Whonix comes with many security features. Whonix is Kicksecure^™ Hardened by default and also provides extensive Documentation including this System Hardening Checklist. The more you know, the safer you can be.

This page is targeted at users who wish to improve the security of their systems for even greater protection.

Introduction[edit]

Recommendations specific to Qubes-Whonix or Non-Qubes-Whonix are marked accordingly.

It is possible to significantly harden the Whonix and/or host platform. This reduces the likelihood of a temporary or persistent compromise, while increasing the chances of successful, anonymous activity. Hardening is dependent upon a user's skill set, motivation and available hardware. The checklist below is intended to provide a quick overview of important issues, categorized by difficulty level - easy, moderate, difficult and expert.

Upstream[edit]

This page will focus exclusively on aspects related to Whonix/Anonymity. For security hardening and additional insights, users should refer to the Kicksecure page.

Introduction: Whonix Documentation Introduction, User Expectations, Footnotes and References, User Expectations - What Documentation Is and What It Is Not
Whonix is based on Kicksecure^™: Whonix inherits many features and principles from Kicksecure.
Kicksecure is based on Debian: Kicksecure builds upon the stability of Debian.
Inheritance: Therefore, Whonix is also based on Debian.
Debian is GNU/Linux-based: Debian primarily uses the GNU/Linux as its foundation.
Shared documentation benefits: Because one distribution is based on another:
- Inherited documentation: Little specific documentation is required for each layer.
- Shared principles: Features and principles often remain consistent across forks. Users can often follow the same instructions for both Whonix and Kicksecure.
Keep using Whonix: This does not mean the user should switch to Kicksecure.
Where to apply the instructions: The instructions should be applied inside Whonix.
Wiki editors notice: This box is wiki template upstream_wiki. (Pages that link to it.)
Comparison: Whonix versus Kicksecure
Documentation compatibility: Since Whonix is based on Kicksecure, the user can follow these instructions for System Hardening Checklist . Apply the instructions inside Whonix, not Kicksecure.
Note: Re-interpretation...

Kicksecure: Perform these steps inside Kicksecure.

Instead the user should apply the instructions inside Whonix-Workstation.

Kicksecure for Qubes: Perform these steps inside Qubes kicksecure-17 Template.

Instead the user should apply the instructions inside whonix-workstation-17 Template.

Easy[edit]

Anonymous Blogging, Posting, Chat, Email and File Sharing[edit]

To remain anonymous, follow all the Whonix recommendations to minimize threats of keyboard/mouse biometrics, stylometric analysis and other covert channels.
- A browser is an unsafe environment to directly write text, regardless of whether it is a forum post, email, webmail or IMAP-related reply.
  - At a minimum users should not type into browsers with JavaScript enabled, since this opens up this deanonymization vector. Text should be written in an offline text editor and then copied and pasted into the web interface when it is complete.
Remove metadata from documents, pictures, videos or other files before uploading them to the Internet.
Think twice before sharing "anonymous" photos due to unique embedded noise signatures that have no known countermeasures.
Be careful sharing anonymous documents. Digital watermarks with embedded covert data are robust, so run documents through Optical Character Recognition (OCR) before sharing the output.
Utilize OnionShare to anonymously share or receive files securely over the Tor network, anonymously chat, or host anonymous websites. ^[1]

Dedicated Computer[edit]

For high security, it's best to use a dedicated, physically different computer only for the purpose of using Whonix and nothing else. For other use cases, use completely different hardware including a different screen.

This is to lower the impact of fingerprinting VMs in case they get ever compromised.

Use a Dedicated Host Operating System and Computer

Related: VM Fingerprinting

Forum discussion: https://forums.whonix.org/t/high-opsec-recommendation/17237

File Storage Location[edit]

Avoid storing files directly in the root home folder and create appropriate sub-folders instead.
Move files downloaded by Tor Browser from the ~/Downloads folder to another specially created one. ^[2]

Mandatory Access Control[edit]

Enable all available apparmor profiles in the Whonix-Workstation^™ and Whonix-Gateway^™ Templates.
Enable seccomp on Whonix-Gateway (sys-whonix ProxyVM).

