Installing Whonix in Qubes OS

Hello! Let's begin today's lesson.

Introduction

In our last session, we explored the theoretical underpinnings of Whonix. We focused on its two-part Gateway-Workstation architecture and established how this "security by isolation" model, enforced by the hypervisor, provides robust protection against IP address and DNS leaks, even if applications inside the Workstation are compromised.

Today, we transition from theory to practice. The learning outcome for this lesson is to install the Whonix Gateway and Workstation templates within Qubes OS. This is a critical hands-on step that adds the necessary tools for anonymity to our secure Qubes environment. We will use the dom0 terminal to fetch, install, and configure these new components, laying the foundation for all our future work with Tor.

1. System Preparation: Updating Dom0

Before installing any new components in Qubes, it's a critical security and stability practice to ensure that dom0—the most privileged domain—is fully up-to-date. This ensures we have the latest security patches and that the system's package manager and configuration tools are prepared for the new templates.

The official Whonix documentation outlines this as a mandatory first step.

Now, on your Qubes machine, please perform the following actions:

1. Open a dom0 terminal: Qubes App Launcher > Terminal Emulator.
2. Execute the update command you just read about:

   sudo qubes-dom0-update --show-output --console
   

   This command will connect to the repositories (via your sys-net and sys-firewall qubes) and download any available updates for dom0. This may take a few minutes.

After the update is complete, the documentation mentions a version number verification step. While the update should handle this, it's good practice to understand what it's doing. This step checks a configuration file used by Qubes' automation tool, SaltStack, to ensure it's aware of the correct Whonix version you intend to install. This is analogous to checking a dependency version in a requirements.txt file before running a Python project.

2. Installing the Whonix Templates

With dom0 updated, we can now install the Whonix templates. Qubes OS treats templates as packages that can be installed from software repositories. The standard Qubes repositories contain officially supported templates (like Fedora and Debian). Whonix, being a third-party project, is available from the community-maintained repository.

The installation process involves a single command that instructs the Qubes template manager (qvm-template) to install both the Gateway and Workstation templates.

In the same dom0 terminal, execute the installation command. Note the --enablerepo flag, which explicitly tells the package manager to look in the qubes-templates-community repository.

qvm-template install --enablerepo=qubes-templates-community whonix-gateway-17 whonix-workstation-17

This command will download and install two new templates:

• whonix-gateway-17-xfce (which will be named whonix-gw-17 in Qubes)
• whonix-workstation-17-xfce (which will be named whonix-ws-17 in Qubes)

Note: This download is several hundred megabytes and can take a significant amount of time depending on your internet connection.

3. Configuring the Whonix VMs with Salt

Installing the templates provides the "master images" for our Whonix VMs, but it doesn't create the VMs themselves. For that, we use Qubes' built-in configuration management system, Salt (or SaltStack).

You can think of Salt as an infrastructure-as-code tool, similar in principle to Ansible or Terraform. It allows for the scripted, repeatable creation and configuration of system components. Qubes uses it to automate the setup of VMs. We will execute a Salt "state file" (.sls) that contains all the necessary instructions to:

1. Create a new AppVM named sys-whonix based on the whonix-gw-17 template.
2. Create another AppVM named anon-whonix based on the whonix-ws-17 template.
3. Correctly configure the networking, setting anon-whonix to use sys-whonix as its NetVM.
4. Apply the appropriate tags and settings to integrate them into the Qubes system.

This is the final, mandatory step to make Whonix operational.

Now, run the command in your dom0 terminal:

sudo qubesctl state.sls qvm.anon-whonix

You will see a lot of output as Salt executes the configuration steps. Once it completes without errors, your Whonix system is installed and configured.

4. Verification

To confirm that the installation was successful, you can check in two places:

1. Qube Manager: Open the Qube Manager. You should see the two new templates (whonix-gw-17 and whonix-ws-17) listed with a "template" type. You should also see the two new AppVMs (sys-whonix and anon-whonix).
2. Application Menu: Click the Qubes App Launcher. You will now see entries for sys-whonix and anon-whonix, along with the templates.

The application menu should now contain entries similar to what is shown in the image below (your version numbers will be different).

Conclusion

In this lesson, we successfully transitioned from theory to a functional installation. By following a methodical, command-line-driven process, we have equipped our Qubes OS with the tools necessary for strong network anonymity.

Key Takeaways:

• System maintenance is crucial: Always update dom0 with sudo qubes-dom0-update before installing new system components.
• Qubes OS uses a repository system for templates. Whonix is found in the qubes-templates-community repository.
• The qvm-template install command is used to fetch and install new templates into dom0.
• Qubes Salt (qubesctl) is used to automate the creation and configuration of VMs based on the newly installed templates, ensuring a correct and repeatable setup.

Preview of the Next Lesson:
Now that we have the whonix-gw-17 and whonix-ws-17 templates, along with the default anon-whonix AppVM, we are ready to put them to use. In the next lesson, we will create a new AppVM based on the Whonix Workstation template for anonymous browsing and demonstrate how to use the Tor Browser within this isolated, secure environment.