Xubuntu as custom Whonix workstation

guides
, , , ,

If you are a Whonix user this guide may be useful for you. Sometimes when I want to torify whole traffic from a virtual system I am using Whonix Gateway virtual machine. For people who haven’t use Whonix yet here is a short description with links:

Whonix ™ consists of two VMs: the Whonix-Gateway ™ and the Whonix-Workstation ™. The former runs Tor processes and acts as a gateway, while the latter runs user applications on a completely isolated network.

xubuntu workstation

So sometimes in my virtual lab I want to use standard Linux distribution instead of the Whonix Workstation. There is a quite nice documentation about setting up a network in other operating systems. There is also section about Ubuntu, but since network configuration is now based on netplan, the wiki entry didn’t work for me. I set it up by myself, and decided to share the configuration steps. I did it on Xubuntu 22.04.

Whonix network configuration for Xubuntu

First, run the following set of commands to disable the NetworkManager:

1
2
3
sudo systemctl stop NetworkManager
sudo systemctl disable NetworkManager
sudo systemctl mask NetworkManager

Next, start and enable the systemd-networkd service:

1
2
3
sudo systemctl unmask systemd-networkd.service
sudo systemctl enable systemd-networkd.service
sudo systemctl start systemd-networkd.service

edit conf file:

1
sudo nano /etc/netplan/01-network-manager-all.yaml

Your config should look like the one below:

1
2
3
4
5
6
7
8
9
10
11
12
13
network:
  version: 2
  renderer: networkd
  ethernets:
    enp0s3:
      dhcp4: no
      addresses:
        - 10.152.152.12/18
      routes:
        - to: default
          via: 10.152.152.10
      nameservers:
        addresses: [10.152.152.10]

where enp0s3 is the name of your network adapter and apply new configuration:

1
sudo netplan apply

then shutdown the system.

In Virtual Box configuration for the virtual machine with Xubuntu choose network as Internal Network and name choose Whonix. (I guess you already have imported Whonix Gateway and know how to use it.)

Turn on the Gateway and your Xubuntu and that’s all. All the traffic from the Xubuntu machine is now passed through Whonix Gateway and “torified”.

Remember that Whonix Workstation has more security settings implemented, so you should harden your custom workstation for better security, privacy and anonymity. Check some cool comparison and read about More Security or Even More Security to make your custom workstation even better.

Firefox hardening

Basic steps would be to set some Firefox settings (hardening). Go to about:config and change some options. Of course all depends on your needs, but below you can find some suggestions.

Allow onion

1
network.dns.blockDotOnion false

Disable Firefox Screenshots extension

1
extensions.screenshots.disabled	true

Disable telemetry

1
2
3
4
5
browser.newtabpage.activity-stream.feeds.telemetry false
browser.ping-centre.telemetry false
browser.tabs.crashReporting.sendReport false
toolkit.telemetry.enabled false
toolkit.telemetry.unified false

Delete the URL for toolkit.telemetry.server, and leave it empty.

Disable Pocket

1
2
3
4
5
browser.newtabpage.activity-stream.feeds.discoverystreamfeed false
browser.newtabpage.activity-stream.feeds.section.topstories false
browser.newtabpage.activity-stream.section.highlights.includePocket false
browser.newtabpage.activity-stream.showSponsored false
extensions.pocket.enabled false

Disable prefetching

1
2
network.dns.disablePrefetch true
network.prefetch-next false

Disable JavaScript in PDF

1
pdfjs.enableScripting false

Disable Firefox account features

1
identity.fxaccounts.enabled false

Disable geolocation support

1
geo.enabled false

Disable notification support

1
dom.webnotifications.enabled false

Disable WebRTC

1
2
media.peerconnection.enabled false
media.navigator.enabled false

Disable WebGL

1
webgl.disabled true

Resist browser fingerprinting

1
privacy.resistFingerprinting true

Disable clipboard events

1
dom.event.clipboardevents.enabled false

Of course go to standard Firefox setting available from GUI and change some options too, like clear history and cookie every time when Firefox is closed etc.

If you would like to use Tor Browser on custom Whonix Workstation, don’t forget to set it up correctly to avoid Tor Over Tor scenario.