Tor Browser Series and Settings[edit]

Prefer the stable Tor Browser release over the alpha series in line with Tor developer recommendations; see footnotes. ^[3] ^[4] ^[5] ^[6]
Run the Tor Browser Security Slider in the highest position. ^[7]
Disable Javascript by default and only allow it sparingly for trusted sites. ^[8]
Do not configure custom NoScript (per-site) settings which persist across successive Tor Browser sessions because this aids fingerprinting.
Use .onion services where possible to stay within the Tor network, such as defaulting searches to the DuckDuckGo onion service. ^[9]
Use multiple Tor Browser instances or multiple Whonix-Workstation to better compartmentalize contextual identities.
Follow all other Whonix recommendations for safe and anonymous use of Tor Browser.
Install Tor Browser outside of Whonix so a second, working instance is always available for anonymous activities. ^[10]

Virtual Machines[edit]

All Virtualizers[edit]

Remove the virtual audio controller to VMs from getting access to a microphone (eavesdropping risk) or speaker (profiling threat).

VirtualBox[edit]

Remove a host of VirtualBox features to reduce the attack surface.
Take regular, clean VM snapshots that are not used for any activities.
Spoof the initial virtual hardware clock offset.
Consider disabling clipboard sharing to reduce the risk of identity correlation. ^[11]
Shared folders are discouraged because they weaken isolation between the guest and the host. ^[12]

Networking[edit]

Spoof MAC Addresses[edit]

Tip: MAC spoofing is only necessary if traveling with your laptop or PC. It is not required for home PCs that do not change locations.

In Qubes-Whonix, follow these steps to spoof the MAC address on the Debian or Fedora Template used for network connections.
In Non-Qubes-Whonix, follow these steps to spoof the MAC address of the network card on a Linux, Windows or macOS host.

Time Related[edit]

Non-Qubes-Whonix only: Disable ICMP timestamps and TCP timestamps on the host operating system to prevent leakage of information. ^[13]
Non-Qubes-Whonix only: Uninstall the NTP client on the host operating system and disable systemd's timdatectl NTP synchronization feature. ^[14]
Prevent possible time leaks by blocking networking until sdwdate finishes.

Tor Settings[edit]

Consider enabling Tor connection padding for potentially better anonymity; note it is unclear whether this provides any additional benefit (see footnote). ^[15]
Consider installing newer Tor versions directly from The Tor Project repository.
Avoid regenerating the Tor state file or manually rotating Tor guards ^[16] because it degrades anonymity.
Avoid configuring non-persistent entry guards, as this severely degrades anonymity.
Consider using Bridges if Tor is censored, dangerous or deemed suspicious in your location.
If using a bridge, configure alternating bridges for different physical locations.
Heavily censored users should configure a meek-azure bridge with Anon Connection Wizard. ^[17]
To help preserve anonymity, copy Tor configuration files and settings to any new sys-whonix instance which is created. ^[18]

Whonix VM Security[edit]

Consider disabling the Control Port Filter Proxy to reduce the attack surface of both the Whonix-Gateway and Whonix-Workstation.
Consider hardening systemcheck.
Consider the periodic deletion and recreation of VMs that are used for sensitive operations.
- If a compromise of Whonix-Gateway and/or Whonix-Workstation is suspected, follow the compromise recovery instructions.

Difficult[edit]

Chaining Anonymizing Tunnels[edit]

Avoid this course of action. The anonymity benefits are unproven and it may actually hurt a user's anonymity and security goals.
Virtual Private Network (VPN) tunnel-links are strongly recommended against due to multiple security and anonymity risks.

Disposables[edit]

Qubes / Qubes-Whonix only.
Note: Some traces of Disposable usage and data contents will leak into the dom0 filesystem and survive reboots; see here for further information. (This is a Qubes-specific issue and unrelated to Whonix.)

