

Did you need to disable kvmclock check in whonixcheck? If so, that would be bad. Otherwise weā€™re all good.

53

When its disabled in the xml its not detected when whonixcheck is looking for it. I was just lazy and didnā€™t go back and edit the xml aftert I reverted a snapshot. But weā€™re good. Sorry for the confusion.

54

Okay, no more blockers then.

And I will disable the strong general KVM warning in Whonix 9 in whonixcheck and replace it with a weaker ā€œkvm support was recently added, now in testing phaseā€ warning or something like that. Should kvmclock be detected, whonixcheck will advice to use the kvm instructions at Whonix for KVM.

HulaHoop, can you refresh my mind please? What was the issue that broke whonixcheck and TransPort test for you in kvm in past before zweeble helped us out? I am just asking, to make sure no one else is bumping into this issue. Do the KVM instructions reflect that?

Are the KVM instructions complete for now?

55
And I will disable the strong general KVM warning in Whonix 9 in whonixcheck and replace it with a weaker "kvm support was recently added, now in testing phase" warning or something like that. Should kvmclock be detected, whonixcheck will advice to use the kvm instructions at https://www.whonix.org/wiki/KVM.

Using the xml I currently uploaded to git, I assure you no kvmclock appears in the vm. I doublechcked and ran whonixcheck with its default values.

HulaHoop, can you refresh my mind please? What was the issue that broke whonixcheck and TransPort test for you in kvm in past before zweeble helped us out? I am just asking, to make sure no one else is bumping into this issue. Do the KVM instructions reflect that?

whonixcheck was never broken and I was confused about the transproxy being off because of the wrong way we did the FIN ACK leak test.

56

Using the xml I currently uploaded to git, I assure you no kvmclock appears in the vm. I doublechcked and ran whonixcheck with its default values.[/quote]
Sure. There will still be people who miss the KVM instructions and Whonix into KVM on their own. For those who donā€™t have official xml settings, those get kvmclock and be warned and advised to use KVM instructions.

57

I guess forget about the weaker warning. We can rather add this to documentation.

58

Deactivated general kvm warning in whonixcheck:
https://github.com/Whonix/whonixcheck/commit/eb620c4c48c63f6f351438fe92c1f555cc6c8fe6
(https://github.com/Whonix/whonixcheck/blob/master/usr/lib/whonixcheck/check_virtualizer)

Reworded warning if kvmclock is detected a bit:
https://github.com/Whonix/whonixcheck/blob/master/usr/lib/whonixcheck/check_kvmclock#L42

59

just in caseā€¦ if I change the host/domain names on a workstation - does this effect whonix in some way?? Should still work I guess?

60

Domain name of workstation = name of the VM? Whonix doesnā€™t notice even notice the name of the VM, so no. Or do you mean /etc/hostname?