Post-installation Security Advice

Whonix ®

Download

Windows Linux Mac VirtualBox KVM Qubes USB ISO (coming soon) More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

This page provides security advice, steps that can be applied after installation of Whonix for better security.

Introduction

Whonix comes with many security features . Whonix is Kicksecure^™ hardened by default and also provides extensive Documentation including a System Hardening Checklist. The more you know, the safer you can be.

This page provides security advice, including steps that can be applied after installation of Whonix for better security.

On Whonix-Gateway^™ and Whonix-Workstation^™

Increase Virtual Machine RAM

Qubes-Whonix^™ users can skip this section.

• Whonix-Workstation: No changes are necessary for most users.
• Whonix-Gateway: If enough host RAM is available, ideally the virtual RAM setting of Whonix-Gateway should be increased to 2048 MB RAM. If it is infeasible to increase the virtual RAM setting, Whonix-Gateway will still function properly.

If it is unknown how much RAM is available, follow these steps on the host:

• Windows 10: Task Manager in More details view → Click/tap on the Performance tab → Click/tap on Memory; or Open a command prompt → Run wmic MemoryChip get /format:list
• macOS: Apple menu → About This Mac
• Linux: Open a terminal → Run free -h

Related:

• Low RAM Issues
• Advice for Systems with Low RAM

VirtualBox

1. To add RAM in VirtualBox the VM must first be powered down.
2. Virtual machine → Menu → Settings → Adjust Memory slider → Hit: OK

KVM

1. Shut down the virtual machine(s).

virsh -c qemu:///system shutdown <vm_name>

2. Increase the maximum memory.

virsh setmaxmem <vm_name> <memsize> --config

3. Set the actual memory.

virsh setmem <vm_name> <memsize> --config

4. Restart the virtual machine(s).

virsh -c qemu:///system start <vm_name>

Change Keyboard Layout

Qubes-Whonix users can skip this section.

If you are using a keyboard layout other than qwerty (US), consider changing the keyboard layout. Refer to the dedicated Keyboard Layout entry for further details.

Test Keyboard Layout

Qubes-Whonix users can skip this section.

• Start menu → Accessories → Mousepad; or
• Open file ~/testfile in a text editor of your choice as a regular, non-root user.

If you are using a graphical environment, run. mousepad ~/testfile

If you are using a terminal, run. nano ~/testfile

Try typing the words user, changeme and qwerty. Try typing further words to ensure the desired keyboard layout is functional.

Change Password

• Introduction: Whonix Documentation Introduction, User Expectations, Footnotes and References, User Expectations - What Documentation Is and What It Is Not
• Whonix is based on Kicksecure^™: Whonix inherits many features and principles from Kicksecure.
• Kicksecure is based on Debian: Kicksecure builds upon the stability of Debian.
• Inheritance: Therefore, Whonix is also based on Debian.
• Debian is GNU/Linux-based: Debian primarily uses the GNU/Linux as its foundation.
• Shared documentation benefits: Because one distribution is based on another:
  • Inherited documentation: Little specific documentation is required for each layer.
  • Shared principles: Features and principles often remain consistent across forks. Users can often follow the same instructions for both Whonix and Kicksecure.
• Keep using Whonix: This does not mean the user should switch to Kicksecure.
• Where to apply the instructions: The instructions should be applied inside Whonix.
• Wiki editors notice: This box is wiki template upstream_wiki. (Pages that link to it.)
• Comparison: Whonix versus Kicksecure
• Documentation compatibility: Since Whonix is based on Kicksecure, the user can follow these instructions for Post Install Advice . Apply the instructions inside Whonix, not Kicksecure.
• Note: Re-interpretation...

Kicksecure: Perform these steps inside Kicksecure.

Instead the user should apply the instructions inside Whonix-Workstation.

Kicksecure for Qubes: Perform these steps inside Qubes kicksecure-17 Template.

Instead the user should apply the instructions inside whonix-workstation-17 Template.

Security Updates

Regularly check for security updates and apply them in a timely fashion; see Operating System Updates.

Network Time Syncing

This is a short summary of the Network Time Synchronization wiki page which is recommended reading.

1. Timezone information.

Warning: The system clock inside Whonix is set to UTC to prevent against timezone leaks. This means it may be a few hours ahead or behind the user's host system clock. It is strongly recommended not to change this setting.

2. Check the host clock is reasonably accurate.

A reasonably accurate host clock is required for many general security properties because an inaccurate clock can lead to:

• Broken internet connectivity; and
• Time Attacks.

Therefore, at all times ensure the host clock has an accuracy of up to ± 30 minutes.

3. Avoid pause / suspend / save / hibernate functions.

In simple terms, most users should avoid the pause / suspend / save / hibernate features. Although discouraged, see Network Time Synchronization for further details on when this is possible.

Better Security

This chapter is aimed at newcomers and only provides a short and simple overview for basic protection. Anonymity and platform security can be improved by following recommendations outlined in the Security Guide and Advanced Security Guide sections, along with the Time Attacks and Network Time Synchronization page.

Appendix

How do I Check the Current Whonix Version?

See /etc/*_version.

Open a terminal.

If you are using Qubes-Whonix^™, complete the following steps.

Qubes App Launcher (blue/grey "Q") → Whonix-Gateway™ ProxyVM (commonly named sys-whonix) → Xfce Terminal

If you are using a graphical Whonix with Xfce, run.

Start Menu → Xfce Terminal

cat /etc/*_version

Should show.

12.1
17

The first line shows the version of the major and minor version of Debian. The second line shows the version of the derivative (Whonix).

Footnotes

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!