Whonix KVM dnsmasq - listen port on host operating system - attack surface reduction

KVM
14

I tested setting up a brand new KVM host without dnsmasq installed and with the default KVM network deleted.

I was able to import the Whonix-External network but could not start it due to an error about dnsmasq command being missing.

So it appears this is required for NAT networks in particular and not purely the default network.

I will test two things:

  1. Creating a stub dnsmasq executable that will simply exit 0 or halts execution so that it appears to be running in the background; and
  2. Modifying the Whonix-External network XML configuration in the hope of removing the dnsmasq requirement.

And report back.

I don’t feel we should need dnsmasq on a KVM host used exclusively for Whonix as we don’t need the host to be able to ping the VMs by name.

1 Like