Whonix live mode / amnesia / amnesic / non-persistent / anti-forensics

[sijhdooooaoao]

@nurmagoz

Not whonix issue:

My disk has enough free space. When I used VB 6.1.18 with LisLogic SAS live mode on the host worked well and I was able to start whonix VB with a live mode on the host. But now when live mode is on on the host I got this error - VERR_DISK_FULL
Also now is impossible to switch AHCI VB to read only.

[sijhdooooaoao]

Never mind VB issued version 6.1.22 with fixed LsiLogic SAS problem.

[nurmagoz]

Thanks for reporting the bug, Though im getting different error message:(Debian host)

and debian didnt yet upgraded vbox in sid yet to .22:

https://packages.debian.org/search?suite=default&section=all&arch=any&searchon=names&keywords=virtualbox

[Patrick]

Testing (to please myself) Live Mode User

Already some time since I tried Whonix. The feature I still use on a daily basis is the Live Mode (of the host) via Grub-Live. Now I got the idea that I want to verify for myself that the live mode is doing what I always hoped it was doing: preventing persistance of changes to my disk. So I want to make a system image, do a checksum, work on the system, re-image and recalculate the checksum and test for equality. Ideally I should not have to ask you how to go about this, on the other hand maybe …

[Patrick]

As noticed in above forum thread, /boot isn’t write protected. Any idea how /boot could also be covered?

Testing (to please myself) Live Mode User

mount time (time of last mounting of partition) is a pretty good guess. Maybe mount option in /etc/fstab noatime for /boot (and generally?) would help? Maybe there is a kernel boot parameter similar to noatime that we could set? Ideally in live mode mount times shouldn’t be recorded. It’s not a critical issue but for simplicity of dd whole encrypted disk and compare it would be much more handy if this issue wouldn’t exist. Non-Qubes-Whonix (and Kicksecure) VM images do not have a separate /b…

[Patrick]

grub-live ported to dracut would be great!

replacing initramfs-tools with dracut

If we want to implement a live boot option for Whonix we maybe need to change the default tool for generating the initramfs from the current initramfs-tools to dracut. Therefore, also some minor changes to the build scripts are required. Dracut is mostly used by everything Fedora based (RedHat, CentOS, Qubes) and OpenSuse. Initramfs-tools is used by Debian and derivatives by default. I couldn’t find any important differences between both, which doesn’t mean they don’t exist. Dracut is also in …

[Patrick]

Debian feature request
Boot existing Host Operating System or VM into Live Mode (grub-live)
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991276

[Patrick]

@Patrick

grub-live ported to dracut would be great!

replacing initramfs-tools with dracut

grub-live dracut support has been implemented.

[MrKaos]

When this becomes available will it be used in very much the same way one would use tails? Burn onto usb or dvdr then use it as an OS like tails?

[Patrick]

This feature is already available. See links to wiki (edit) in initial post in this forum thread.

[MrKaos]

Thanks for getting back. But isn’t there something still in development where we would be able to boot a usb stick or DVD and it will take us straight into the whonix environment? Whonix live ISO or something…Without using any virtual machine? If so is it ready for end users yet? Thanks again for response

[Patrick]

You can combine

Installation of Whonix ™ on a USB

with

Live Mode

That’s the most you can get for now.

Future:

Whonix-Host Operating System Live ISO, Whonix-Host Installer

No ETA.

[MrKaos]

Cool… well I’d happily donate towards it I think it’s a great idea and am in full support of it. Unfortunately though with my lack of technical knowledge I can’t be of much help in that area

[Patrick]

Is it possible to use Whonix in Live-Mode while somehow be able to access a persistent file/folder

Hey there, I am somewhat unsure that this is the right category, but the others doesn’t seem to be fitting too. If somebody would use Virtualbox Whonix Workstation in Live-Mode and still would like to be able to take notes or save a screenshot. How could that be accomplished? Something like the Tails Persistent Storage option would be awesome… I was thinking about attaching a USB with passthrough to access a location, but that seems not recommended. Another idea was to use an online tool/clou…

[Patrick]

Reduce numbers of grub live-mode boot menu entries

whonix startup confusing grub live-mode options: whenever there is a new linux kernel version installed it will add up to the live-mode list instead of choosing the latest version. the list going to be like this: start whonix advanced... live-mode kernel x live-mode kernel y live-mode kernel z facially and practically not great. Solution: https://github.com/Kicksecure/grub-live/blob/master/etc/grub.d/11_linux_live#L19 disable GRUB_DISABLE_SUBMENU="y" then its going to be: start whonix a…

[Patrick]

refactoring

[Patrick]

Livecheck.sh script broken on bookworm

[Patrick]

Added to Combine Kicksecure ™ Live VMs with Read-only Mode for Virtual Hard Drives chapter VirtualBox in Kicksecure wiki just now:

On Debian bookworm based Kicksecure ™ 17 (and above) / Newer VirtualBox versions:

• VirtualBox might no longer support VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly. Settings set thorugh VBoxManage setextradata are not officially supported and might be gone at some time such as now.
• VirtualBox documentation chapter Special Image Write Modes mentions immutable images but this might not be as good as read-only images.

[Patrick]

Above two issues are not easy to fix.

Help welcome!

Link to source code:

Kicksecure/desktop-config-dist/blob/master/usr/share/livecheck/livecheck.sh