Whonix-workstation-17: Cant use sudo "permission denied: sudo" - on brand new template

[Patrick]

@EveK818

Is the above method that I demonstrated CORRECT?And is it the Whonix recommended way of enabling sudo or root

If you want sudo/root, then it’s the recommended way.

@EveK818

Why can I not keep user-sysmaint-split mode enabled, and instead just install applications using the root console (qvm-run -u root whonix-workstation-17 xfce4-terminal) for the corresponding qube?

You can do that.

@EveK818

Wouldn’t this keep me more secure than uninstalling user-sysmaint-split?

Yes.

@EveK818

Why can I not log into (su - sysmaint) the “sysmaint” user account from the root console, and then install and or update applications from there? Thus again, keeping the security of the sysmaint user and user-sysmaint-split application? Wouldn’t this keep me more secure than uninstalling user-sysmaint-split?

Quote sysmaint, Usage

R4.2

In Qubes OS R4.2 and earlier: Kicksecure for Qubes cannot be booted into sysmaint session. However, user-sysmaint-split is useful in Qubes VMs too because it makes SUID privilege escalation tools (sudo, su, pkexec) inaccessible for account user. You can access the root account by opening a Qubes Root Console.

Much improved in Qubes-Whonix 18 for Qubes R4.3. Highly recommend as per Qubes-Whonix 18 Released! Major Release Upgrade!

See same link as above for R4.3 documentation.