Run all instances of Tor Browser in a Disposable which is preferably uncustomized to resist fingerprinting. ^[19]
Configure each ServiceVM as a static Disposable to mitigate the threat from persistent malware accross VM reboots. ^[20]
Until fully ephemeral Disposables are available by default in a future Qubes release, advanced users can consider configuring them manually:
- Unman's guide to ephemeral Disposables creates a RAM-based storage area.
- anywaydense's guide to ephemeral PVH Disposables encrypts data written to the disk with an ephemeral encryption key only stored in RAM.

Email[edit]

All Platforms[edit]

Follow the Whonix recommendations to select an email provider compatible with privacy and anonymity.
For anonymous PGP-encrypted email over Tor, use Mozilla Thunderbird. ^[21]
For greater email or message security, consider using the OneTime application or a Physical One-time Pad for military-grade encryption.
Follow all other email principles for greater safety.

Qubes-Whonix Only[edit]

Use split-GPG for email to reduce the risk of key theft used for encryption / decryption and signing.
Create an App Qube that is exclusively used for email and change the VM's firewall settings to only allow network connections to the email server and nothing else ("Deny network access except...").
Only open untrusted email attachments in a Disposable to prevent possible infection.

Mix Personal Tor Traffic with Own Tor Bridge or Relay[edit]

See Host a Bridge or Tor Relay; this configuration might make adversary classification of Tor traffic more difficult. ^[22]

Whitelisting Tor Traffic[edit]

Qubes-Whonix: Configure sys-whonix to use corridor as a filtering gateway to ensure only connections to Tor relays pass through. ^[23] ^[24]
Non-Qubes-Whonix or Qubes-Whonix: Use a standalone corridor as a filtering gateway.

Expert[edit]

Physical Isolation[edit]

Non-Qubes-Whonix only.

If additional hardware is available, consider Physical Isolation in Non-Qubes-Whonix. ^[25]

Footnotes[edit]

↑ OnionShare 2.0 and higher enforce v3 onion connections. Whonix 16 is based on Debian bookworm which provides OnionShare v2.2.
↑ The reason is AppArmor profiles (and possibly other mandatory access control frameworks) are unlikely to allow access to these folders by default.
↑ Tor Blog:
Note: this is an alpha release, an experimental version for users who want to help us test new features. For everyone else, we recommend downloading the latest stable release instead.
↑ Selfrando (load-time memory randomization) protection has been removed from alpha Tor Browser Linux builds. Although Selfrando provides a security improvement over standard address space layout randomization (ASLR) present in Tor Browser and other browsers, Tor developers believe it is relatively easy for attackers to bypass and not worth the effort.
↑ The "hardened" Tor Browser series has been deprecated, see: https://gitlab.torproject.org/legacy/trac/-/issues/21912
↑ Following the official release of the v8.0+ Tor Browser series (based on Firefox 60 ESR), the stable and alpha Tor Browser versions both have a native sandbox.
↑ This may affect usability and proper functioning on some websites.
↑ This is more secure, but increases the user's fingerprinting risk due to selective use of Javascript.
↑ Take care to observe you stay within the Tor network -- 'downgrade' attacks have been observed that result in clearnet URLs being loaded in place of onion services across successive page loads on some sites.
↑ Thereby circumventing any possible future problems, like the breakage of Whonix.
↑ Bidirectional clipboard sharing is currently enabled by default in Whonix VirtualBox VMs. There are security reasons to disable clipboard sharing, for example to prevent the accidental copying of something (non-)anonymous and pasting it in its (non-)anonymous counterpart such as a browser, which would lead to identity correlation.
↑ Providing a mechanism to access files of the host system from within the guest system via a specially defined path necessarily enlarges the attack surface and provides a potential pathway for malicious actors to compromise the host.
↑ Such as system information, host time, system uptime, and fingerprinting of devices behind a router.
↑ This prevents time-related attack vectors which rely on leakage of the host time.
↑ https://forums.whonix.org/t/tor-connectionpadding/7477
↑ Via creation of a new Whonix-Gateway (sys-whonix).
↑ For example, Whonix users residing in China.
↑ This is useful when testing later Whonix releases to stymie deanonymization attempts by advanced adversaries, or when creating an identical backup that does not share any other persistent data, except for Tor state and custom torrc options.
↑ This is safe in the stable Qubes R4 release, but privacy issues were unresolved in Qubes R3.2 (now unsupported).
↑ Users can configure sys-net, sys-firewall and sys-usb as static Disposables. This option has been available from Qubes R4 onward.
↑ Reminder: The Subject: line and other header fields are not encrypted in the current configuration.
↑ The reason is adversaries observing traffic will need to perform classification of both traffic generated by the Tor relay or bridge and your personal client traffic.
↑ This provides an additional fail-safe to protect from accidental clearnet leaks that might arise from hypothetical Whonix bugs, but does not address potential Qubes ProxyVM leaks.
↑ https://github.com/rustybird/corridor
↑ Using two different computers and virtualization is one of the most secure configurations available, but may be less secure than Qubes' approach (software compartmentalization).

