bcl / whonix-user-qemu

QEMU startup scripts for running Whonix as a user

Run Whonix without root

These helper scripts will run Whonix Gateway and Workstation without needing root access, libvirt, or bridge support. It uses qemu user networking and a socket to communicate between the Workstation VM and the Gateway VM.

Download the KVM release of Whonix from here, verify the images and extract them.

First start the gateway::

run-gateway ./Whonix-Gateway-*qcow2

By default it uses 256M and runs in text mode. You can change this by setting MEM first. It also defaults to 2 CPUs, this can be changed by setting SMP when running it::

MEM=1024 SMP=1 run-gateway ./Whonix-Gateway-*qcow2

Then run the Workstation, MEM and SMP also work here. It defaults to 2048M of RAM and 2 CPUs.

run-workstation ./Whonix-Workstation-*qcow2

Communication between the VMs uses socket 7001 on localhost, and the traffic is not encrypted, so anyone one the local system who manages to gain enough privileges to monitor localhost could examine the traffic.

whonix-user-qemu's Issues

Firejailed

This is superb, I have gotten Whonix QEMU running in a firejail sandbox with Secomp and user namespace. In order to get gateway and workstation to communicate I have to join workstation to the gateway sandbox. Performance is excellent.

For further isolation I tried launching them in separate firejails that share a network namespace but workstation isn't connecting to gateway. This is a bit beyond me but I'm close enough to taste it. Thanks for the great script!

Whonix 15 KVM has both gateway and workstation rolled into single libvirt file

Whonix 15 KVM has both gateway and workstation rolled into a single unified ova libvirt file.
When I try to run the script with the unified OVA I get this error:

$ '/home/user/Downloads/Whonix/QEMU/whonix-user-qemu-master/run-workstation' '/home/user/Downloads/Whonix/QEMU/whonix-user-qemu-master/Whonix-XFCE-15.0.0.0.9.libvirt' SMP = 2 MEM = 2048 WARNING: Image format was not specified for '/home/user/Downloads/Whonix/QEMU/whonix-user-qemu-master/Whonix-XFCE-15.0.0.0.9.libvirt' and probing guessed raw. Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted. Specify the 'raw' format explicitly to remove the restrictions.

Is it possible to extract the individual qcow2 VMs out of the libvirt Whonix-XFCE-15.0.0.0.9.libvirt?