Whonix

The most watertight privacy operating system in the world.

Dark mode

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

[1] OnionShare 2.0 and higher enforce v3 onion connections. Whonix 16 is based on Debian bookworm which provides OnionShare v2.2.

[2] The reason is AppArmor profiles (and possibly other mandatory access control frameworks) are unlikely to allow access to these folders by default.

[3] Tor Blog:
Note: this is an alpha release, an experimental version for users who want to help us test new features. For everyone else, we recommend downloading the latest stable release instead.

[4] Selfrando (load-time memory randomization) protection has been removed from alpha Tor Browser Linux builds. Although Selfrando provides a security improvement over standard address space layout randomization (ASLR) present in Tor Browser and other browsers, Tor developers believe it is relatively easy for attackers to bypass and not worth the effort.

[5] The "hardened" Tor Browser series has been deprecated, see: https://gitlab.torproject.org/legacy/trac/-/issues/21912

[6] Following the official release of the v8.0+ Tor Browser series (based on Firefox 60 ESR), the stable and alpha Tor Browser versions both have a native sandbox.

[7] This may affect usability and proper functioning on some websites.

[8] This is more secure, but increases the user's fingerprinting risk due to selective use of Javascript.

[9] Take care to observe you stay within the Tor network -- 'downgrade' attacks have been observed that result in clearnet URLs being loaded in place of onion services across successive page loads on some sites.

[10] Thereby circumventing any possible future problems, like the breakage of Whonix.

[11] Bidirectional clipboard sharing is currently enabled by default in Whonix VirtualBox VMs. There are security reasons to disable clipboard sharing, for example to prevent the accidental copying of something (non-)anonymous and pasting it in its (non-)anonymous counterpart such as a browser, which would lead to identity correlation.

[12] Providing a mechanism to access files of the host system from within the guest system via a specially defined path necessarily enlarges the attack surface and provides a potential pathway for malicious actors to compromise the host.

[13] Such as system information, host time, system uptime, and fingerprinting of devices behind a router.

[14] This prevents time-related attack vectors which rely on leakage of the host time.

[15] ttps://forums.whonix.org/t/tor-connectionpadding/7477

[16] Via creation of a new Whonix-Gateway (sys-whonix).

[17] For example, Whonix users residing in China.

[18] This is useful when testing later Whonix releases to stymie deanonymization attempts by advanced adversaries, or when creating an identical backup that does not share any other persistent data, except for Tor state and custom torrc options.

[19] This is safe in the stable Qubes R4 release, but privacy issues were unresolved in Qubes R3.2 (now unsupported).

[20] Users can configure sys-net, sys-firewall and sys-usb as static Disposables. This option has been available from Qubes R4 onward.

[21] Reminder: The Subject: line and other header fields are not encrypted in the current configuration.

[22] The reason is adversaries observing traffic will need to perform classification of both traffic generated by the Tor relay or bridge and your personal client traffic.

[23] This provides an additional fail-safe to protect from accidental clearnet leaks that might arise from hypothetical Whonix bugs, but does not address potential Qubes ProxyVM leaks.

[24] ttps://github.com/rustybird/corridor

[25] Using two different computers and virtualization is one of the most secure configurations available, but may be less secure than Qubes' approach (software compartmentalization).

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]

[18]

[19]

[20]

[21]

[22]

[23]

[24]

[25]

System Hardening Checklist

Contents